CVE-2022-32049: Out-of-bounds Write

TOTOLINK T6 V4.1.9cu.5179B20201015 was discovered to contain a stack overflow via the url parameter in the function FUN00418540...

Reflected XSS in type url parameter

Description The application has a reflected xss vulnerability in the url parameter type. Proof of Concept // PoC.js var payload = "alertdocument.cookie...

[SECURITY] Fedora 35 Update: python-bottle-0.12.21-2.fc35

Bottle is a fast and simple micro-framework for small web-applications. It offers request dispatching Routes with URL parameter support, Templates, a built-in HTTP Server and adapters for many third party WSGI/HTTP-server and template engines. All in a single file and with no dependencies other...

CVE-2022-31784

A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker that has network access to the management interface to conduct a buffer overflow attack due to insufficient validation of URL...

CVE-2022-31784

A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker that has network access to the management interface to conduct a buffer overflow attack due to insufficient validation of URL...

CVE-2022-32364

Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/admin/?page=products/manageproduct&id=...

CVE-2022-32342

Hospital's Patient Records Management System v1.0 is vulnerable to SQL Injection via /hprms/admin/roomtypes/viewroomtype.php?id=...

Server-Side Template Injection

nystudio107/craft-seomatic is vulnerable to server-side template injection. The vulnerability exists due to the lack of sanitization used for the url parameter in the safeCanonicalUrl function of Helper.php, allowing an attacker to inject and execute malicious code...

CVE-2021-41750: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the SEOmatic plugin 3.4.10 for Craft CMS 3 allows remote attackers to inject arbitrary web script via a GET to /index.php?action=seomatic/file/seo-file-link with url parameter containing the base64 encoded URL of a malicious web page / file and fileName...

PT-2022-11474

Name of the Vulnerable Software and Affected Versions SEOmatic plugin version 3.4.10 for Craft CMS 3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script via a GET to "/index.php?action=seomatic/file/seo-file-link" with url parameter containing the...

CVE-2022-31386

A Server-Side Request Forgery SSRF in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter...

PT-2022-20725

Name of the Vulnerable Software and Affected Versions nbnbk cms version 3 Description A Server-Side Request Forgery SSRF issue exists in the getFileBinary function, allowing attackers to force the application to make arbitrary requests by injecting arbitrary URLs into the URL parameter...

Barco Control Room Cross-Site Scripting Vulnerability

Barco Control Room is a visualization and collaboration solution from Barco Belgium. Used to build control rooms, a cross-site scripting vulnerability exists in the Barco Control Room Management Suite web application prior to version 3.14. The vulnerability stems from the URL parameter of the...

CVE-2022-31386: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the URL parameter...

Cross site scripting

kkFileView v4.0.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

Keking kkFileView 跨站脚本漏洞

Keking KkFileview is a Spring-Boot build file document online preview project from Keking Technology Keking, China. A security vulnerability exists in kkFileView version 4.0.0, which originates from. A cross-site scripting XSS vulnerability was found via the url parameter in...

CVE-2022-29349

kkFileView v4.0.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

CVE-2022-29349

kkFileView v4.0.0 was discovered to contain a cross-site scripting XSS vulnerability via the url parameter at /controller/OnlinePreviewController.java...

CVE-2022-29349

kkFileView 4.0.0 is affected by CVE-2022-29349, with multiple XSS vulnerabilities exposed via the url/currentUrl parameters in /controller/OnlinePreviewController.java. The issue enables injection of script code into a victim’s browser, potentially enabling session hijacking, defacement, or leaka...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the currentURL parameter on the Portal Workflow module's edit process page, which is accepted and rendered without sanitization. Details Cross-site scripting or XSS is a code vulnerability that occurs when a...