MyBB File Name Cross-Site Scripting Vulnerability

MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is characterized by its simplicity, multi-language support and extensibility. A cross-site scripting vulnerability exists in MyBB before version 1.8.31, which stems from the lack o...

Backdrop CMS Comment Cross-Site Scripting Vulnerability

Backdrop CMS is an open source content management system CMS. A cross-site scripting vulnerability exists in Backdrop CMS Comment version 1.23.0, which can be exploited by attackers to launch cross-site scripting XSS attacks due to a lack of effective filtering and escaping of user-supplied data...

WordPress Muffingroup Betheme theme plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Muffingroup Betheme theme plugin 26.6.1 and earlier versions have a cross-site scripting...

Backdrop CMS Card Cross-Site Scripting Vulnerability

Backdrop CMS is an open source content management system CMS. A cross-site scripting vulnerability exists in Backdrop CMS Card version 1.23.0, which stems from the lack of effective filtering and escaping of user-supplied data, and can be exploited by attackers to inject cross-site code and launc...

Fusiondirectory Cross-Site Scripting Vulnerability

FusionDIrectory is a FusionDIrectory open source application. Used to ensure that the user's identity management security. A cross-site scripting vulnerability exists in Fusiondirectory version 1.3. The vulnerability stems from a lack of effective filtering and escaping of user-supplied data, whi...

Moodle reflected cross-site scripting vulnerability in policy tool

A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in...

GHSA-XV72-6PGH-CJJ8 Moodle stored-XSS vulnerability in some "social" user profile fields

The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fields. An attacker could inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website...

Cross site scripting

A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool. An attacker can trick the victim to open a specially crafted link that executes an arbitrary HTML and script code in user's browser in...

Google TensorFlow tf.keras.losses.poisson buffer overflow vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A buffer overflow vulnerability exists in Google TensorFlow versions 2.9.0 and later, and versions prior to 2.9.3, which stems from a lack of proper validation of user-supplied data in...

Google TensorFlow BaseCandidateSamplerOp Buffer Error Vulnerability

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A buffer error vulnerability exists in Google TensorFlow versions prior to 2.8.4, 2.9.0 and later, and prior to 2.9.3, which stems from a lack of validation of user-supplied data in the...

CVE-2022-45151

Summary: CVE-2022-45151 is a stored-XSS vulnerability in Moodle caused by insufficient sanitization of data in several social user profile fields. An attacker could inject and execute arbitrary HTML/script code in a user’s browser within the context of the vulnerable site. The CVSSv3.1 base score...

PHPGurukul Blood Donor Management System Cross-Site Scripting Vulnerability

The PHPGurukul Blood Donor Management System is a blood donor management system from PHPGurukul, USA. A cross-site scripting vulnerability exists in version 1.0 of the Phpgurukul Blood Donor Management System, which stems from a lack of effective filtering and escaping of user-supplied data at Ad...

WBCE CMS Section Header Field Cross-Site Scripting Vulnerability

WBCE CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in WBCE CMS v1.5.4 and its previous versions, which stems from the lack of effective filtering and escaping of user-supplied data in the Section Header field of the Show...

SilverStripe 跨站脚本漏洞

SilverStripe is New Zealand SilverStripe company's set of open source programming framework and content management system CMS. The system has support for multiple languages , cross-platform and other features . A cross-site scripting vulnerability exists in SilverStripe 4.11 and earlier versions...

Microsoft Excel FBX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Excel. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX...

ManageEngine ServiceDesk Plus MSP generateSQLReport Improper Input Validation Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of ManageEngine ServiceDesk Plus MSP. Authentication is required to exploit this vulnerability. The specific flaw exists within the generateSQLReport function. The issue results from the lack of proper...

Student Attendance Management System Cross-Site Scripting Vulnerability

Student Attendance Management System is a student attendance management system. The vulnerability is caused by the lack of effective filtering and escaping of user-supplied data in the className parameter of the createClass.php file, which can be exploited to cause cross-site scripting attacks...

Cross-Site Scripting Vulnerability in WordPress Ezoic

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Ezoic 2.8.8 and earlier versions, which stems from a lack of effective filtering and...

Siemens Simcenter Femap X_T File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Siemens Simcenter Femap. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsin...

CVE-2022-3377

Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by accessing an uninitialized pointer, leading to an out-of-bounds memory...