Remote Code Execution

friendsofsymfony1/symfony1 is vulnerable to Remote Code Execution. The vulnerability due to improper handling of user input during deserialization of the sfNamespacedParameterHolder class, allowing attackers to achieve remote code execution if the application deserializes user input from the clas...

Remote Code Execution

friendsofsymfony1/symfony1 is vulnerable to Remote Code Execution. The vulnerability is due to the ability to abuse the destruct methods in Swift Mailer classes, which can be exploited to execute arbitrary PHP code if a developer unserializes untrusted user input...

PT-2024-23050 · Woocommerce · Venipak For Woocommerce

Name of the Vulnerable Software and Affected Versions: Shipping with Venipak for WooCommerce versions 1.19.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables...

PT-2024-23052 · Dearflip · Dearflip

Name of the Vulnerable Software and Affected Versions: DearFlip versions through 2.2.26 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables attackers to inject malicious scripts int...

PT-2024-23291

Name of the Vulnerable Software and Affected Versions Andy Moyle Church Admin versions 4.0.27 and earlier Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecti...

PT-2024-23057 · Softlab · Softlab Radio Player

Name of the Vulnerable Software and Affected Versions: SoftLab Radio Player versions 2.0.73 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can inject...

Cache Poisoning Vulnerability

Summary An attacker controlling the second variable of the translate function is able to perform a cache poisoning attack. They can change the outcome of translation requests made by subsequent users. Details The opt.id parameter allows the overwriting of the cache key. If an attacker sets the id...

CVE-2024-29374

A Cross-Site Scripting XSS vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter...

GHSA-3QW5-V9CC-V262 Cross site scripting in moodle

A Cross-Site Scripting XSS vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter...

Cross site scripting in moodle

A Cross-Site Scripting XSS vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter...

CVE-2024-29374

A Cross-Site Scripting XSS vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter...

CVE-2024-29374

A Cross-Site Scripting XSS vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter...

Security Bulletin: IBM License Metric Tool is vulnerable to cross-script scripting due to use of jQuery Cookie.

Summary jQuery is used by IBM License Metric Tool to provide UI functionality and process user-supplied input. Vulnerability Details CVEID:CVE-2022-23395 DESCRIPTION: jQuery Cookie is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could...

CVE-2024-29374

A Cross-Site Scripting XSS vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter...

CVE-2024-29374

A Cross-Site Scripting XSS vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter...

CVE-2024-29374

A Cross-Site Scripting XSS vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter...

PT-2024-22193 · Repute Infosystems · Armember

Name of the Vulnerable Software and Affected Versions: Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup versions through 4.0.23 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also kno...

OneBlog 安全漏洞

OneBlog is a Java blog. OneBlog v2.3.4 version of a cross-site scripting vulnerability , the vulnerability stems from the Lab module under the Category List parameter of the user-supplied data lack of effective filtering and escaping , an attacker can exploit the vulnerability by injecting a...

Fedora 38 : rubygem-yard (2024-3744975c4b)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-3744975c4b advisory. A security flaw was found on rubygem-yard that documents generated by yard may be vulnerable to XSS attack. This issue is now assigned as CVE-2024-27285 . Th...

PT-2024-18471 · WordPress · Simple Ajax Chat

Name of the Vulnerable Software and Affected Versions: The Simple Ajax Chat WordPress plugin versions prior to 20240223 Description: The issue concerns the reflection of unsanitized input to other users, specifically when visitors use malicious names in the chat. This allows for potential malicio...