CVE-2021-43633

Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS. If a sender inserts valid scripts into the chat, the script will be executed on the receiver chat...

CVE-2021-43633

CVE-2021-43633 concerns Sourcecodester Messaging Web Application 1.0, where stored XSS is possible. An attacker can inject a valid script into the chat, and the recipient’s chat client may execute it. The vulnerability is described as stored XSS, affecting the messaging feature; no explicit fixes...

Messaging Web Application 跨站脚本漏洞

Messaging Web Application is a messaging web application in PHP and MySQL database by Carlo Montero Personal Developer. A cross-site scripting vulnerability exists in Messaging Web Application version 1.0, which can be exploited by inserting a valid script into a chat that will be executed in the...

Express-FileUpload Arbitrary File Overwrite

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server. This vulnerability is debated by the package author...

Apache Struts Security Update (S2-062) - Version Check

Apache Struts is prone to a remote code execution RCE vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

ManageEngine ADSelfService Plus < build 6121 XSS

According to its self-reported version, the ManageEngine ADSelfService Plus application running on the remote host is prior to build 6121. It is, therefore, affected by a cross-site scripting vulnerability affecting the welcome name attribute on the Reset Password, Unlock Account and User Must...

CVE-2022-27261

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server...

Arbitrary file deletion

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server...

CVE-2022-27261

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server...

CVE-2022-27261

An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an overwrite of files in the web application server...

CVE-2022-27261

CVE-2022-27261 describes an arbitrary file write vulnerability in Express-FileUpload v1.3.1. The issue allows uploading multiple files with the same name, leading to overwriting existing files on the web application server. Connected documents corroborate the affected product/version and impact, ...

CVE-2022-28036

AtomCMS 2.0 is vulnerable to SQL Injection via Atom.CMSadminajaxnavigation.php...

Laravel remote code execution vulnerability

Laravel, a web application framework from the Laravel Team Laravel, has a security vulnerability that stems from a vulnerability in 1 RoutingPendingResourceRegistration.php via destruct, 2 cal in QueueCapsuleManager.php and 3 the deserialization pop-up chain invoke in...

XWiki Privileged API Vulnerability (GHSA-ghcq-472w-vf4h)

XWiki is prone to a privileged API vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

CVE-2022-27127

zbzcms v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php/ajax.php...

UPS VDP: Reflected XSS on https://wwwapps.ups.com/ctc/request?loc=

Summary: ========= Detalis XSS ----------- Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a...

Design/Logic Flaw

Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

School Club Application System 1.0 Local File Inclusion

Title: School Club Application System 1.0 LFI To RCE Author: Hejap Zairy Date: 08.04.2022 Vendor: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html Software: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scas0.zip Referenc...

Bakery Shop Management System 1.0 Local File Inclusion Vulnerability

Title: Bakery Shop Management System 1.0 LFI To RCE Author: Hejap Zairy Date: 06.04.2022 Vendor: https://www.campcodes.com/projects/php/simple-bakery-shop-management-system/ Software: https://www.campcodes.com/wp-content/uploads/2022/02/bsms0.zip Reference: https://github.com/Matrix07ksa Tested o...

TPCMS Cross-Site Scripting Vulnerability (CVE-2022-27441)

TPCMS is a content management system.A cross-site scripting vulnerability exists in TPCMS version 3.2, which stems from the lack of proper validation of client-side data by the WEB application. An attacker could exploit the vulnerability to execute arbitrary web script or HTML by injecting a...