1337 matches found
jazz-club-trier.de Cross Site Scripting vulnerability OBB-3418638
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-34362
MOVEit Transfer CVE-2023-34362 is a SQL injection vulnerability in the MOVEit Transfer web app that allows an unauthenticated attacker to access MOVEit databases. Affected versions include 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), with all ...
webapps.umgc.edu Cross Site Scripting vulnerability OBB-3368979
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2023-15044 · WordPress · Litespeed Cache
Name of the Vulnerable Software and Affected Versions: LiteSpeed Cache plugin versions prior to 5.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...
Jsfinder - Fetches JavaScript Files Quickly And Comprehensively
jsFinder is a command-line tool written in Go that scans web pages to find JavaScript files linked in the HTML source code. It searches for any attribute that can contain a JavaScript file e.g., src, href, data-main, etc. and extracts the URLs of the files to a text file. The tool is designed to ...
webnova.com.ar Cross Site Scripting vulnerability OBB-3338569
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-32568
An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level...
PHP SQL注入漏洞
PHP is a scripting language that executes on the server side. A SQL injection vulnerability exists in PHP-Login version 1.0, which stems from an incorrect manipulation of the parameter myusername resulting in sql injection...
CVE-2022-4259
The CVE-2022-4259 vulnerability affects Nozomi Networks Guardian and CMC, caused by improper input validation in the Alerts controller that enables authenticated SQL injection. A logged-in attacker can execute arbitrary SQL queries on the web application's DBMS, with impact on confidentiality, in...
Judging Management System SQL注入漏洞
Judging Management System is a judging management system by Carlo Montero Personal Developer. A security vulnerability exists in Judging Management System v1.0, which originates from a SQL injection vulnerability in the judgeid parameter in /php-jms/editjudge.php...
CVE-2023-30403
An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater MiniRouter v0.131229 allows attackers to bypass login by connecting to the web app after a successful attempt by a legitimate user...
GHSA-PJFJ-QVQW-3F6V Apache StreamPark LDAP Injection vulnerability
Apache StreamPark versions 1.0.0 to 2.0.0 have an LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements...
web2webjalandhar.com Cross Site Scripting vulnerability OBB-3278829
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2023-22683 · Unknown · Pear Admin Boot
Name of the Vulnerable Software and Affected Versions: Pear-Admin-Boot versions up to 2.0.2 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message. This enables attackers to...
akko-personal.de Cross Site Scripting vulnerability OBB-3251159
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Simple Food Ordering System v1.0 - Cross-Site Scripting (XSS)
Exploit Title: Simple Food Ordering System v1.0 - Cross-Site Scripting XSS Exploit Author: Muhammad Navaid Zafar Ansari Date: 17 February 2023 CVE Assigned: CVE-2023-0902 mitre.org nvd.nist.org Vendor Homepage: https://www.sourcecodester.com Software Link: Simple Food Ordering System Version: v 1...
Cross site scripting
Veritas NetBackUp OpsCenter Version 9.1.0.1 is vulnerable to Reflected Cross-site scripting XSS. The Web App fails to adequately sanitize special characters. By leveraging this issue, an attacker is able to cause arbitrary HTML and JavaScript code to be executed in a user's browser...
Active eCommerce CMS 6.5.0 - Stored Cross-Site Scripting Vulnerability
Exploit Title: Active eCommerce CMS 6.5.0 - Stored Cross-Site Scripting XSS Exploit Author: Sajibe Kanti Vendor Name: ActiveITzone Vendor Homepage: https://activeitzone.com/ Software Link: https://codecanyon.net/item/active-ecommerce-cms/23471405 Version: 6.5.0 Tested on: Live Centos & Litespeed...
All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal
The plugin does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only displays the last 50 lines of the file. PoC POST...