17429 matches found
CVE-2020-36399
CVE-2020-36399 describes a stored cross-site scripting (XSS) vulnerability in phplist versions 3.5.4 and earlier, exploitable via a crafted payload in the “rule1” parameter under the “Bounce Rules” module. All connected sources corroborate that the issue is a client-side scripting vulnerability t...
CVE-2020-36396
The CVE refers to LavaLite 5.8.0, specifically a stored XSS in the /admin/roles/role component. An authenticated attacker can inject arbitrary web scripts/HTML via the New parameter, enabling script execution in the context of the logged-in user. The provided connected documents confirm the vulne...
CVE-2020-36395
CVE-2020-36395 affects LavaLite 5.8.0 with a stored XSS vulnerability in the /admin/user/team component. The issue allows an authenticated attacker to inject and execute web scripts or HTML via the New parameter, enabling arbitrary script execution in the context of the affected user. Multiple so...
CVE-2020-23190
Phplist 3.5.4 is affected by a stored XSS in the Import emails module. An authenticated attacker can execute arbitrary web scripts or HTML via a crafted payload. Exploitation status is not detailed in the provided sources. Remediation guidance present in PT-2021-10853 recommends disabling the Imp...
CVE-2020-23184
CVE-2020-23184 is a stored XSS vulnerability in PHP-Fusion 9.03.60. The issue affects the /administration/settings_registration.php script where user input in the Registration field can be stored and later executed as script/html by authenticated users. Impact is web-script execution and HTML ren...
CVE-2020-23181
CVE-2020-23181 is a reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 9.03.60. The flaw occurs in /administration/theme.php and can be exploited by an authenticated attacker who injects a crafted payload into the “Manage Theme” field to execute arbitrary web scripts or HTML in the ...
CVE-2020-23179
CVE-2020-23179 describes a stored XSS in PHP-Fusion 9.03.50 via the Site footer field in administration/settings_main.php. An authenticated user can inject script/HTML that is stored and later rendered to other users. Affected component: PHP-Fusion’s admin settings_main.php; vulnerability type: s...
CVE-2020-23214
CVE-2020-23214 is a stored XSS vulnerability in phplist 3.5.3 that allows an attacker to inject and execute arbitrary web scripts/HTML through the Configure categories field in the Categorise Lists module. Public references across multiple sources (NVD, OSV, CNVD, Red Hat, etc.) confirm the same ...
CVE-2020-23209
phplist 3.5.3 contains a stored XSS in the List Description field of the Edit A List module. The issue allows execution of arbitrary scripts/HTML via crafted input; root cause is unsanitized/unsafe input handling. Affected component: List Description in phplist 3.5.3. Remediation: update to a new...
CVE-2020-23205
CVE-2020-23205 is a stored XSS vulnerability in Monstra CMS 3.0.4 . The flaw allows an attacker to inject and execute arbitrary web scripts or HTML by crafting a payload into the Site Name field in the Site Settings module. Current sources describe the vulnerability as a stored XSS with impact li...
Online Voting System 1.0 Remote Code Execution
Exploit Title: Online Voting System 1.0 - Remote Code Execution Authenticated Exploit Author: deathflash1411 Date 30.06.2021 Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/4808/voting-system-php.html Version 1.0 Tested on: Ubuntu 20.04 Proof of...
Simple Traffic Offense System 1.0 - Stored Cross Site Scripting (XSS)
Exploit Title: Simple Traffic Offense System 1.0 - 'Multiple' Stored Cross Site Scripting XSS Date: 30-06-2021 Exploit Author: Barış Yıldızoğlu Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/trafic.zip Version:...
Homebrew: clickjacking at brew.sh
hello , While performing security testing of your website i have found the vulnerability called Clickjacking. URL is in scope and vulnerable to Clickjacking. What is Clickjacking ? Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a...
U.S. Dept Of Defense: RXSS ON https://██████████
Description: Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differe...
Design/Logic Flaw
Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...
PT-2021-17586
Name of the Vulnerable Software and Affected Versions exacqVision Enterprise Manager version 20.12 Description The issue arises from insufficient validation, filtering, escaping, and/or encoding of user-controllable input before it is placed in output that is used as a web page served to other...
CVE-2020-23962
This CVE-2020-23962 is a documented XSS vulnerability in Catfish CMS 4.9.90. The flaw allows an attacker to inject arbitrary web scripts/HTML via the announcement_gonggao parameter, enabling script execution in the victim’s browser. The affected component is Catfish CMS (version 4.9.90); the root...
CVE-2021-34243
CVE-2021-34243 affects Ice Hrm 29.0.0.OS with a stored XSS flaw in the Document Management tab. A crafted file uploaded to that tab can cause arbitrary web scripts/HTML to execute when a user visits the upload location. The available sources reiterate the same condition but do not provide concret...
OWASP ESAPI 安全漏洞
OWASP ESAPI is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. A security vulnerability exists in OWASP ESAPI version 2.0 RC2 and prior versions. The vulnerability stems from an oracle padding attack...
