CVE-2023-2399 qubotchat < 1.1.6 - Unauthenticated Stored XSS

The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard...

CVE-2023-2399 qubotchat < 1.1.6 - Unauthenticated Stored XSS

The QuBot WordPress plugin before 1.1.6 doesn't filter user input on chat, leading to bad code inserted on it be reflected on the user dashboard...

ROS-20230619-02

A vulnerability in the Redis database is related to insufficient validation of user-entered data, a user could use the HINCRBYFLOAT command to create an invalid hash field. Exploitation of the vulnerability could allow an attacker acting remotely to cause Redis to crash when accessing the affecte...

Stored XSS on user "Category report" function

Description An attacker can inject malicious executable scripts into the code of the Name field Proof of Concept Log in as an admin or any member with the right access to the Category report - Configuration function. Insert this payload into the "Name" field General role assignment" autofocus...

PT-2023-24002 · Thinking · Thinking Software Efence

Name of the Vulnerable Software and Affected Versions: Thinking Software Efence affected versions not specified Description: The issue is related to insufficient validation for user input in the login function, allowing an unauthenticated remote attacker to inject arbitrary SQL commands. This can...

Code Injection

nuxt is vulnerable to Code Injection. The vulnerability exists due to a lack of user input path validation in test-component-wrapper.ts which allows an attacker to inject and execute malicious code. Note that this vulnerability is only applicable if the server is ran on dev mode...

Denial Of Service (DoS)

org.codehaus.janino:janino is vulnerable to Denial of Service DoS attacks. The vulnerability is due to the guessParameterNames method caused to an uncaught stack overflow exception, which can be triggered by user input with deeply nested structures causing the application to crash...

CVE-2023-25367

Siglent SDS 1104X-E SDS1xx4X-EV6.1.37R9.ADS allows unfiltered user input resulting in Remote Code Execution RCE with SCPI interface or web server...

Cross site scripting

SAP UI5 Variant Management - versions SAPUI 750, SAPUI 754, SAPUI 755, SAPUI 756, SAPUI 757, UI700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting Stored XSS vulnerability. After successful exploitation, an attacke...

CVE-2023-33991 Stored Cross-Site Scripting (Stored XSS) vulnerability in SAP UI5 Variant Management

SAP UI5 Variant Management - versions SAPUI 750, SAPUI 754, SAPUI 755, SAPUI 756, SAPUI 757, UI700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting Stored XSS vulnerability. After successful exploitation, an attacke...

CVE-2023-33986 Cross-Site Scripting (XSS) vulnerability in SAP CRM ABAP (Grantor Management)

SAP CRM ABAP Grantor Management - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the applicatio...

WordPress Plugin Page Builder: KingComposer Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Page Builder: KingComposer, which is caused by incorrect validation of...

EulerOS Virtualization 3.0.6.0 : ruby (EulerOS-SA-2023-2248)

According to the versions of the ruby package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The cgi gem before 0.1.0.2, 0.2.x before 0.2.2, and 0.3.x before 0.3.5 for Ruby allows HTTP response splitting. This is relevant to...

HTML Injection

teampass password manager is vulnerable to HTML injection .The vulnerability is due to lack of user input sanitisation while renaming a folder with user supplied folder name resulting in running malicious html when the same folder is accessed by other users including admin...

GHSA-QMW8-X364-XXXM Teampass Cross-site Scripting vulnerability

In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting XSS vectors in the application...

Teampass Cross-site Scripting vulnerability

In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting XSS vectors in the application...

Teampass Cross-site Scripting vulnerability

In versions of nilsteampassnet/teampass prior to 3.0.9 some user input was not properly sanitized which may have lead to stored cross-site scripting XSS vectors in the application...

CVE-2023-3184

A vulnerability was found in SourceCodester Sales Tracker Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save. The manipulation of the argument firstname/middlename/lastname/username leads to cross sit...

LeafKit allows XSS with untrusted user input

This affects anyone passing unsanitised data to Leaf's variable tags. Before this fix, Leaf would not escape any strings passed to tags as variables. If an attacker managed to find a variable that was rendered with their unsanitised data, they could inject scripts into a generated Leaf page, whic...

Stored XSS vulnerability

Description The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Proof of Concept 1 Step1: The user has the right to access and perform the creation of surveys, with the payload...