Cross-site Scripting (XSS)

Overview fatfreecrm is a customer relationship management platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via an authenticated request to the /comments URI. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a...

Inout Blockchain AltExchanger SQL注入漏洞

Nesote Technologies Inout Blockchain AltExchanger is a premium and secure cryptocurrency exchange platform script by Nesote Technologies India. It helps you to start cryptocurrency exchange service online. An SQL injection vulnerability exists in Inout Blockchain AltExchanger version 1.2.1, which...

CVE-2021-39043

IBM Jazz Team Server (Jazz Team Server) versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 are affected by CVE-2021-39043 allowing stored cross-site scripting in the Web UI, potentially leading to credentials disclosure within a trusted session. The root cause is a stored XSS flaw in the Web UI that ...

bired.org Cross Site Scripting vulnerability OBB-2622129

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-29646

CVE-2022-29646 affects TotoLink A3100R routers (versions V4.1.2cu.5050_B20200504 and V4.1.2cu.5247_B20211129). The public docs describe an access-control flaw that allows attackers to obtain sensitive information via a crafted web request, i.e., a remote, network-based impact with low attack comp...

OnePress Social Locker <= 5.6.2 - Arbitrary Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack document.getElementById"test".submit; form id="test"...

CVE-2022-1465

The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue...

BWASP - BoB Web Application Security Project

The BoB Web Application Security Project BWASP is an open-source, analysis tool to support for Web Vulnerability Manual Analysis hackers. The BWASP tool basically provides predicted information through vulnerability analysis without proceeding with an attack. BWASP supports performing automated...

GHSA-VX5C-598G-QPG6 ChakraCore RCE Vulnerability

The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," a different vulnerability than CVE-2016-7200, CVE-2016-7201,...

savannahcosmetology.com Cross Site Scripting vulnerability OBB-2617173

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-22796 Sysaid – Sysaid System Takeover

Sysaid – Sysaid System Takeover - An attacker can bypass the authentication process by accessing to: /wmiwizard.jsp, Then to: /ConcurrentLogin.jsp, then click on the login button, and it will redirect you to /home.jsp without any authentication...

CVE-2022-29747

Simple Client Management System 1.0 is vulnerable to SQL Injection via /cms/admin/?page=invoice/manageinvoice&id= // Leak place --- id...

Explore CMS 1.0 - SQL Injection Vulnerability

Exploit Title: Explore CMS 1.0 - SQL Injection Exploit Author: Sajibe Kanti Vendor Name : EXPLORE IT Vendor Homepage: https://exploreit.com.bd CVE: CVE-2022-27412 POC SQL Injection SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an...

Explore CMS 1.0 - SQL Injection

Exploit Title: Explore CMS 1.0 - SQL Injection Date: 19/03/2022 Exploit Author: Sajibe Kanti Vendor Name : EXPLORE IT Vendor Homepage: https://exploreit.com.bd CVE: CVE-2022-27412 POC SQL Injection SQL injection is a web security vulnerability that allows an attacker to interfere with the queries...

php: SSRF bypass in FILTER_VALIDATE_URL

A flaw was found in php. Currently, php's FILTERVALIDATEURL check doesn't recognize some non-compliant RFC 3986 URLs and returns them as valid. This flaw allows an attacker to craft URLs, which depending on how the URL filter checking is used on the application side, lead to Server Side Request...

CVE-2022-27308

PHProjekt PhpSimplyGest v1.3.0 is affected by a stored XSS vulnerability that can be triggered via the project title. The issue is described across multiple connected sources as allowing attackers to execute arbitrary web scripts or HTML within PHProjekt/MyProjects projects (including items like ...

多款MEIKYO ELECTRIC产品跨站请求伪造漏洞

WATCH BOOT nino RPC-M2C and WATCH BOOT light RPC-M5C are both MEIKYO ELECTRIC products.WATCH BOOT nino RPC-M2C is a rebooter.WATCH BOOT light RPC-M5C is a rebooter. A cross-site request forgery vulnerability exists in various MEIKYO ELECTRIC products, which stems from insufficient authentication ...

fujisystems.co.jp Cross Site Scripting vulnerability OBB-2611664

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Craft CMS 3.7.36 Password Reset Poisoning Attack Vulnerability

Craft CMS version 3.7.36 suffers from a password reset poisoning vulnerability. An unauthenticated attacker who knows valid email addresses or account names of Craft CMS backend users is able to manipulate the password reset functionality in a way that the registered users of the CMS receive...

CVE-2022-26889

Splunk Enterprise before 8.1.2 is vulnerable to a path traversal flaw in the URI path used to load a relative resource within a web page. The root cause is lack of proper filtering of relative URL paths, enabling potential arbitrary content injection (HTML Injection, XSS) or bypass of SPL safegua...