Cross site scripting

IBM Rational Change 5.3 is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using the SUPPTEMPLATEFLAG parameter in a specially-crafted URL to execute script in a victim's Web browser within the security...

PT-2022-19963 · Unknown · Sourcecodester Online Market Place Site

Name of the Vulnerable Software and Affected Versions: Sourcecodester Online Market Place Site version 1.0 Description: The issue allows attackers to register as a Seller and then create new products containing XSS payloads in the 'Product Title' and 'Short Description' fields. This enables Cross...

PT-2022-25194 · Unknown · Simple College Website

Name of the Vulnerable Software and Affected Versions: Simple College Website version 1.0 Description: The issue is related to a reflected cross-site scripting XSS vulnerability. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...

PT-2022-25169 · Sourcecodester · Sourcecodester Simple Task Managing System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Task Managing System version 1.0 Description: The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fullName parameter in the newProjectValidation.php component. This...

Cross site scripting

HTML injection attack is closely related to Cross-site Scripting XSS. HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input...

CVE-2022-36055 Denial of service in Helm

Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. Fuzz testing, provided by the CNCF, identified input to functions in the strvals package that can cause an out of memory panic. The strvals package contains a parser that turns strings in to Go...

CVE-2022-38118

Affected software: OAKlouds Portal Meeting Room. The issue is a SQL injection caused by insufficient input validation. A remote attacker with general user privileges can access, modify, delete the database, perform system operations, and disrupt service. CVSS v3.1 base score 8.8 (AV:N/AC:L/PR:L/U...

PT-2022-24212 · Unknown · Oaklouds Portal

Name of the Vulnerable Software and Affected Versions: OAKlouds Portal affected versions not specified Description: The issue is related to insufficient validation for user input in the Meeting Room of the OAKlouds Portal website. This allows a remote attacker with general user privileges to...

PT-2022-23460

Name of the Vulnerable Software and Affected Versions Edoc-doctor-appointment-system version 1.0.1 Description The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability is located at the "/patient/settings.php" API endpoint and allows attackers to execute arbitra...

CVE-2022-20865 Cisco FXOS Software Command Injection Vulnerability

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The attacker would need to have Administrator privileges on the device. This vulnerability is due to insufficient input validation of...

Ajax Load More < 5.5.4.1 - Admin+ Arbitrary File Read

The plugin does not properly validates paths generated with user input in the almrepeatersexport function, which could allow high privilege users to read arbitrary files form the server even when they should not be able to have access to any, for example in multisite setup This is due to an...

WP Server Health Stats < 1.7.0 - Admin+ Stored Cross-Site Scripting

The plugin does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC As admin, put the following payload in the "Provide your IP-API Pro key", "Memcached Server Host", "Set the...

OTFCC Buffer Overflow Vulnerability (CNVD-2025-02612)

OTFCC is Caryll open source a C library and utility programs. Used to parse and write OpenType font files. A buffer overflow vulnerability exists in OTFCC version 0.10.4, which stems from a lack of proper validation of user-supplied data in the /release-x64/otfccdump+0x6e41a8 file, and can be...

PT-2022-22919 · Unknown · Sazanrjb Inventorymanagementsystem

Name of the Vulnerable Software and Affected Versions: sazanrjb InventoryManagementSystem version 1.0 Description: A SQL injection issue in CustomerDAO.java allows attackers to execute arbitrary SQL commands via the searchTxt parameter. This enables unauthorized access and manipulation of databas...

CVE-2022-20869

A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user of the interface. This vulnerability exists because the web-based management...

Information Disclosure

centreon/centreon is vulnerable to information disclosure. Lack of proper validation of user supplied strings while processing virtual metrics inDB-Func.php allows authenticated attackers to gain access to confidential user information such as stored credentials...

IBM DataPower Gateway Server-Side Request Forgery Vulnerability (CNVD-2022-56971)

IBM DataPower Gateway is a set of security and integration platforms from IBM USA designed specifically for mobile, cloud, application programming interface API, web, service-oriented architecture SOA, B2B and cloud workloads. The platform protects, integrates and optimizes access across channels...

Cross site scripting

A vulnerability in the web-based management interface of Cisco IoT Control Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly...

IBM Sterling Partner Engagement Manager Server-Side Request Forgery Vulnerability

IBM Sterling Partner Engagement Manager is an automation management tool from IBM U.S.A. A server-side request forgery vulnerability exists in IBM Sterling Partner Engagement Manager, which stems from the product's failure to properly validate user input and could be exploited by an authenticated...

CVE-2022-20800 Cisco Unified Communications Products Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM, Cisco Unified Communications Manager Session Management Edition Unified CM SME, Cisco Unified Communications Manager IM & Presence Service Unified CM IM&P, and Cisco Unity Connection could...