CVE-2024-34469

CVE-2024-34469 Rukovoditel up to 3.5.3 version is affected to cross-site scripting attack XSS The payload can be embedded in two places, on the registration page and in the user’s personal account with any privileges. The vulnerability is in the userphoto parameter. 1. Editing the personal accoun...

CVE-2024-34468

Rukovoditel before 3.5.3 allows XSS via userphoto to My Page...

CVE-2024-34468

Rukovoditel before 3.5.3 allows XSS via userphoto to My Page...

CVE-2024-34469

Rukovoditel before 3.5.3 allows XSS via userphoto to index.php?module=users/registration&action=save...

CVE-2024-34469

Rukovoditel before 3.5.3 allows XSS via userphoto to index.php?module=users/registration&action=save...

CVE-2024-34469: Improper Neutralization of Input During Web Page Generation

Rukovoditel before 3.5.3 allows XSS via userphoto to index.php?module=users/registration&action=save...

CVE-2024-34468

Versions of Rukovoditel prior to 3.5.3 are vulnerable to a Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input via the user_photo parameter when accessed on the My Page section. This vulnerability could allow for the execution of malicious scripts in the user's...

CVE-2024-34468: Improper Neutralization of Input During Web Page Generation

Rukovoditel before 3.5.3 allows XSS via userphoto to My Page...

CVE-2024-34468

Rukovoditel before 3.5.3 allows XSS via userphoto to My Page...

CVE-2024-34468

Rukovoditel before 3.5.3 allows XSS via userphoto to My Page...

CVE-2015-2994: Undefined Security Weakness

Unrestricted file upload vulnerability in ChangePhoto.jsp in SysAid Help Desk before 15.2 allows remote administrators to execute arbitrary code by uploading a file with a .jsp extension, then accessing it via a direct request to the file in icons/userphoto/...