17076 matches found
service.dreusicke.de Cross Site Scripting vulnerability OBB-2144198
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
weberpl.lib.ut.us Cross Site Scripting vulnerability OBB-2143171
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
pzstelmach.de Cross Site Scripting vulnerability OBB-2140285
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Path Traversal in dmpop/mejiro
Description A path traversal attack also known as directory traversal aims to access files and directories that are stored outside the web root folder. By manipulating variables that reference files with “dot-dot-slash ../” sequences and its variations or by using absolute file paths, it may be...
Maccms 跨站请求伪造漏洞
Maccms is a PHP-based content management system CMS for film and television. Maccms suffers from a cross-site request forgery vulnerability, which stems from the fact that links to add and edit articles to the product fail to validate that the request came from a trusted user. An attacker could a...
XML Injection in Any23
An XML external entity XXE injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions 2.5. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's processing of...
Cross-Site Request Forgery (CSRF) in e107inc/e107
✍️ Description Attacker or malicious user is able to change delete any banning record if a logged in user visits attacker website. because lack of CSRF token "checking" 🕵️♂️ Proof of Concept 1.when you logged in open this POC.html in a browser 2.you can check unintentionally blacklist record with...
Xxe
An XML external entity XXE injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions 2.5. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's processing of...
CVE-2021-38555
Apache Any23 is affected by CVE-2021-38555 due to an XML External Entity (XXE) vulnerability in StreamUtils.java, affecting versions before 2.5. The issue allows an attacker to manipulate XML processing and potentially view server files or reach back‑end systems accessible to the application. Rem...
webinars.governing.com Cross Site Scripting vulnerability OBB-2137860
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2020-19295
Jeesns 1.4.2 is affected by a reflected XSS in the /weibo/topic component. A crafted payload in the system error message text field can execute arbitrary scripts/HTML in a victim’s browser. The issue is documented as CVE-2020-19295. Affected product: Jeesns 1.4.2 (reflected XSS) with the vulnerab...
CVE-2020-19292
CVE-2020-19292 affects Jeesns 1.4.2, with a stored XSS in the /question/ask component. The vulnerability allows an attacker to inject and execute arbitrary web scripts or HTML via a crafted payload in a posted question. The provided documents do not include exploitation details or an official rem...
CVE-2020-19291
Summary: CVE-2020-19291 is a stored cross-site scripting (XSS) vulnerability in the /weibo/publishdata component of JEESNS 1.4.2 that allows attackers to execute arbitrary web scripts or HTML via a crafted payload in a posted Weibo. Affected product/component: JEESNS 1.4.2; vulnerable path is /we...
CVE-2020-19290
CVE-2020-19290 is a stored cross-site scripting (XSS) vulnerability in the Jeesns 1.4.2 application, specifically in the /weibo/comment component. The issue enables an attacker to inject and execute arbitrary web scripts or HTML via a crafted payload submitted in Weibo comments. Connected sources...
CVE-2020-19288
Jeesns 1.4.2 has a stored XSS in the /localhost/u component that allows attackers to inject and execute arbitrary scripts via a crafted payload in a private message. Public references confirm the vulnerability and its impact; no specific exploit details or remediation are provided in the connecte...
CVE-2020-19285
The CVE-2020-19285 entry describes a stored XSS vulnerability in Jeesns 1.4.2. Affected component: /group/apply, where an attacker can inject arbitrary web scripts via the Name field, enabling script execution in a user’s browser. Root cause is improper input handling in the group/apply payload p...
CVE-2020-19281
Jeesns 1.4.2 is affected by a stored XSS in the /manage/loginusername field. The vulnerability allows attackers to inject arbitrary web scripts or HTML via a crafted payload in the username parameter. The connected documents confirm the affected component and entry point but do not provide a patc...
CVE-2020-19266
A stored XSS vulnerability exists in Dswjcms 1.6.4, specifically in index.php/Dswjcms/Site/articleList, allowing attackers to execute arbitrary web scripts/HTML. The root cause is lack of input validation/escaping for the affected parameter. No explicit exploitation details or remediation are pro...
CVE-2021-38723
FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items...
The vulnerability of the conference communication component of the Mitel ST 14.2 telecommunications system, related to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.
The vulnerability of the conference communication component in Mitel ST 14.2 telecommunications systems is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...