154 matches found
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Description Pimcore settings module is vulnerable to stored cross site scripting Proof of Concept 1 . Login to dev demo account. https://10.x-dev.pimcore.fun/ 2 . Goto settings --data objects --Add a new class -- add payload in icon field 3 . Click save and close and open that class alert will...
Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework
Description Stored cross site scripting vulnerability in pimcore app, name and description field field is vulnerable to xss in customer automation rules. Proof of Concept 1 .login to the account 2 .go to customers -- customer automation rules -- Add payload in name field. 3 .payload " Impact This...
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Description Stored cross site scripting vulnerability in report class field on custom report feature. Proof of Concept 1 . Login to dev account https://10.x-dev.pimcore.fun/admin/ 2 . Go to marketing -- custom reports -- Report class :field in left navigation menu 3 . Add payload " in report clas...
Cross-site Scripting (XSS) - Reflected in zikula/core
Description In zikula/core cross site scripting vulnerability in extension list name field. Proof of Concept 1. login to the demo account 2. go to extensions https://demo.ziku.la/extensions/module/modify/3 3. Add payload in displayname field payload " Impact This vulnerability is capable of stole...
CVE-2021-42699
The affected product is vulnerable to cookie information being transmitted as cleartext over HTTP. An attacker can capture network traffic, obtain the user’s cookie and take over the account...
CVE-2021-30086
Cross Site Scripting XSS vulnerability exists in KindEditor Chinese versions 4.1.12, which can be exploited by an attacker to obtain user cookie information...
CVE-2021-30086
Cross Site Scripting XSS vulnerability exists in KindEditor Chinese versions 4.1.12, which can be exploited by an attacker to obtain user cookie information...
CVE-2021-37267
Cross Site Scripting XSS vulnerability exists in all versions of KindEditor, which can be exploited by an attacker to obtain user cookie information...
Cross site scripting
Cross Site Scripting XSS vulnerability exists in all versions of KindEditor, which can be exploited by an attacker to obtain user cookie information...
CVE-2021-37267
Cross Site Scripting XSS vulnerability exists in all versions of KindEditor, which can be exploited by an attacker to obtain user cookie information...
WordPress Easy Social Icons Cross-Site Scripting Vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Easy Social Icons plugin is a WordPress open source application plugin. WordPress Easy Social Icons plugin in...
WordPress underConstruction cross-site scripting vulnerability
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the erection of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. WordPress underConstruction plugin in version 1.18...
JetBrains YouTrack Cross-Site Scripting Vulnerability (CNVD-2022-09231)
JetBrains YouTrack is a browser-based bug tracking and project management software from JetBrains Czech Republic. A cross-site scripting vulnerability exists in versions of JetBrains YouTrack prior to 2021.2.17925, which stems from the lack of proper validation of client-side data in the web...
IBM API Connect Cross-Site Scripting Vulnerability (CNVD-2021-88200)
IBM API Connect is an integrated solution for managing the API lifecycle from IBM USA. The product supports creating, running, managing and securing APIs, microservices and more. A cross-site scripting vulnerability exists in IBM API Connect. The vulnerability stems from the lack of proper...
WordPress W3 Total Cache plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. A cross-site scripting vulnerability exists in the WordPress plugin W3 Total Cache in versions prior to 2.1.4, which stems from a lack of validation of client-side data in the "extension" parameter of t...
Advantech R-SeeNet Cross-Site Scripting Vulnerability
Advantech R-SeeNet is an industrial monitoring software from Advantech, Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.A cross-site scripting vulnerability exists in Advantech R-SeeNet, which stems from the lack ...
XSS vulnerability in Jinan Speed Information Technology Co.
Jinan Speed Information Technology Co., Ltd. was founded in 2010, is a network technology company focusing on user experience design and development and Internet branding. There is an XSS vulnerability in Jinan Speed Information Technology Co., Ltd.'s website building system, which can be exploit...
Joomla! Cross-site scripting vulnerability (CNVD-2021-53938)
A cross-site scripting vulnerability exists in versions 3.0.0 to 3.9.27, which could be exploited to lure users into clicking on and executing client-side code to steal user cookie credentials...
IBM Datacap Fastdoc Capture Cross-Site Scripting Vulnerability
IBM Datacap Fastdoc Capture is a client-only capture software solution from IBM USA that automatically indexes scanned documents for accurate storage and retrieval. A cross-site scripting vulnerability exists in IBM Datacap Fastdoc Capture that stems from a lack of proper validation of client-sid...