CVE-2024-31857

Forminator prior to 1.15.4 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remote attacker may obtain user information etc. and alter the page contents on the user's web browser...

WordPress plugin Forminator has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2023-38294

The Itel Vision 3 Turbo Android device is vulnerable because a pre-installed application, com.transsion.autotest.factory (versionCode='7', versionName='1.8.0(220310_1027)'), possesses inadequate access control . This flaw allows local third-party apps to execute arbitrary shell commands within th...

WonderCMS Home Page Cross-Site Scripting Vulnerability

WonderCMS is an open source PHP-based content management system CMS. A cross-site scripting vulnerability exists in WonderCMS v3.4.3, which stems from the lack of effective filtering and escaping of user-supplied data on the Home page, and can be exploited by an attacker to steal the victim's...

WonderCMS PAGE DESCRIPTION parameter cross-site scripting vulnerability

WonderCMS is an open source PHP-based content management system CMS. A cross-site scripting vulnerability exists in WonderCMS v3.4.3, which stems from the lack of effective filtering and escaping of user-supplied data in the PAGE DESCRIPTION parameter of the Settings section, and can be exploited...

Juniper Networks Test Agent Unauthorized Access

The vulnerability of the Test Agent component of the testing and monitoring platform for physical, hybrid, and virtual networks in Paragon Active Assurance for Juniper Networks’ Junos OS Evolved network devices of the ACX series is related to the unencrypted storage of user data. Exploiting this...

PT-2024-24689 · Melapress · Melapress Wp 2Fa

Name of the Vulnerable Software and Affected Versions: Melapress WP 2FA versions n/a through 2.6.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inje...

GO-2024-2730 WITHDRAWN: Directory traversal in FilesystemStore in github.com/gorilla/sessions

This report has been withdrawn on the grounds that it generates too many false positives. Session IDs are documented as not being suitable to hold user-provided data. FilesystemStore does not sanitize the Session.ID value, making it vulnerable to directory traversal attacks. If an attacker has...

CVE-2024-32463

The CVE-2024-32463 entry concerns phlex, a Ruby-based open source framework for building object-oriented views. The vulnerability is an XSS flaw in the handling of href attributes on tags, where the javascript: scheme can be bypassed by inserting tab or newline characters (e.g., java\tscript:). ...

GHSA-G7XQ-XV8C-H98C Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags

Summary There is a potential cross-site scripting XSS vulnerability that can be exploited via maliciously crafted user data. Our filter to detect and prevent the use of the javascript: URL scheme in the href attribute of an tag could be bypassed with tab \t or newline \n characters between the...

PT-2024-24667

Name of the Vulnerable Software and Affected Versions Code Insert Manager Q2W3 Inc Manager versions n/a through 2.5.3 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2024-24663

Name of the Vulnerable Software and Affected Versions Minoji MJ Update History versions 1.0.4 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an attacker can inject...

PT-2024-24520

Name of the Vulnerable Software and Affected Versions WonderCMS version 3.4.3 Description Multiple cross-site scripting XSS vulnerabilities in the Home page of WonderCMS allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters. This issue...

MindsDB Cross-Site Scripting Vulnerability (CNVD-2024-26182)

MindsDB is an emerging low-code machine learning platform from MindsDB, Inc. MindsDB suffers from a cross-site scripting vulnerability. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to execute...

CVE-2024-29839

The Web interface of Evolution Controller Versions 2.04.560.31.03.2024 and below contains poorly configured access control on DESKTOPEDITUSERGETCARD, allowing for an unauthenticated attacker to return the card value data of any user...

PT-2024-24174 · Unknown · Cosmetics/Beauty Product Online Store

Name of the Vulnerable Software and Affected Versions: Cosmetics and Beauty Product Online Store version 1.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter. This enables attacke...

iTop security vulnerabilities

iTop is a platform that provides all the resources needed to optimize iTop. A security vulnerability exists in iTop version 3.1.1, which stems from a cross-site scripting that may result when displaying/editing a user's personal token...

PT-2024-24441

Name of the Vulnerable Software and Affected Versions PineWise WP Google Analytics Events versions through 2.8.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2024-24176 · Unknown · Cosmetics/Beauty Product Online Store

Name of the Vulnerable Software and Affected Versions: Cosmetics and Beauty Product Online Store version 1.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name parameter. This enables attackers ...

CVE-2024-29839

The CVE-2024-29839 entry concerns Evolution Controller Web UI prior to a certain version. Affected: Evolution Controller Versions 2.04.560.31.03.2024 and earlier. Root cause: poorly configured access control on the DESKTOP_EDIT_USER_GET_CARD endpoint. Impact: unauthenticated attackers can retriev...