CVE-2025-42620: Improper Neutralization of Input During Web Page Generation

In affected versions, vulnerability-lookup handled user-controlled content in comments and bundles in an unsafe way, which could lead to stored Cross-Site Scripting XSS. On the backend, the relatedvulnerabilities field of bundles accepted arbitrary strings without format validation or proper...

CVE-2024-22414

flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the /user/ page allows a user's comments to execute arbitrary javascript code. The html template user.html contains the following code snippet to render comments made by a user: comment2|safe. Use of the "safe" tag...

CVE-2024-22414: Improper Neutralization of Input During Web Page Generation

flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the /user/ page allows a user's comments to execute arbitrary javascript code. The html template user.html contains the following code snippet to render comments made by a user: comment2|safe . Use of the "safe" ta...

PT-2019-11960

Name of the Vulnerable Software and Affected Versions HYBBS version 2.2 Description An issue was discovered that allows adding an administrator account due to a CSRF vulnerability in the "/?admin/user.html" API endpoint. Recommendations For HYBBS version 2.2, as a temporary workaround, consider...

CVE-2019-10644: Cross-Site Request Forgery (CSRF)

An issue was discovered in HYBBS 2.2. /?admin/user.html has a CSRF vulnerability that can add an administrator account...

Cross site request forgery (csrf)

In youke365 v1.1.5, admin/user.html has a CSRF vulnerability that can add an user account...

CVE-2018-18215

In youke365 v1.1.5, admin/user.html has a CSRF vulnerability that can add an user account...

CVE-2018-18215

In youke365 v1.1.5, admin/user.html has a CSRF vulnerability that can add an user account...

CVE-2018-18215

In Youke365 v1.1.5, the admin/user.html page contains a CSRF vulnerability that can be exploited by remote attackers to add a user account. The issue is documented across multiple sources (CVE-2018-18215) with CVSS v3.0 base score 8.8 (HIGH) and CVSS v2.0 base score 6.8 (MEDIUM) indicating unauth...

PT-2018-14373

Name of the Vulnerable Software and Affected Versions youke365 version 1.1.5 Description The issue concerns a CSRF vulnerability in the admin/user.html endpoint. This vulnerability can be exploited to add a user account. Recommendations For youke365 version 1.1.5, consider implementing proper CSR...

CVE-2018-18215: Cross-Site Request Forgery (CSRF)

In youke365 v1.1.5, admin/user.html has a CSRF vulnerability that can add an user account...

CVE-2008-3089: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in user.html in Xpoze Pro 3.06 aka Xpoze Pro CMS 2008 allows remote attackers to execute arbitrary SQL commands via the uid parameter...

XPOZE Pro 3.06 - uid SQL Injection

XPOZE Pro 3.06 - uid SQL Injection ^Hiva Digital Security Team^ ^HIva Team^ Script: Xpoze Pro CMS 2008 XPOZE Pro 3.06 SQL Injection Exploit Demo: http://demo.xpoze.org/ Authors: farenh3it, sn0wman Exploit:...

Unfixed XSS vulnerability at www.mywunschzettel.de

Security researcher kInGoFcHaOs, has submitted on 18/06/2008 a cross-site-scripting XSS vulnerability affecting www.mywunschzettel.de, which at the time of submission ranked 3485259 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 09/07/2008. It...

CVE-2006-4220: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in webacc in Novell GroupWise WebAccess before 7 Support Pack 3 Public Beta allow remote attackers to inject arbitrary web script or HTML via the 1 User.html, 2 Error, 3 User.Theme.index, and 4 and User.lang parameters...

CVE-2001-1458: Undefined Security Weakness

Directory traversal vulnerability in Novell GroupWise 5.5 and 6.0 allows remote attackers to read arbitrary files via a request for /servlet/webacc?User.html= that contains "../" dot dot sequences and a null character...