57 matches found
Cross-site Scripting (XSS)
Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the processing of user-supplied input in form fields. A low-privileged attacker attacker can execute arbitrary JavaScript in the context of a...
PT-2024-6878 · Centreon · Centreon
Name of the Vulnerable Software and Affected Versions: Centreon version 24.04.2 Description: A SQL injection vulnerability allows a remote high-privileged attacker to execute arbitrary SQL commands via create user form inputs. This issue is related to the lack of protection of the SQL query...
CVE-2024-0352
A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. This vulnerability affects the function FileServer::userFormImage of the file server/application/api/controller/File.php of the component HTTP POST Request Handler. The manipulation of the argument file leads to...
PT-2024-15488
Name of the Vulnerable Software and Affected Versions Likeshop versions up to 2.5.7.20210311 Description A critical vulnerability was found in the function FileServer::userFormImage of the file server/application/api/controller/File.php, which is part of the HTTP POST Request Handler component. T...
PT-2023-29038 · Emsigner · Emsigner
Name of the Vulnerable Software and Affected Versions: EMSigner version 2.8.7 Description: The issue is related to incorrect access control in the AdHoc User creation form, allowing unauthenticated attackers to modify usernames and privileges using the email address of a registered user...
CVE-2023-29454 Persistent XSS in the user form
Stored or persistent cross-site scripting XSS is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload e.g., in a database or server-side text files, and finally, the application unintentionally executes the payload for every victi...
CVE-2023-29454 Persistent XSS in the user form
Stored or persistent cross-site scripting XSS is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload e.g., in a database or server-side text files, and finally, the application unintentionally executes the payload for every victi...
Flask-AppBuilder 安全漏洞
Flask-AppBuilder is a simple and fast application development framework. A security vulnerability exists in Flask-AppBuilder versions prior to 4.3.2, which can be exploited by an attacker to trigger a database error by adding special characters to the Add, Edit user form...
CVE-2023-31703
Cross Site Scripting XSS in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter...
CVE-2023-31703
Cross Site Scripting XSS in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter...
PT-2023-23423 · Escan · Escan
Name of the Vulnerable Software and Affected Versions: eScan management console version 14.0.1400.2281 Description: The issue is related to Cross Site Scripting XSS in the edit user form, allowing a remote attacker to inject arbitrary code via the from parameter. This enables the attacker to...
Remote Code Execution
tribalsystems/zenario is vulnerable to remote code execution. It is possible for a remote attacker to upload and execute malicious code on the system via the vulnerable handlePluginAJAX function in modulecode.php which resides inside User Form module, when the file upload is enabled...
CVE-2022-38619
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:jid90 parameter at /SVFE2/pages/feegroups/mccgroup.jsf...
PT-2022-24486 · Unknown · Smartvista Svfe2
Name of the Vulnerable Software and Affected Versions: SmartVista SVFE2 version 2.2.22 Description: The issue is a SQL injection vulnerability. It can be exploited via the UserForm:j id90 parameter at the "/SVFE2/pages/feegroups/mcc group.jsf" endpoint. Recommendations: For SmartVista SVFE2 versi...
CVE-2022-38618
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:jid88, UserForm:jid90, and UserForm:jid92 parameters at /SVFE2/pages/feegroups/countrygroup.jsf...
SmartVista SVFE2 SQL注入漏洞
SmartVista SVFE2 is a subsystem of SmartVista, Inc. A security vulnerability exists in SmartVista SVFE2 version v2.2.22, which can be exploited to achieve SQL injection via the UserForm:jid88, UserForm:jid90, UserForm:jid92 parameters of the /SVFE2/pages/feegroups/countrygroup.jsf component. id92...
CVE-2022-38616
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:jid90 parameter at /feegroups/tgrtgroup.jsf...
SmartVista SVFE2 SQL注入漏洞
SmartVista SVFE2 is a subsystem of SmartVista, Inc. A security vulnerability exists in SmartVista SVFE2 version v2.2.22, which originates from the UserForm:jid90 parameter in /feegroups/tgrtgroup.jsf contains a SQL injection vulnerability...
Crime Reporting System 1.0 Cross Site Scripting
Exploit Title: Crime reporting system - Stored cross-site scripting XSS Date: 29/07/2022 Exploit Author: Eslam Reda Vendor Homepage: https://sourcecodehero.com/crime-reporting-system-project-in-php-with-source-code/ Software Link:...