CVE-2023-43830

CVE-2023-43830 affects Subrion CMS v4.2.1. The vulnerability is a Cross-Site Scripting (XSS) bug in the /panel/configuration/financial/ endpoint, where a crafted payload injected into multiple fields—specifically ‘Minimum deposit’, ‘Maximum deposit’, and/or ‘Maximum balance’—allows an attacker to...

CVE-2023-43232

The CVE-2023-43232 entry concerns a stored XSS vulnerability in the Website column management feature of DedeBIZ v6.2.11, where an attacker can inject a crafted payload into the title parameter to execute arbitrary web scripts or HTML. Public records (NVD/Red Hat/EUVD/CNNVD/etc.) corroborate the ...

CVE-2023-44042

CVE-2023-44042 is a stored XSS vulnerability impacting Black Cat CMS 1.4.1, caused by injection into the Website header parameter in /settings/index.php. The available documents describe arbitrary web-script execution as the consequence but do not provide exploit details, affected versions beyond...

NextGEN Gallery < 3.39 - Admin+ Arbitrary File Read and Delete

Description The plugin is vulnerable to Arbitrary File Read and Delete due to a lack of input parameter validation in the galleryedit function, allowing an attacker to access arbitrary resources on the server. 1. Create a Gallery called "My Gallery" and note its ID. 2. Run the following code in...

inclusievandaag.be Cross Site Scripting vulnerability OBB-3707210

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

advocatekhoj.com Cross Site Scripting vulnerability OBB-3705364

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

flexogent.be Cross Site Scripting vulnerability OBB-3705135

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

sidelink.com.au Cross Site Scripting vulnerability OBB-3703658

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

brainycp.com Cross Site Scripting vulnerability OBB-3701348

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-41614

The CVE-2023-41614 entry describes a stored XSS in Zoo Management System v1.0, specifically in the Add Animal Details function where an attacker can inject a payload via the Description of Animal parameter. Affected component: Add Animal Details (Description of Animal). Impact per sources: arbitr...

CVE-2015-5467

CVE-2015-5467 affects Yii2 (web/ViewAction) in 2.x prior to 2.0.5. The vulnerability allows an attacker to execute arbitrary local PHP files by supplying a relative path in the view parameter, enabling local file inclusion through the view rendering path. The root cause is improper handling of vi...

pragmatha.com.br Cross Site Scripting vulnerability OBB-3700502

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-1438

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability...

GHSA-4F4R-WGV2-JJVG Quarkus HTTP vulnerable to incorrect evaluation of permissions

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized...

CVE-2023-43376

CVE-2023-43376 describes a cross-site scripting (XSS) vulnerability in Hoteldruid v3.0.5, exploitable via the nometipotariffa1 parameter on the /hoteldruid/clienti.php endpoint. The issue allows attackers to run arbitrary web scripts or HTML in victims’ browsers. Official records report a CVSS v3...

CVE-2023-41890

Sustainsys.Saml2 (used to add SAML2P to ASP.NET sites) contains CVE-2023-41890 due to insufficient validation of the IdP issuer when processing a response. This can let a malicious IdP craft a SAML2 response that appears to come from another IdP, and an end user could cause stored AuthenticationP...

brightconnect.com.au Cross Site Scripting vulnerability OBB-3698530

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-42454

SQLpage CVE-2023-42454 affects versions before 0.11.1 where an exposed SQLPage instance stores the database connection string in sqlpage/sqlpage.json and the web_root is the default, allowing an attacker who can access the instance and the database to retrieve credentials and connect directly. Th...

webadmin.sztaki.hu Cross Site Scripting vulnerability OBB-3697384

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

gunlukdemirfiyatlari.net Cross Site Scripting vulnerability OBB-3696478

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...