CVE-2023-37473 Limited code execution in zenstruck/collections

zenstruck/collections is a set of helpers for iterating/paginating/filtering collections. Passing callable strings ie system caused the function to be executed. This would result in a limited subset of specific user input being executed as if it were code. This issue has been addressed in commit...

Regular Expression Denial Of Service (ReDoS)

apacheairflow is vulnerable to Regular expression Denial of Service ReDoS. The vulnerability exists in the partialsubset function at dag.py due to not validating user input regex efficiently which allows an attacker to send a crafted input causing an application crash...

Cross-Site Scripting (XSS)

wintercms/winter and winter/storm are vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape user input, which allows an attacker with backend.managebranding permissions to upload SVGs as the application logo and execute malicious javascript on victim's browser...

PT-2023-25985 · Unknown · Zenstruck/Collections

Name of the Vulnerable Software and Affected Versions: zenstruck/collections versions prior to 0.2.1 Description: The issue arises from passing callable strings, such as system, which causes the function to be executed. This results in a limited subset of specific user input being executed as if ...

CVE-2023-29456

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

CVE-2023-29456

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

UBUNTU-CVE-2023-29456

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

CVE-2023-29456 Inefficient URL schema validation

URL validation scheme receives input from a user and then parses it to identify its various components. The validation scheme can ensure that all URL components comply with internet standards...

Cross Site Scripting (XSS)

Decidim is vulnerable to Cross Site Scripting XSS vulnerability. The vulnerability is due to not sanitising user input correctly while processing proposals leading to attacker make other users endorse or support proposals they have no intention of supporting or endorsing...

Cross-site Scripting (XSS)

mediawiki/core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in the SiteLinksView.php which allows an attacker to inject and execute arbitrary JavaScript into the browser...

Adobe ColdFusion 代码问题漏洞

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. Adobe ColdFusion has a deserialization vulnerability that arises from unsafe deserialization of...

WordPress Plugin WP EasyCart SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin WP EasyCar...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user-input sanitization in the processes filter. This allows a remote attacker to execute JavaScript code in the context of a currently logged-in user. An attacker could use this vulnerability to...

Cross site scripting

A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8. Affected by this vulnerability is an unknown functionality of the file /load.php. The manipulation of the argument firstname/secondname/phone/address1/country leads to cross site scripting...

PT-2023-25811 · Unknown · Kodexplorer

Name of the Vulnerable Software and Affected Versions: KodExplorer version 4.51 Description: The issue concerns a Cross-Site Scripting XSS vulnerability located in the Description box of the Light App creation feature. An attacker can exploit this by injecting XSS syntax into the Description fiel...

CVE-2023-20133

A vulnerability in the web interface of Cisco Webex Meetings could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability exists because of insufficient validation of user-supplied input in Webex Events class...

PT-2023-25203 · Outline · Outline

Name of the Vulnerable Software and Affected Versions: outline/outline versions prior to 0.70.1 Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input and later displays it without proper validation or escaping, allowing an...

CVE-2023-36859

PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands...

CVE-2023-36859 PiiGAB M-Bus Code Injection

PiiGAB M-Bus SoftwarePack 900S does not correctly sanitize user input, which could allow an attacker to inject arbitrary commands...

inDrive: Blind SQL injection on id.indrive.com

A blind SQL injection vulnerability was found where user input was not sanitized before being used in SQL queries. This allowed arbitrary SQL commands to be injected, revealing details of the backend database...