Lucene search
+L

15167 matches found

Huntr
Huntr
added 2021/10/14 4:45 p.m.13 views

in forkcms/forkcms

Description Insufficient Session expiration even after Credential like password of the account is being updated. Proof of Concept open the same account in multiple browsers. change the password in one Browser. Reload the other one. as a result we can see the account on the other browser is not...

3.7AI score
SaveExploits0
CNNVD
CNNVD
added 2021/10/14 12:00 a.m.9 views

Ericsson Network Manager 跨站脚本漏洞

Ericsson Network Manager is a network manager from Ericsson, Sweden. It covers monitoring, troubleshooting, configuration, automation and optimization of networks. Ericsson Network Manager suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-si...

6.1CVSS6.1AI score0.00601EPSS
SaveExploits0References2
CNNVD
CNNVD
added 2021/10/14 12:00 a.m.9 views

Tuleap Open ALM 跨站脚本漏洞

Enalean Tuleap Open Alm is a free and open source tool from Enalean France. It is used for end-to-end traceability of application and system development. Tuleap Open ALM suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by a WEB...

5.4CVSS5.6AI score0.00725EPSS
SaveExploits0References5
Veracode
Veracode
added 2021/10/13 5:26 p.m.45 views

HTTP Request Smuggling (HRS)

nodejs is vulnerable to HTTP Request Smuggling HRS. The vulnerability exists due to an error related to a space in headers which allows an attacker to poison the web cache, bypassing the web application...

6.5CVSS7.8AI score0.02936EPSS
SaveExploits1References4Affected Software5
CVE
CVE
added 2021/10/13 5:10 p.m.58 views

CVE-2021-41139

Anuko Time Tracker (PHP) suffers a reflected XSS in time.php via the date URI parameter, exploitable before patch in 1.19.30.5600. An attacker could persuade a logged-in user to click a crafted link, causing attacker-supplied JavaScript to execute in the user’s browser. Remediated in version 1.19...

8.1CVSS6.4AI score0.01023EPSS
SaveExploits0References3Affected Software1
Huntr
Huntr
added 2021/10/13 11:14 a.m.13 views

Cross-site Scripting (XSS) - Reflected in dmpop/mejiro

Description From OWASP : : Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script...

5.6AI score
SaveExploits0References2
Exploit DB
Exploit DB
added 2021/10/13 12:00 a.m.316 views

Simple Issue Tracker System 1.0 - SQLi Authentication Bypass

Exploit Title: Simple Issue Tracker System 1.0 - SQLi Authentication Bypass Date: 11.10.2021 Exploit Author: Bekir Bugra TURKOGLU Vendor Homepage: https://www.sourcecodester.com/php/14938/simple-issue-tracker-system-project-using-php-and-sqlite-free-download.html Software Link:...

5.3AI score
SaveExploits0
Gitee
Gitee
added 2021/10/12 8:51 p.m.17 views

Exploit for Off-by-one Error in Sudo_Project Sudo

PoC exploit for CVE-2021-3156, an exploit module targeting the WangluoAnquan framework. The exploit is designed to demonstrate the vulnerability in the framework's UploadHandler.ashx component, which allows for arbitrary file uploads. The exploit uses a simple form submission to upload a maliciou...

7.8CVSS8.3AI score0.99969EPSS
SaveExploits83
ATTACKERKB
ATTACKERKB
added 2021/10/12 6:15 p.m.7 views

CVE-2021-40292

A Stored Cross Site Sripting XSS vulnerability exists in DzzOffice 2.02.1 via the settingnew parameter...

5.4CVSS5.8AI score0.00516EPSS
SaveExploits1References2
Prion
Prion
added 2021/10/12 3:15 p.m.18 views

Cross site scripting

SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to the victim and executed by the web browser, resulting in...

4.3CVSS6AI score0.00747EPSS
SaveExploits0References2Affected Software1
Cvelist
Cvelist
added 2021/10/12 2:04 p.m.37 views

CVE-2021-38183

SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to the victim and executed by the web browser, resulting in...

