CVE-2021-43558: Improper Neutralization of Input During Web Page Generation

A flaw was found in Moodle in versions 3.11 to 3.11.3, 3.10 to 3.10.7, 3.9 to 3.9.10 and earlier unsupported versions. A URL parameter in the filetype site administrator tool required extra sanitizing to prevent a reflected XSS risk...

ShinHer StudyOnline System security vulnerabilities

ShinHer StudyOnline System is a school administration system from ShinHer, China. " feature is not controlled by permissions. An attacker could use this vulnerability to access other users' message board content by setting URL parameters after logging in with user privileges...

CVE-2021-40542

Opensis-Classic Version 8.0 is affected by cross-site scripting XSS. An unauthenticated user can inject and execute JavaScript code through the linkurl parameter in Ajaxurlencode.php...

CVE-2021-41120

sylius/paypal-plugin is a paypal plugin for the Sylius development platform. In affected versions the URL to the payment page done after checkout was created with autoincremented payment id /pay-with-paypal/id and therefore it was easy to predict. The problem is that the Credit card form has...

Prototype Pollution

aurelia-path is vulnerable to prototype pollution. An attacker is able to modify object class Object by tricking an application to parse the following URL: https://aurelia.io/blog/?protoasdf=asdf...

CVE-2021-36440

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'fileurl' parameter in the component AdminUpdateController.class.php'...

PT-2021-21270

Name of the Vulnerable Software and Affected Versions ShowDoc version 2.9.5 Description The issue allows remote attackers to execute arbitrary code via the file url parameter in the AdminUpdateController.class.php component. This enables attackers to upload files without restrictions, potentially...

Mautic Cross-Site Scripting Vulnerability (CNVD-2021-70088)

Mautic is an open source marketing automation software that monitors and manages websites, sends emails and manages customer resources. Mautic is vulnerable to a cross-site scripting vulnerability that stems from an XSS vulnerability on Mautic's password reset page, where a vulnerable parameter...

Mautic cross-site scripting vulnerabilities

Mautic is an open source marketing automation software that monitors and manages websites, sends emails and manages customer resources. Mautic is vulnerable to a cross-site scripting vulnerability that stems from an XSS vulnerability on Mautic's password reset page, where a vulnerable parameter...

CVE-2021-24550

The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an authenticated SQL injection issue...

Sql injection

The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an authenticated SQL injection issue...

PT-2021-16070

Name of the Vulnerable Software and Affected Versions Broken Link Manager WordPress plugin versions 0.6.5 and earlier Description The issue arises from the plugin not sanitizing, validating, or escaping the url GET parameter before using it in a SQL statement when retrieving a URL to edit. This...

Cross site scripting

A persistent cross-site scripting vulnerability was discovered in the Excerpt parameter in Textpattern CMS 4.9.0 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting the 'Articles' page...

CVE-2021-28001

A cross-site scripting vulnerability was discovered in the Comments parameter in Textpattern CMS 4.8.4 which allows remote attackers to execute arbitrary code via a crafted payload entered into the URL field. The vulnerability is triggered by users visiting...

CVE-2021-34655

The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter found in the /inc/class.ajax.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.11...

CVE-2021-34655 WP Songbook <= 2.0.11 Reflected Cross-Site Scripting

The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter found in the /inc/class.ajax.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.11...

PT-2021-20623

Name of the Vulnerable Software and Affected Versions: WP Songbook WordPress plugin versions up to and including 2.0.11 Custom Post Type Relations WordPress plugin versions up to and including 1.0 Description: The issue allows attackers to inject arbitrary web scripts via Reflected Cross-Site...

CVE-2021-34655: Improper Neutralization of Input During Web Page Generation

The WP Songbook WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the url parameter found in the /inc/class.ajax.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.11...

CVE-2021-36601

GetSimpleCMS 3.3.16 contains a cross-site Scripting XSS vulnerability, where Function TSL does not filter check settings.php Website URL: "siteURL" parameter...

getsimplecms cross-site scripting vulnerabilities

getsimplecms is a content management system for individual developers. A cross-site scripting vulnerability exists in getsimplecms, which stems from an XSS vulnerability in the siteURL parameter of the /admin/settings.php page...