PopojiCMS Cross-Site Scripting Vulnerability

PopojiCMS is an open source content management system CMS based on the Popoji framework. A cross-site scripting vulnerability exists in PopojiCMS. The vulnerability stems from a lack of proper validation of client-side data in the WEB application. An attacker can exploit this vulnerability to...

Online Store System Cross-Site Scripting Vulnerability (CNVD-2019-40113)

Online Store System is an e-commerce system. A cross-site scripting vulnerability exists in Online Store System v1.0. The vulnerability stems from a lack of proper validation of client-side data in the web application. An attacker can exploit this vulnerability to execute client-side code...

Code execution vulnerability in dw*** parameter of ad***_we***.php file in seacms backend

seacms ocean film and television management system, ocean cms is based on PHP + MySql technology development of video on demand system. seacms background adwe.php file dw parameter there is a code execution vulnerability, attackers can use the vulnerability to obtain control of the web server...

FusionPBX Cross-Site Scripting Vulnerability (CNVD-2019-37878)

FusionPBX is a scalable, multi-threaded communications platform. The platform can be used as a call center server, fax server, VOIP server, voicemail server, conference server and voice application server. A cross-site scripting vulnerability exists in FusionPBX 4.5.7 and earlier versions, which...

IceWarp Mail Server Cross-Site Scripting Vulnerability (CNVD-2019-36906)

IceWarp Mail Server is a mail server product from IceWarp USA. The product supports e-mail archiving, SmartAttach attachments, automatic migration, etc. IceWarp Webclient is a Web-based IceWarp client program. A cross-site scripting vulnerability exists in IceWarp Webclient versions prior to...

Jiangnan Online Judge Cross-Site Scripting Vulnerability

Jiangnan Online Judge is an online evaluation system for computer programming. The system is mainly used for compiling and executing the source code submitted by users and checking the correctness of the program source code. A cross-site scripting vulnerability exists in Jiangnan Online Judge...

Siemens IE/WSN-PA Link WirelessHART Gateway Cross-Site Scripting Vulnerability

The IE/WSN-PA Link is a gateway that connects the WirelessHART network to Industrial Ethernet. A cross-site scripting vulnerability exists in the Siemens IE/WSN-PA Link WirelessHART Gateway. The vulnerability stems from a lack of proper validation of client-side data by the web application. An...

WordPress democracy-poll plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. democracy-poll is an online poll plugin used in it. A cross-site request forgery vulnerability exists in the WordPress democracy-poll...

NETGEAR Nighthawk M1 Cross-Site Request Forgery Vulnerability

The NETGEAR Nighthawk M1 is a portable wireless router from NETGEAR. A cross-site request forgery vulnerability exists in the NETGEAR Nighthawk M1 MR1100 versions prior to 12.06.03. The vulnerability stems from a WEB application that does not adequately validate that a request is coming from a...

NETGEAR EX7000 Cross-Site Scripting Vulnerability

The NETGEAR EX7000 is a wireless router from NETGEAR. A cross-site scripting vulnerability exists in NETGEAR EX7000 version V1.0.0.421.0.94. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to execute...

Crunchbase Cognitoys Dino Cross-Site Request Forgery Vulnerability

Crunchbase Cognitoys Dino is a children's cognitive electronic learning toy from Crunchbase USA. A cross-site request forgery vulnerability exists in the Crunchbase Cognitoys Dino device. The vulnerability stems from the WEB application not adequately verifying that a request is from a trusted...

Bagisto Cross-Site Request Forgery Vulnerability

Bagisto is a set of open source e-commerce framework. A cross-site request forgery vulnerability exists in Bagisto version 0.1.5, which stems from a WEB application that does not adequately validate whether a request comes from a trusted user, and can be exploited by an attacker to send an...

SQL Injection Vulnerability in ASK2 Q&A System Ap***.php File

ASK2 Q&A is an open source PHP Q&A program. ASK2 Q&A System Ap.php file has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

DIGISOL SYSTEMS DG-HR3400 Cross-Site Scripting Vulnerability

DIGISOL SYSTEMS DG-HR3400 is a wireless router from DIGISOL SYSTEMS India. A cross-site scripting vulnerability exists in the DIGISOL SYSTEMS DG-HR3400. The vulnerability stems from the lack of proper validation of client data by the WEB application. An attacker can exploit the vulnerability to...

Cross-site scripting vulnerability in multiple Zyxel devices

ZyXEL ZyWall 310 and others are products of Taiwan, China-based ZyXEL Corporation.ZyXEL ZyWall 310 is a 310 series VPN firewall appliance.ZyXEL ZyWall 110 is a 110 series VPN firewall appliance.ZyXEL USG1900 is a next-generation unified security gateway appliance. Zyxel ZyWall A cross-site...

Quadbase Systems EspressReport ES Cross-Site Scripting Vulnerability

Quadbase Systems EspressReport ES ERES is a centralized business intelligence reporting solution from Quadbase Systems, USA. A cross-site scripting vulnerability exists in Quadbase Systems ERES version 7.0 update 7. The vulnerability stems from a lack of proper validation of client-side data by t...

CVE-2019-3410

All versions up to UKBBWF820+1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by Cross-Site Request Forgery vulnerability,which stems from the fact that WEB applications do not adequately verify whether requests come from trusted users. An attacker can exploit this vulnerability to sen...

ZOHO ManageEngine ServiceDesk Plus Cross-Site Scripting Vulnerability (CNVD-2019-16939)

ZOHO ManageEngine ServiceDesk Plus is a set of ITIL-based IT service management software ITSM from ZOHO. The software integrates incident management, problem management, asset management, IT project management, procurement and contract management and other functional modules. A cross-site scripti...

SQL Injection Vulnerability in B2C_UQ Cloud Business System

UQ Cloud Business System B2C version is a compact e-commerce system, the platform is developed by PHP7.0+Mysql. B2CUQ Cloud Business System suffers from a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive database information...

CVE-2018-5430

The Spring web flows of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for ActiveMatrix BPM, TIBCO Jaspersoft for AWS with Multi-Tenancy, and TIBCO Jaspersoft Reporting and Analytics for AWS contain a vulnerability which...