CVE-2022-40088

The CVE-2022-40088 entry affects Simple College Website v1.0, with a reflected XSS vulnerability in the page parameter of /college_website/index.php?page=. The root cause is input reflected back into the page, enabling arbitrary web-script/HTML execution when a crafted payload is submitted. The N...

Multix 2.4 Cross Site Request Forgery

Exploit Title: Multix - Multipurpose Website CMS with Codeigniter Cross Site Request Forgery Exploit Author: th3d1gger Vendor Homepage: https://codecanyon.net Software Link: https://codecanyon.net/item/multix-multipurpose-website-cms-with-codeigniter/23537596 Version: Version 2.4 Tested on Ubuntu...

CVE-2022-28982

Summary: CVE-2022-28982 is an XSS vulnerability in Liferay Portal 7.3.3–7.4.2 and Liferay DXP 7.3 before Service Pack 3. The flaw allows an attacker to inject a crafted payload into a tag name, enabling arbitrary web scripts/HTML execution on the client side. Affected products/components: Liferay...

CVE-2022-40027

CVE-2022-40027 affects SourceCodester Simple Task Managing System v1.0. The vulnerability is a cross-site scripting (XSS) in the newTask.php component, exploitable via the shortName parameter to cause arbitrary web scripts/HTML execution. Reported impact per sources is low on confidentiality/inte...

CVE-2022-23693

CVE-2022-23693 affects Aruba ClearPass Policy Manager. The web-based management interface contains SQL injection vulnerabilities that authenticated remote attackers could exploit against 6.10.x (6.10.6 and below) and 6.9.x (6.9.11 and below). Multiple sources (NVD/Red Hat/PRION/CNNVD/NCSc) confir...

CVE-2022-38550

Jeesns v2.0.0 contains a stored XSS in the /weibo/list component. The vulnerability allows an attacker to execute arbitrary web scripts or HTML via a crafted payload. Affected software: Jeesns 2.0.0 (Web UI component /weibo/list). Root cause: stored XSS in the mentioned component. Impact: potenti...

OpenCart 3.x Newsletter Custom Popup 4.0 SQL Injection

Exploit Title: OpenCart v3.x So Newsletter Custom Popup Module - Blind SQL Injection Date: 18/09/2022 Exploit Author: Saud Alenazi Vendor Homepage: https://www.opencart.com/ Software Link:...

revodent.nl Cross Site Scripting vulnerability OBB-2932500

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

chu-brest.nous-recrutons.fr Cross Site Scripting vulnerability OBB-2932381

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

yaz-dv.com Cross Site Scripting vulnerability OBB-2922002

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

cheesegames.net Cross Site Scripting vulnerability OBB-2921778

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ravensburg.de Cross Site Scripting vulnerability OBB-2921546

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-40365

CVE-2022-40365 concerns the gocron project (versions up to and including 1.5.3). The vulnerability is a cross-site scripting (XSS) issue caused by lack of sanitization of the scope.row.hostname parameter in web/vue/src/pages/taskLog/list.vue, enabling an attacker to inject and potentially execute...

boekbindboetiek.nl Cross Site Scripting vulnerability OBB-2917490

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

TYPO3 跨站脚本漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from TYPO3 Association in Switzerland. A cross-site scripting vulnerability exists in TYPO3. An attacker could exploit this vulnerability to perform cross-site scripting attacks...

CVE-2022-38295

CVE-2022-38295 affects Cuppa CMS v1.0. The vulnerability is a cross-site scripting flaw in the Add New Group workflow, exploitable via a crafted payload in the Name field at /table_manager/view/cu_user_groups, allowing execution of arbitrary web scripts/HTML. Public docs identify the impact as ex...

CVE-2022-38291

CVE-2022-38291 affects SLiMS Senayan Library Management System v9.4.2. The issue is a cross-site scripting (XSS) vulnerability in the Search function, allowing an attacker to inject a crafted payload via the Search bar to execute arbitrary client-side scripts/HTML. Root cause: insufficient input ...

CVE-2022-1700

Improper Restriction of XML External Entity Reference 'XXE' vulnerability in the Policy Engine of Forcepoint Data Loss Prevention DLP, which is also leveraged by Forcepoint One Endpoint F1E, Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20...

CVE-2022-1700

Improper Restriction of XML External Entity Reference 'XXE' vulnerability in the Policy Engine of Forcepoint Data Loss Prevention DLP, which is also leveraged by Forcepoint One Endpoint F1E, Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20...

CVE-2022-1700

Improper Restriction of XML External Entity Reference 'XXE' vulnerability in the Policy Engine of Forcepoint Data Loss Prevention DLP, which is also leveraged by Forcepoint One Endpoint F1E, Web Security Content Gateway, Email Security with DLP enabled, and Cloud Security Gateway prior to June 20...