1348 matches found
webnova.com.ar Cross Site Scripting vulnerability OBB-3338569
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2023-32568
An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2.800 and 8.x before 8.0.410. The VIOM web application does not validate user-supplied data and appends it to OS commands and internal binaries used by the application. An attacker with root/administrator level...
PHP SQL注入漏洞
PHP is a scripting language that executes on the server side. A SQL injection vulnerability exists in PHP-Login version 1.0, which stems from an incorrect manipulation of the parameter myusername resulting in sql injection...
CVE-2022-4259
The CVE-2022-4259 vulnerability affects Nozomi Networks Guardian and CMC, caused by improper input validation in the Alerts controller that enables authenticated SQL injection. A logged-in attacker can execute arbitrary SQL queries on the web application's DBMS, with impact on confidentiality, in...
Judging Management System SQL注入漏洞
Judging Management System is a judging management system by Carlo Montero Personal Developer. A security vulnerability exists in Judging Management System v1.0, which originates from a SQL injection vulnerability in the judgeid parameter in /php-jms/editjudge.php...
CVE-2023-30403
An issue in the time-based authentication mechanism of Aigital Aigital Wireless-N Repeater MiniRouter v0.131229 allows attackers to bypass login by connecting to the web app after a successful attempt by a legitimate user...
GHSA-PJFJ-QVQW-3F6V Apache StreamPark LDAP Injection vulnerability
Apache StreamPark versions 1.0.0 to 2.0.0 have an LDAP injection vulnerability. LDAP Injection is an attack used to exploit web based applications that construct LDAP statements based on user input. When an application fails to properly sanitize user input, it's possible to modify LDAP statements...
web2webjalandhar.com Cross Site Scripting vulnerability OBB-3278829
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2023-22683 · Unknown · Pear Admin Boot
Name of the Vulnerable Software and Affected Versions: Pear-Admin-Boot versions up to 2.0.2 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title of a private message. This enables attackers to...
akko-personal.de Cross Site Scripting vulnerability OBB-3251159
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Simple Food Ordering System v1.0 - Cross-Site Scripting (XSS)
Exploit Title: Simple Food Ordering System v1.0 - Cross-Site Scripting XSS Exploit Author: Muhammad Navaid Zafar Ansari Date: 17 February 2023 CVE Assigned: CVE-2023-0902 mitre.org nvd.nist.org Vendor Homepage: https://www.sourcecodester.com Software Link: Simple Food Ordering System Version: v 1...
Cross site scripting
Veritas NetBackUp OpsCenter Version 9.1.0.1 is vulnerable to Reflected Cross-site scripting XSS. The Web App fails to adequately sanitize special characters. By leveraging this issue, an attacker is able to cause arbitrary HTML and JavaScript code to be executed in a user's browser...
Active eCommerce CMS 6.5.0 - Stored Cross-Site Scripting Vulnerability
Exploit Title: Active eCommerce CMS 6.5.0 - Stored Cross-Site Scripting XSS Exploit Author: Sajibe Kanti Vendor Name: ActiveITzone Vendor Homepage: https://activeitzone.com/ Software Link: https://codecanyon.net/item/active-ecommerce-cms/23471405 Version: 6.5.0 Tested on: Live Centos & Litespeed...
All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal
The plugin does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only displays the last 50 lines of the file. PoC POST...
The vulnerability of the Symfony software platform for developing and managing web applications lies in improper session management, which allows attackers to execute CSRF attacks.
The vulnerability of the Symfony software platform for developing and managing web applications is related to improper session management. Exploiting this vulnerability allows a malicious actor to execute a CSRF attack from a remote location...
Cross site scripting
teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used...
CVE-2023-26047 teler-waf contains detection rule bypass via entities payload
teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab is used...
Cross site scripting
teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. In teler-waf prior to version 0.1.1 is vulnerable to bypassing common web attack rules when a specific HTML entities payload is used. This vulnerability allows an attacker to execute...
teler-waf contains detection rule bypass via Entities payload
Description teler-waf is a Go HTTP middleware that provides teler IDS functionality to protect against web-based attacks. teler-waf prior to version v0.2.0 is vulnerable to a bypass attack when a specific case-sensitive hex entities payload with special characters such as CR/LF and horizontal tab...