PT-2023-17691 · Unknown · Sourcecodester Employee/Visitor Gate Pass Logging System

Name of the Vulnerable Software and Affected Versions: SourceCodester Employee and Visitor Gate Pass Logging System version 1.0 Description: A critical issue has been discovered, affecting an unknown function of the file /admin/maintenance/view designation.php, specifically the component GET...

SourceCodester Employee and Visitor Gate Pass Logging System SQL注入漏洞

Employee and Visitor Gate Pass Logging System is an employee and visitor pass logging system by Carlo Montero, an individual developer. SourceCodester Employee and Visitor Gate Pass Logging System version 1.0 suffers from a SQL injection vulnerability that stems from a problem in the file...

CVE-2023-2077

A vulnerability, which was classified as problematic, has been found in Campcodes Online Traffic Offense Management System 1.0. This issue affects some unknown processing of the file /admin/offenses/viewdetails.php. The manipulation of the argument id leads to cross site scripting. The attack may...

CVE-2023-2075

A vulnerability classified as critical has been found in Campcodes Online Traffic Offense Management System 1.0. This affects an unknown part of the file /admin/offenses/viewdetails.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. Th...

PT-2023-17613 · Campcodes · Campcodes Online Traffic Offense Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Traffic Offense Management System version 1.0 Description: A critical vulnerability has been found in the system, affecting the file /admin/offenses/view details.php. The manipulation of the id argument leads to SQL injection...

Campcodes Online Traffic Offense Management System SQL注入漏洞

Campcodes Online Traffic Offense Management System is a web-based traffic offense management system. A SQL injection vulnerability exists in Campcodes Online Traffic Offense Management System v1.0. The vulnerability stems from the lack of validation of external input SQL statements in the paramet...

PT-2023-17630 · Campcodes · Campcodes Online Traffic Offense Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Traffic Offense Management System version 1.0 Description: A problematic issue has been found in the system, affecting the processing of the file /admin/offenses/view details.php. The manipulation of the id argument leads to...

Nextcloud Server 24.0.4 < 24.0.7, 25.x < 25.0.1 Improper Access Control Vulnerability (GHSA-7w6h-5qgw-4j94)

Nextcloud Server is prone to an improper access control vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GHSA-4F8G-FQ6X-JQRR org.xwiki.platform:xwiki-platform-oldcore vulnerable to data leak through deleted documents

Impact Rights added to a document are not taken into account for viewing it once it's deleted. Note that this vulnerability only impact deleted documents that where containing view rights: the view rights provided on a space of a deleted document are properly checked. Patches The problem has been...

PT-2023-4805 · Ckeditor +1 · Ckeditor +1

Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 13.10.11 XWiki versions prior to 14.4.7 XWiki versions prior to 14.10 Description: The issue allows any user with view rights on commonly accessible documents, including the legacy notification activity macro, to execu...

ChatBot < 4.4.9 - Subscriber+ OpenAI Settings Update to Stored XSS

The plugin does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS Run the below command in...

CVE-2023-1908

A vulnerability was found in SourceCodester Simple Mobile Comparison Website 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/categories/viewcategory.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. ...

ERPNext 12.29 Cross Site Scripting

Exploit Title: ERPNext 12.29 - Cross-Site Scripting XSS Date: 7 Feb 2023 Exploit Author: Patrick Dean Ramos / Nathu Nandwani / Junnair Manla Github - https://github.com/patrickdeanramos/CVE-2022-28598 Vendor Homepage: https://erpnext.com/ Version: 12.29 CVE-2022-28598 Summary: Stored cross-site...

Simple Mobile Comparison Website SQL注入漏洞

Simple Mobile Comparison Website is a mobile comparison website by Carlo Montero personal developer. It allows users to compare the specifications of smartphones. SourceCodester Simple Mobile Comparison Website version 1.0 suffers from a SQL injection vulnerability that stems from a problem in th...

PT-2023-17330 · Unknown · Sourcecodester Simple Mobile Comparison Website

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Mobile Comparison Website version 1.0 Description: A critical issue has been found in the GET Parameter Handler component of the file /admin/categories/view category.php, where the manipulation of the id argument leads t...

Cross site scripting

A vulnerability was found in Keysight IXIA Hawkeye 3.3.16.28. It has been declared as problematic. This vulnerability affects unknown code of the file /licenses. The manipulation of the argument view with the input teste"alert%27c4ng4c3ir0%27 leads to cross site scripting. The attack can be...

[SECURITY] Fedora 37 Update: rubygem-actionmailer-7.0.4.3-1.fc37

Email on Rails. Compose, deliver, and test emails using the familiar controller/view pattern. First-class support for multipart email and attachments...

PT-2023-17290 · Keysight · Keysight Ixia Hawkeye

Name of the Vulnerable Software and Affected Versions: Keysight IXIA Hawkeye version 3.3.16.28 Description: A problem has been found in the software. It affects unknown code in the /licenses file. The issue arises when the view argument is manipulated with a specific input, leading to cross-site...

SUSE CVE-2023-28645

Nextcloud richdocuments is a Nextcloud app integrating the office suit Collabora Online. In affected versions the secure view feature of the rich documents app can be bypassed by using unprotected internal API endpoint of the rich documents app. It is recommended that the Nextcloud Office app...

Jenkins Pipeline Aggregator View Plugin vulnerable to Cross-site Scripting

Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability exploitable by authenticated attackers with Overall/Read permission. Version 1.14 obtains the...