Cross site scripting

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this...

CVE-2023-0594

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this...

CVE-2023-0594

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this...

CVE-2023-0594

Grafana CVE-2023-0594 is a stored XSS in the trace view visualization introduced on the 7.x line. The vulnerability arises because span attribute/resource values were not properly sanitized and can be rendered when expanded, enabling an attacker with Editor role to inject JavaScript into a trace ...

SUSE CVE-2023-25821

Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shares can be circumvented if reshare permissions are also given. This issue is patched in versions 24.0...

Stored XSS in TraceView Panel

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span’s attributes/resources were not properly sanitized and this...

CVE-2023-1053

A vulnerability was found in SourceCodester Music Gallery Site 1.0 and classified as critical. This issue affects some unknown processing of the file viewcategory.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The associated identifier of th...

PT-2023-16720 · Unknown · Sourcecodester Music Gallery Site

Name of the Vulnerable Software and Affected Versions: SourceCodester Music Gallery Site version 1.0 Description: A critical issue affects the processing of the file view category.php, where the manipulation of the id argument leads to sql injection. The attack can be initiated remotely...

Music Gallery Site SQL注入漏洞

Music Gallery Site is a music gallery site by Carlo Montero, a personal developer. A SQL injection vulnerability exists in SourceCodester Music Gallery Site version 1.0 due to some unknown processing in the file viewcategory.php, which results in an sql injection via the parameter id...

CVE-2023-1038

A vulnerability classified as critical has been found in SourceCodester Online Reviewer Management System 1.0. Affected is an unknown function of the file /reviewer0/admins/assessments/pretest/questions-view.php. The manipulation of the argument id leads to sql injection. It is possible to launch...

Improper access control

Nextcloud is an Open Source private cloud software. Versions 24.0.4 and above, prior to 24.0.7, and 25.0.0 and above, prior to 25.0.1, contain Improper Access Control. Secure view for internal shares can be circumvented if reshare permissions are also given. This issue is patched in versions 24.0...

AudioCodes Device Manager Express 路径遍历漏洞

AudioCodes Device Manager Express is a powerful lifecycle management tool for AudioCodes IP phones, EPOS and Jabra headsets and speakers from AudioCodes Israel. A path traversal vulnerability exists in AudioCodes Device Manager Express 7.8.20002.47752 and prior versions, which stems from a path...

ZoneMinder Snapshots Command Injection

This module exploits an unauthenticated command injection in zoneminder that can be exploited by appending a command to the "create monitor ids"-action of the snapshot view. Affected versions: use exploit/unix/webapp/zoneminder/snapshots msf undefinedsnapshots show actions ...actions... msf...

jenkins-plugin/pipeline-stage-view: CSRF protection for any URL can be bypassed in Pipeline: Stage View Plugin

A Cross-site request forgery CSRF vulnerability was found in a Jenkins plugin. This issue may allow an authenticated attacker to access Jenkins builds, bypassing CSRF protections...

CVE-2023-0966

A vulnerability classified as problematic was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the file admin/?page=orders/vieworder. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotel...

CVE-2023-0961

A vulnerability was found in SourceCodester Music Gallery Site 1.0. It has been classified as critical. This affects an unknown part of the file viewmusicdetails.php of the component GET Request Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the...

CVE-2023-24811 Cross site scripting (XSS) vulnerability using url preview in Misskey

Misskey is an open source, decentralized social media platform. In versions prior to 13.3.2 the URL preview function is subject to a cross site scripting vulnerability due to insufficient URL validation. Arbitrary JavaScript is executed when a malicious URL is loaded in the View in Player or View...

Online Eyewear Shop 跨站脚本漏洞

Online Eyewear Shop is an online eyewear store by the individual developer Carlo Montero. A cross-site scripting vulnerability exists in SourceCodester Online Eyewear Shop version 1.0, which stems from a problem with the file admin/?page=orders/vieworder, where manipulation of the parameter id ca...

Sales Tracker Management System SQL注入漏洞

Sales Tracker Management System is a sales tracking management system by Carlo Montero Personal Developer. A SQL injection vulnerability exists in Sales Tracker Management System version 1.0, which stems from a problem in the file admin/products/viewproduct.php, where manipulation of the paramete...

PT-2023-16650 · Sourcecodester · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A problematic issue was found in the software, affecting an unknown functionality of the file "admin/?page=orders/view order". The manipulation of the id argument leads to cross-site...