Cloudflare Saw Record-Breaking DDoS Attack Peaking at 26 Million Request Per Second

Cloudflare on Tuesday disclosed that it had acted to prevent a record-setting 26 million request per second RPS distributed denial-of-service DDoS attack last week, making it the largest HTTPS DDoS attack detected to date. The web performance and security company said the attack was directed...

CVE-2022-1969

CVE-2022-1969 (WordPress Mobile Browser Color Select plugin) describes a Cross-Site Request Forgery vulnerability in versions up to 1.0.1, caused by missing or incorrect nonce validation on the admin_update_data() function. The issue allows unauthenticated attackers to induce an administrator to ...

CVE-2022-31398

CVE-2022-31398 is a cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2, specifically involving /staff/tools/custom-fields. The root cause is a lack of parameter filtering/escaping in the email name field, enabling an attacker to inject arbitrary web scripts or HTML. Impact is limited to...

dr-fehlert.de Cross Site Scripting vulnerability OBB-2648635

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-2035

The CVE-2022-2035 entry describes a reflected XSS in the SCORM Engine’s playerConfUrl parameter in /defaultui/player/modern.html. Affected versions are SCORM Engine < 20.1.45.914 and 21.1.x

designbiz.com Cross Site Scripting vulnerability OBB-2643423

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

tualityphysicians.com Cross Site Scripting vulnerability OBB-2640076

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kas.de Cross Site Scripting vulnerability OBB-2636208

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Bypass filter - Stored XSS in Resources

Description Website does incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This fix for this bug https://huntr.dev/bounties/dcf87c0b-6188-4817-8798-ef1e2581b15a/ can be bypassed using bellow payload...

CVE-2022-29540

resi-calltrace in RESI Gemini-Net 4.2 is affected by Multiple XSS issues. Unauthenticated remote attackers can inject arbitrary web script or HTML into an HTTP GET parameter that reflects user input without sanitization. This exists on numerous application endpoints,...

Cross site scripting

A cross-site scripting XSS vulnerability in /omps/seller of Online Market Place Site v1.0 allows attackers to execute arbitrary web cripts or HTML via a crafted payload injected into the Page parameter...

CVE-2019-12349

The CVE-2019-12349 entry applies to the zzCMS 2019 CMS, where a SQL injection exists in /admin/dl_sendsms.php via the id parameter. The vulnerability is rooted in improper handling of the id input, with public sources citing the lack of single quotes as the underlying cause (CNVD-2022-56481, RH a...

Online Car Wash Booking System SQL注入漏洞

Online Car Wash Booking System is an online car wash booking system from Carlo Montero's personal developer. version v1.0 of Online Car Wash Booking System is vulnerable to SQL injection, which originates from /ocwbs/classes/Master.php?f =getvehicleservice page lacks validation of external input...

ChatBot App with Suggestion SQL注入漏洞

ChatBot App with Suggestion is a ChatBot application with Suggestion by Carlo Montero's personal developer. v1.0 of ChatBot App with Suggestion is vulnerable to SQL injection, which originates from /simplechatbot/ admin/?page=responses/manageresponse&id=The page lacks validation for external inpu...

CVE-2021-27778

CVE-2021-27778 concerns HCL Traveler. The vulnerability is a cross-site scripting (XSS) flaw caused by improper validation of the Name parameter for Approved Applications in the Traveler administration web pages. The impact described across sources is that an attacker could run malicious scripts ...

VulnCheck KEV: CVE-2021-41174

Grafana is an open-source platform for monitoring and observability. In affected versions if an attacker is able to convince a victim to visit a URL referencing a vulnerable page, arbitrary JavaScript content may be executed within the context of the victim's browser. The user visiting the...

CVE-2022-29732

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 are affected by a cross-site scripting (XSS) flaw in the Username parameter. An attacker can cause arbitrary web scripts/HTML to run in a user’s browser, via a crafted payload. The available documents do not specify a fix or remediati...

Weak Password Vulnerability in Netnifty's Web Tampering Prevention System

Beijing Netnifty Information Technology Company is a leading enterprise in the domestic information security industry, specializing in the research and development, production and sales of information security products, and providing hierarchical overall security solutions and security profession...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the currentURL parameter on the Portal Workflow module's edit process page, which is accepted and rendered without sanitization. Details Cross-site scripting or XSS is a code vulnerability that occurs when a...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the redirect URL parameter. An attacker can execute arbitrary scripts in the context of a user's browser by convincing the user to follow a crafted link. Details Cross-site scripting or XSS is a code...