Nextcloud Contacts Cross-Site Scripting Vulnerability

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud Germany. nextcloud Contacts application prior to version 4.0.3 suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side...

WordPress St-Daily-Tip plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports personal blogging sites on PHP and MySQL servers. WordPress St-Daily-Tip plugin has a cross-site request spoofing vulnerability in version 4.7 and earlier, which stems from a...

Shopware Cross-Site Scripting Vulnerability (CNVD-2021-103572)

Shopware is a suite of open source e-commerce software from the German company Shopware.Shopware in versions prior to 5.7.6 suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by the WEB application. An attacker could exploit the...

Design/Logic Flaw

The ASP.NET debug feature is enabled by default in Kiwi Syslog Server 9.7.2 and previous versions. ASP.NET allows remote debugging of web applications, if configured to do so. Debug mode causes ASP.NET to compile applications with extra information. The information enables a debugger to closely...

CVE-2021-35235

The CVE concerns SolarWinds Kiwi Syslog Server (versions

The vulnerability of the Redmine project and task management web application, related to the lack of protective measures for the website structure, allows attackers to compromise the integrity of the data.

The vulnerability of web applications for project and task management is related to the lack of protective measures for the website’s structure. Exploiting this vulnerability allows a malicious actor to compromise the integrity of the data...

firefly-iii 跨站请求伪造漏洞

firefly-iii is a free and open source personal finance software. firefly-iii suffers from a cross-site request forgery vulnerability, which originates when a WEB application does not sufficiently validate that a request is from a trusted user, and can be exploited by an attacker to send an...

Isshue Shopping Cart 3.5 Cross Site Scripting

Document Title: =============== Isshue Shopping Cart v3.5 - Cross Site Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2284 Release Date: ============= 2021-10-22 Vulnerability Laboratory ID VL-ID: ====================================...

Mult-e-Cart Ultimate 2.4 SQL Injection

Document Title: =============== Mult-e-Cart Ultimate v2.4 - SQL Injection Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2306 Release Date: ============= 2021-10-22 Vulnerability Laboratory ID VL-ID: ====================================...

Tibco Software TIBCO Nimbus 跨站脚本漏洞

Tibco Software TIBCO Nimbus is a business application for process documentation from Tibco Software, USA. A cross-site scripting vulnerability exists in TIBCO Nimbus, which stems from a lack of proper validation of client-side data by the web application. An attacker can exploit this vulnerabilit...

Pi-hole 跨站脚本漏洞

Pi-hole is a web-grade ad-blocking application from Pi-hole, Inc. Pi-hole suffers from a cross-site scripting vulnerability that stems from the WEB application's lack of proper validation of client-side data. An attacker can exploit this vulnerability to execute client-side code...

Simplephpscripts Simple CMS 2.1 Cross Site Scripting

Document Title: =============== Simplephpscripts Simple CMS v2.1 - Persistent Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2302 Release Date: ============= 2021-10-19 Vulnerability Laboratory ID VL-ID: ==================================...

PHP Melody 3.0 Cross Site Scripting

Document Title: =============== PHP Melody v3.0 - Multiple Cross Site Web Vulnerabilities References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2290 Bulletin: https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/ Release Date:...

CVE-2021-21319

Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround this is the default state...

CVE-2021-21319

Galette is a membership management web application geared towards non profit organizations. In versions prior to 0.9.5, malicious javascript code can be stored to be displayed later on self subscription page. The self subscription feature can be disabled as a workaround this is the default state...

CVE-2021-21319

Galette (Open Source membership management app) versions before 0.9.5 are affected by cross-site scripting issues. The vulnerability stems from malicious JavaScript that can be displayed/executed in user-facing pages: stored on the self-subscription flow and, on login and password pages, it can b...

CVE-2017-20007 Information Exposure in INGEPAC DA AU

Ingeteam INGEPAC DA AU AUC1.13.0.28 and before web application allows access to a certain path that contains sensitive information that could be used by an attacker to execute more sophisticated attacks. An unauthenticated remote attacker with access to the device´s web service could exploit this...

CVE-2017-20007

CVE-2017-20007 affects Ingeteam INGEPAC DA AU AUC_1.13.0.28 (and earlier) web applications. The issue allows an unauthenticated remote attacker with access to the device’s web service to reach a path that contains sensitive information and could be used to obtain different configuration files, en...

Engineers Online Portal 1.0 SQL Injection

Exploit Title: Engineers Online Portal 1.0 - 'multiple' Authentication Bypass Exploit Author: Alon Leviev Date: 22-10-2021 Category: Web application Vendor Homepage: https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html Software Link:...

Balbooa Joomla Forms Builder 2.0.6 SQL Injection

Exploit Title: Balbooa Joomla Forms Builder 2.0.6 - SQL Injection Unauthenticated Date: 24.10.2021 Exploit Author: blockomat2100 Vendor Homepage: https://www.balbooa.com/ Version: 2.0.6 Tested on: Docker An example request to trigger the SQL-Injection: POST /index.php?option=combaforms HTTP/1.1...