CVE-2024-22129 Cross-Site Scripting (XSS) vulnerability in SAP Companion

SAP Companion - version 3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information and cause minor impact on the integrity of the web application...

CVE-2024-22129 Cross-Site Scripting (XSS) vulnerability in SAP Companion

SAP Companion - version 3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information and cause minor impact on the integrity of the web application...

The vulnerability of the php-scrm/login.php component of the Simple Customer Relationship Management System web application, which allows a hacker to execute arbitrary SQL queries against the database.

The vulnerability of the php-scrm/login.php component in the Simple Customer Relationship Management System web application is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL queries against the databa...

Icinga Web 2 Cross-Site Request Forgery Vulnerability

Icinga Web 2 is a software application.Icinga Web 2 is the next generation open source monitoring web interface, framework and command line interface developed by the Icinga Project to support Icinga 2, Icinga Core and any other IDO database compatible monitoring backend. Icinga Web 2 suffers fro...

Number withdrawn

SourceCodester Employee Management System is a php-based website builder for employee performance management from SourceCodester, USA. The CVE number has been withdrawn...

CVE-2024-24014

A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. An attacker can pass crafted offset, limit, and sort parameters to perform SQL injection via /novel/author/list...

CVE-2024-24812

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...

Cross site scripting

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...

CVE-2024-24812

CVE-2024-24812 affects the Frappe framework. The vulnerability is a portal-page Cross-Site Scripting (XSS) issue that could allow injection of malicious JavaScript when a user clicks a crafted link. Public sources confirm the issue is in Frappe versions prior to 14.59.0 and 15.5.0 and that it has...

CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...

CVE-2024-24812 Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and a tightly integrated client side library. Prior to versions 14.59.0 and 15.5.0, portal pages are susceptible to Cross-Site Scripting XSS which can be used to inject malicious JS code if user click...

CVE-2024-0628

CVE-2024-0628 affects the WordPress WP RSS Aggregator plugin. The vulnerability is a Server-Side Request Forgery (SSRF) in all versions up to and including 4.23.5, exploitable by authenticated attackers with administrator-level access to issue web requests from the application (via the RSS feed s...

CVE-2024-0628

The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the RSS feed source in admin settings. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to...

Fortinet FortiWeb Log injection (FG-IR-23-256)

The version of FortiWeb installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-23-256 advisory. - An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5...

CVE-2023-45227

An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter...

CVE-2023-45227

An attacker with access to the web application with vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "dns.0.server" parameter...

CVE-2023-45222

An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter...

CVE-2023-40143

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...

CVE-2023-45222

An attacker with access to the web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "autorefresh" parameter...

CVE-2023-40143

An attacker with access to the Westermo Lynx web application that has the vulnerable software could introduce arbitrary JavaScript by injecting a cross-site scripting payload into the "forward.0.domain" parameter...