CVE-2022-46154

CVE-2022-46154 affects KodExplorer (prior to v4.50). The issue lets unauthenticated users request arbitrary files from the host OS file system due to inadequate access control/path traversal. Impact: access to any files available to the host process. The vulnerability is addressed in version 4.50...

Nextcloud: Website PHP source code returned in javascript

Server-side PHP source code was disclosed to users due to a misconfiguration or typographical error in the application's script, potentially exposing sensitive information such as database passwords and secret keys...

Important: thunderbird

Issue Overview: Integer overflow vulnerability in avtimecodemakestring in libavutil/timecode.c in FFmpeg version 4.3.2, allows local attackers to cause a denial of service DoS via crafted .mov file. CVE-2021-28429 When receiving an HTML email that contained an iframe element, which used a srcdoc...

CVE-2022-43369

CVE-2022-43369 affects AutoTaxi Stand Management System v1.0, with a cross-site scripting (XSS) vulnerability in the search.php component. The issue is described across multiple sources as a client-side/script injection risk in the search functionality, contributing to a CVSS v3.1 base score of 6...

CVE-2022-46169 Unauthenticated Command Injection

Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a command injection vulnerability allows an unauthenticated user to execute arbitrary code on a server running Cacti, if a specific data...

CVE-2022-44952

Summary: Rukovoditel software

CVE-2022-44947

CVE-2022-44947 concerns Rukovoditel v3.2.1, with a stored XSS vulnerability in the Highlight Row feature. An attacker can inject a crafted payload into the Note field at /index.php?module=entities/listing_types&entities_id=24 after clicking “Add,” potentially executing arbitrary scripts in the vi...

CVE-2022-44948

CVE-2022-44948 – Rukovoditel

ewallet.gslb.adp.com Cross Site Scripting vulnerability OBB-3079186

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

synchronik.co.in Cross Site Scripting vulnerability OBB-3077547

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross-site Scripting (XSS)

Overview serve-lite is an a lightweight http-server for static file-based web development Affected versions of this package are vulnerable to Cross-site Scripting XSS because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the...

reactfeminism.de Cross Site Scripting vulnerability OBB-3074376

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

recor.pt Cross Site Scripting vulnerability OBB-3073518

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Reflect Cross Site Scripting

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. Proof of Concept Go to your web phpmyfaq and visit below URL. Exploit URL:...

Cross site scripting

A cross-site scripting XSS vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field...

CVE-2022-45037

WBCE CMS v1.5.4 contains a stored cross-site scripting (XSS) vulnerability in /admin/users/index.php. The issue allows an attacker to inject arbitrary web scripts or HTML via the Display Name field, potentially leading to execution in pages viewed by other users. Nuclei templates label this as St...

CVE-2022-45038

WBCE CMS v1.5.4 suffers a stored XSS in /admin/settings/save.php, exploitable via a crafted payload in the Website Footer field. Impact described: arbitrary script execution in users' browsers, with risks such as data theft, session hijacking, or page defacement. Affected component: admin/setting...

CVE-2022-45225

CVE-2022-45225 affects Book Store Management System v1.0. The vulnerability is a cross-site scripting (XSS) defect in the endpoint /bsms_ci/index.php/book , exploitable by injecting a crafted payload into the book_title parameter. The NVD/CVSS data shows a base score of 6.1 (Medium) with AV:N/AC:...

CVE-2022-45036

WBCE CMS 1.5.4 contains an XSS in the Search Settings module, exploitable via a crafted payload in the No Results field. The vulnerability can lead to execution of arbitrary scripts/HTML in affected pages. Current documents do not provide a remediation or patch details; no exploit status is speci...

fuerstenfeld.de Cross Site Scripting vulnerability OBB-3069675

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...