6.2AI score0.00747EPSS
SaveExploits0References2
CNVD
CNVD
added 2021/10/12 12:00 a.m.37 views

Projectsend directory traversal vulnerability

A directory traversal vulnerability exists in ProjectSend version r1295, a free, customer-facing private file sharing Web application. The vulnerability stems from a lack of validation of the input to the files parameter. An attacker could exploit the vulnerability by adding ... /upload/files/...

10CVSS2.8AI score0.0237EPSS
SaveExploits1
CNNVD
CNNVD
added 2021/10/11 12:00 a.m.7 views

ProjectSend 跨站脚本漏洞

Projectsend formerly known as cFTP is a suite of self-hosted applications based on PHP and MySQL. Projectsend suffers from a cross-site scripting vulnerability that stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to...

5.4CVSS5.7AI score0.00644EPSS
SaveExploits1References3
OpenVAS
OpenVAS
added 2021/10/11 12:00 a.m.11 views

LimeSurvey 3.x-LTS < 3.27.19 XSS Vulnerability

LimeSurvey is prone to a cross-site scripting XSS vulnerability in assets/scripts/modaldialog.js and assets/scripts/uploader.js. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

6.1CVSS6AI score0.0153EPSS
SaveExploits1References2
CNVD
CNVD
added 2021/10/11 12:00 a.m.15 views

Tad TadTools Cross-Site Scripting Vulnerability

Tad TadTools is a module toolkit for individual developers at Tad in Taiwan, China. Used for module development, it can dramatically reduce the size of each module and speed up the development process. Tad TadTools suffers from a cross-site scripting vulnerability that originates from the lack of...

6.1CVSS6.3AI score0.00746EPSS
SaveExploits0References1
CNVD
CNVD
added 2021/10/10 12:00 a.m.48 views

Fortinet FortiWebManager Cross-Site Scripting Vulnerability

Fortinet FortiWebManager is a web application firewall from Fortinet, Inc. A cross-site scripting vulnerability exists in Fortinet FortiWebManager versions 6.2.3 and 6.0.2 and below, which stems from a lack of checksum filtering of user-supplied and output data, and can be exploited by attackers ...

5.4CVSS1.9AI score0.00599EPSS
SaveExploits0References1
CNVD
CNVD
added 2021/10/09 12:00 a.m.56 views

WordPress Appointment Hour Booking plugin cross-site scripting vulnerability (CNVD-2022-01701)

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . The WordPress Appointment Hour Booking plugin suffers fro...

4.8CVSS4.8AI score0.00617EPSS
SaveExploits2References1
CNVD
CNVD
added 2021/10/09 12:00 a.m.23 views

WordPress plugin CM Tooltip Glossary cross-site scripting vulnerability

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL.A cross-site scripting vulnerability exists in the WordPress plugin CM Tooltip Glossary, which stems fro...

5.4CVSS1.8AI score0.00624EPSS
SaveExploits2References1
CNVD
CNVD
added 2021/10/09 12:00 a.m.16 views

Calibre-Web Cross-Site Scripting Vulnerability

Calibre-Web is a web application for browsing, reading and downloading eBooks from the Calibre database. A cross-site scripting vulnerability exists in the Calibre-web application versions v0.6.0 through v0.6.12, which can be exploited by an attacker to inject JavaScript exploit script into the...

5.4CVSS6AI score0.00549EPSS
SaveExploits0References1
CNVD
CNVD
added 2021/10/09 12:00 a.m.45 views

Bosch Rexroth IndraMotion Mlc Cross-Site Scripting Vulnerability

The Bosch Rexroth IndraMotion Mlc is a new device that combines motion and logic control, as well as robot control.A cross-site scripting vulnerability exists in the Bosch Rexroth IndraMotion Mlc, which stems from the lack of proper validation of client-side data by the WEB application. An attack...

10CVSS2.3AI score0.00629EPSS
SaveExploits0References1
Rows per page
Query Builder