Young Entrepreneur E-Negosyo System 1.0 Cross Site Scripting

Exploit Title: Young Entrepreneur E-Negosyo System 1.0 - 'PRODESC' Stored Cross-Site Scripting XSS Date: 2021-10-03 Exploit Author: Jordan Glover Vendor Homepage: https://www.sourcecodester.com/php/12684/young-entrepreneur-e-negosyo-system.html Software Link:...

CVE-2021-41462

CVE-2021-41462 : In concrete5-legacy versions ≤ 5.6.4.0, a cross-site scripting (XSS) flaw exists in concrete/elements/collection_add.php via the ctID parameter. This allows remote attackers to inject arbitrary web script or HTML. The affected product is concrete5-legacy 5.6.4.0 and earlier. The ...

CVE-2021-41463

Cross-site scripting (XSS) vulnerability in concrete5-legacy 5.6.4.0 and earlier exists in the toos/permissions/dialogs/access/entity/types/group_combination.php file. The cID parameter can be exploited by remote attackers to inject arbitrary web script or HTML. This CVE’s documented impact is li...

CVE-2021-40970

CVE-2021-40970 affectsSpotweb

CVE-2021-40927

CVE-2021-40927 is an XSS vulnerability in the Spotify-for-Alfred project (callback.php) affecting version 0.13.9 and earlier. The flaw allows remote attackers to inject arbitrary web script or HTML via the error parameter. According to NVD metrics, the exploitability is network-based with medium ...

CVE-2021-40924

CVE-2021-40924 documents a cross-site scripting (XSS) vulnerability in the Bugs/Tinyissue project. The issue affects install/index.php for bugs versions 1.8 and earlier, where the first_name parameter can be abused to inject arbitrary web script or HTML. The connected sources consistently describ...

web.bizkaia.eus Cross Site Scripting vulnerability OBB-2153280

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2021-41101

CVE-2021-41101 affects wire-server prior to 2.106.0, where the CORS Access-Control-Allow-Origin header configured by nginz was too permissive, applying to all subdomains of wire.com. This enables a potential attacker to abuse any subdomain with an XSS vector to talk to the Wire API using the user...

PayloadsAllTheThings

It is an offensive tool for Web Application Security. The repository, PayloadsAllTheThings, contains a list of useful payloads and bypass techniques for web application security and penetration testing/CTF. The provided code snippet is a GitHub funding model configuration file .github/FUNDING.yml...

CVE-2020-20129

LaraCMS v1.0.1 contains a stored cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content editor...

CVE-2020-20781

UCMS 1.4.7 has a stored XSS in /ucms/index.php?do=list_edit that allows arbitrary HTML/script via crafted text in title, keywords, description, or content fields. Connected documents provide no exploitation details or remediation patches/versions; no fix/version info is in the supplied materials....

CVE-2021-41795

The CVE-2021-41795 issue affects the Safari app extension bundled with 1Password for Mac (versions 7.7.0 through 7.8.x before 7.8.7). The root cause is an authorization bypass in the extension component. A malicious web page could exploit this to read a subset of 1Password vault items that are no...

The vulnerability of the HTMLparser function in the TYPO3 content management system allows attackers to perform cross-site scripting attacks.

The vulnerability of the HTMLparser function in the TYPO3 content management system exists because measures are not taken to protect the structure of web pages when processing HTML tags and attributes. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks...

CVE-2020-20695

GilaCMS v1.11.4 is affected by a stored XSS vulnerability in the SVG handling, allowing an attacker to execute arbitrary web scripts or HTML via a crafted SVG file. This CVE (CVE-2020-20695) is corroborated by multiple connected advisories and national/third-party vulnerability entries (e.g., GHS...

Exploit for Improper Encoding or Escaping of Output in F5 Nginx

This is an offensive tool for web application security training. It is a collection of vulnerable web applications, each with its own set of vulnerabilities, designed to help users learn and practice web application security testing. The repository contains a variety of web applications, includin...

Cross-Site Request Forgery (CSRF) in collectiveaccess/providence

Description No CSRF token and GET requests allowed in Data and Metadata imports Proof of Concept 1. Login as administrator 2. Create a directory called test in /import directory and put a CSV file inside 3. On the browser with administrator cookies, visit...

CVE-2021-41088

Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend started by elvish -web hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a...

CVE-2020-19950

CVE-2020-19950 applies to YzmCMS v5.3, specifically the vulnerable /banner/add.html component. The connected documents confirm a cross-site scripting (XSS) vulnerability that allows an attacker to execute arbitrary web scripts or HTML in the context of the affected user. The available sources do ...

CVE-2020-19949

YzmCMS v5.3 contains a cross-site scripting (XSS) vulnerability in the /link/add.html component. The issue allows attackers to execute arbitrary web scripts or HTML. The CVE entry is supported by multiple sources (NVD, Red Hat, CNVD, OSV, CNVD) that describe the same flaw. The provided connected ...

shop.elparts.fi Cross Site Scripting vulnerability OBB-2146553

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...