14513 matches found
WS-2023-0119
User Input that is reflected in a JavaScript Context is not properly sanitized. The User Input is reflected inside of a single-quoted string and single-quotes are encoded. However, there is an issue with the entity removing HTML tags that prevents single-quotes from being encoded. This allows...
GHSA-PJFJ-QVQW-3F6V Apache StreamPark LDAP Injection vulnerability
Apache StreamPark versions 1.0.0 to 2.0.0 have an LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements...
Apache StreamPark LDAP Injection vulnerability
Apache StreamPark versions 1.0.0 to 2.0.0 have an LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements...
CVE-2022-45801
Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through...
Sql injection
Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through...
CVE-2022-45801 Apache StreamPark (incubating): LDAP Injection Vulnerability
Apache StreamPark 1.0.0 to 2.0.0 have a LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements through...
Cross-Site Scripting (XSS)
microweber/microweber is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in the template parameter of template.php which allows an attacker to inject and execute arbitrary JavaScript into the browser...
PT-2023-21196 · Unknown · Thorsten/Phpmyfaq
Name of the Vulnerable Software and Affected Versions: thorsten/phpmyfaq versions prior to 3.2.0-beta Description: The issue is related to Cross-site Scripting XSS - Stored, which occurs when an application stores user input without proper validation and later displays it, allowing attackers to...
Cross-Site Scripting (XSS)
microweber/microweber is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in the X-Forwarded-For header, which allows an attacker to inject and execute arbitrary JavaScript into the browser...
PT-2023-2883 · Cisco · Cisco Prime Collaboration Deployment
Name of the Vulnerable Software and Affected Versions: Cisco Prime Collaboration Deployment affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Prime Collaboration Deployment could allow an unauthenticated, remote attacker to conduct a...
PT-2023-22540 · Sourcecodester · Sourcecodester Medicine Tracker System
Name of the Vulnerable Software and Affected Versions: Sourcecodester Medicine Tracker System in PHP version 1.0.0 Description: The issue is related to Cross Site Scripting XSS and can be exploited via the page parameter, specifically when set to about. This allows for malicious scripts to be...
Cross-Site Scripting (XSS)
sidekiq is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in application.rb which allows an attacker to inject and execute arbitrary JavaScript into the browser through the /metric endpoint...
CVE-2023-22916
The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FLEX 50W firmware versions 5.10 through 5.35, USG20W-VPN firmware versions 5.10 through 5.35, and VPN series firmware versions 5.00 through 5.35, which fails ...
WordPress CAPTCHA 4WP Plugin < 7.1.0 CSRF Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wpwhitesecurity:captcha4wp"; if description...
AeroCMS Cross-Site Scripting Vulnerability (CNVD-2023-32025)
AeroCMS is a content management system from the American company AeroCMS. AeroCMS version v0.0.1 suffers from a cross-site scripting vulnerability that stems from the commentauthor and commentcontent parameters of /post.php failing to properly validate user input. An attacker can exploit this...
Cross site scripting
In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could leverage a reflected XSS vulnerability to execute arbitrary code within the context of a Flowmon user's web browser...
CVE-2021-36436
An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via submission to the forgotten-password endpoint...
PT-2023-16233 · M Files · M-Files Server
Name of the Vulnerable Software and Affected Versions: M-Files Server versions prior to 23.4.12528.1 Description: The issue allows for Denial of Service due to uncontrolled memory consumption for a scheduled job, caused by user-controlled operations. Recommendations: For versions prior to...