CVE-2023-46127

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version...

Design/Logic Flaw

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version...

CVE-2023-46127 Frappe vulnerable to HTML injection by any Desk user

Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version...

CVE-2023-46127

CVE-2023-46127 affects the Frappe framework. A malicious user with desk access could create documents containing HTML payloads, enabling HTML Injection via a vulnerable HTML rendering/handling path in Frappe prior to patch. The issue is fixed in version 14.49.0. Affected product: Frappe (Python/M...

Moodle 4.3 Cross Site Scripting

Exploit Title: Moodle 4.3 Reflected XSS Date: 21/10/2023 Exploit Author: tmrswrr Vendor Homepage: https://moodle.org/ Software Demo: https://school.moodledemo.net/ Version: 4.3 Tested on: Linux Vulnerability Details ====================== Steps : 1. Log in to the application with the given...

palab.eu Cross Site Scripting vulnerability OBB-3763557

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

BIG-IP Improper Cryptographic Signature Privilege Escalation

The vulnerabilities of the BIG-IP Access Policy Manager, as well as of software solutions such as BIG-IP Advanced Firewall Manager, BIG-IP Advanced Web Application Firewall, BIG-IP Analytics, BIG-IP Application Acceleration Manager, BIG-IP Application Security Manager, BIG-IP Application Visibili...

CVE-2023-40153

The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the 'hostname' parameter of the vulnerable software...

CVE-2023-40153

The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the 'hostname' parameter of the vulnerable software...

Cross site scripting

The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the 'hostname' parameter of the vulnerable software...

CVE-2023-40153 Cross-site Scripting in DEXMA DEXGate

The affected product is vulnerable to a cross-site scripting vulnerability, which could allow an attacker to access the web application to introduce arbitrary Java Script by injecting an XSS payload into the 'hostname' parameter of the vulnerable software...

CVE-2023-40153

CVE-2023-40153 affects DEXMA DexGate (DEXGate 20130114). The Red Hat advisory and multiple sources describe a cross-site scripting (XSS) vulnerability in the hostname parameter of the vulnerable software, enabling arbitrary JavaScript execution within the web application. Public references also i...

DEXMA DexGate Cross-Site Scripting Vulnerability

DEXMA DexGate is a device from DEXMA, Inc. A security vulnerability exists in DEXMA DexGate version 20130114, which stems from the presence of a cross-site scripting XSS vulnerability. An attacker can exploit this vulnerability to access a web application by injecting an XSS load into the hostnam...

WordPress Popular Posts Plugin < 6.3.3 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpresspopularpostsproject:wordpresspopularposts"; if...

Roundcube Webmail < 1.4.15, 1.5.x < 1.5.5, 1.6.x < 1.6.4 XSS Vulnerability

Roundcube Webmail is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Checkmk 1.4.x < 1.4.0p37 Information Disclosure Vulnerability

Checkmk is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:checkmk:checkmk"; if...

Building an AppSec Program with Qualys WAS – Introduction

Part 1 - Introduction and Configuring a Web Application or API: Basic Information Welcome to our introductory series of blogs where we will take you step-by-step through your application security journey with Qualys Web Application Scanning WAS to build and deploy secure web applications and APIs...

Awesome Support < 6.1.5 - Reflected Cross-Site Scripting

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. PoC Visit the following URL as an admin user, with any valid ticket ID. Press the acce...

PT-2023-29624 · Mailmunch · Constant Contact Forms By Mailmunch

Name of the Vulnerable Software and Affected Versions: MailMunch Constant Contact Forms by MailMunch plugin versions = 2.0.10 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

PT-2023-29478 · Sendpulse · Sendpulse Free Web Push Plugin

Name of the Vulnerable Software and Affected Versions: SendPulse Free Web Push plugin versions = 1.3.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...