CVE-2020-36414

CMS Made Simple is affected by a stored XSS in version 2.2.14 via crafted payloads entered in the Add Article feature (URL slug or Extra fields). The vulnerability requires authentication and could allow executing arbitrary scripts/HTML in the victim’s browser. Publicly documented fixes point to ...

CVE-2020-36411

CMS Made Simple 2.2.14 contains a stored XSS vulnerability exploited via crafted input in the Path for the {page_image} tag: and Path for thumbnail field: parameters in the Content Editing Settings module. The issue permits authenticated users to inject and execute arbitrary web scripts/HTML in t...

CVE-2020-36399

CVE-2020-36399 describes a stored cross-site scripting (XSS) vulnerability in phplist versions 3.5.4 and earlier, exploitable via a crafted payload in the “rule1” parameter under the “Bounce Rules” module. All connected sources corroborate that the issue is a client-side scripting vulnerability t...

CVE-2020-36396

The CVE refers to LavaLite 5.8.0, specifically a stored XSS in the /admin/roles/role component. An authenticated attacker can inject arbitrary web scripts/HTML via the New parameter, enabling script execution in the context of the logged-in user. The provided connected documents confirm the vulne...

CVE-2020-36395

CVE-2020-36395 affects LavaLite 5.8.0 with a stored XSS vulnerability in the /admin/user/team component. The issue allows an authenticated attacker to inject and execute web scripts or HTML via the New parameter, enabling arbitrary script execution in the context of the affected user. Multiple so...

CVE-2020-23190

Phplist 3.5.4 is affected by a stored XSS in the Import emails module. An authenticated attacker can execute arbitrary web scripts or HTML via a crafted payload. Exploitation status is not detailed in the provided sources. Remediation guidance present in PT-2021-10853 recommends disabling the Imp...

CVE-2020-23184

CVE-2020-23184 is a stored XSS vulnerability in PHP-Fusion 9.03.60. The issue affects the /administration/settings_registration.php script where user input in the Registration field can be stored and later executed as script/html by authenticated users. Impact is web-script execution and HTML ren...

CVE-2020-23181

CVE-2020-23181 is a reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 9.03.60. The flaw occurs in /administration/theme.php and can be exploited by an authenticated attacker who injects a crafted payload into the “Manage Theme” field to execute arbitrary web scripts or HTML in the ...

CVE-2020-23179

CVE-2020-23179 describes a stored XSS in PHP-Fusion 9.03.50 via the Site footer field in administration/settings_main.php. An authenticated user can inject script/HTML that is stored and later rendered to other users. Affected component: PHP-Fusion’s admin settings_main.php; vulnerability type: s...

CVE-2020-23214

CVE-2020-23214 is a stored XSS vulnerability in phplist 3.5.3 that allows an attacker to inject and execute arbitrary web scripts/HTML through the Configure categories field in the Categorise Lists module. Public references across multiple sources (NVD, OSV, CNVD, Red Hat, etc.) confirm the same ...

CVE-2020-23209

phplist 3.5.3 contains a stored XSS in the List Description field of the Edit A List module. The issue allows execution of arbitrary scripts/HTML via crafted input; root cause is unsanitized/unsafe input handling. Affected component: List Description in phplist 3.5.3. Remediation: update to a new...

CVE-2020-23205

CVE-2020-23205 is a stored XSS vulnerability in Monstra CMS 3.0.4 . The flaw allows an attacker to inject and execute arbitrary web scripts or HTML by crafting a payload into the Site Name field in the Site Settings module. Current sources describe the vulnerability as a stored XSS with impact li...

Online Voting System 1.0 Remote Code Execution

Exploit Title: Online Voting System 1.0 - Remote Code Execution Authenticated Exploit Author: deathflash1411 Date 30.06.2021 Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/4808/voting-system-php.html Version 1.0 Tested on: Ubuntu 20.04 Proof of...

Simple Traffic Offense System 1.0 - Stored Cross Site Scripting (XSS)

Exploit Title: Simple Traffic Offense System 1.0 - 'Multiple' Stored Cross Site Scripting XSS Date: 30-06-2021 Exploit Author: Barış Yıldızoğlu Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/trafic.zip Version:...

Homebrew: clickjacking at brew.sh

hello , While performing security testing of your website i have found the vulnerability called Clickjacking. URL is in scope and vulnerable to Clickjacking. What is Clickjacking ? Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a...

U.S. Dept Of Defense: RXSS ON https://██████████

Description: Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differe...

Design/Logic Flaw

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

CVE-2020-23962

This CVE-2020-23962 is a documented XSS vulnerability in Catfish CMS 4.9.90. The flaw allows an attacker to inject arbitrary web scripts/HTML via the announcement_gonggao parameter, enabling script execution in the victim’s browser. The affected component is Catfish CMS (version 4.9.90); the root...

CVE-2021-34243

CVE-2021-34243 affects Ice Hrm 29.0.0.OS with a stored XSS flaw in the Document Management tab. A crafted file uploaded to that tab can cause arbitrary web scripts/HTML to execute when a user visits the upload location. The available sources reiterate the same condition but do not provide concret...

OWASP ESAPI 安全漏洞

OWASP ESAPI is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. A security vulnerability exists in OWASP ESAPI version 2.0 RC2 and prior versions. The vulnerability stems from an oracle padding attack...