zimihc.nl Cross Site Scripting vulnerability OBB-3857664

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

techbubble.info Cross Site Scripting vulnerability OBB-3857632

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

kemfil.ru Cross Site Scripting vulnerability OBB-3857543

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

comais.it Cross Site Scripting vulnerability OBB-3857292

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

perfectton.blog.fc2.com Cross Site Scripting vulnerability OBB-3856909

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PortSwigger Web Security: CSP Bypass and escalation of https://hackerone.com/reports/2279346

Vulnerability description not provided...

Mozilla: Fullscreen Notification could have been hidden by select element

The Mozilla Foundation Security Advisory describes this flaw as: A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion and possible spoofing attacks...

astruc-traiteur.com Cross Site Scripting vulnerability OBB-3856140

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-26484

A stored cross-site scripting XSS vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link field. NOTE: the vendor's position is that this issue did not affect any version of Kirby CM...

CVE-2024-25801

SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name not the content of a file...

CVE-2024-25874

CVE-2024-25874 is an XSS in Enhavo CMS v0.13.1, exposed in the New/Edit Article module via the Create Tag field. The vulnerability allows execution of arbitrary scripts/HTML when a crafted payload is injected into that field. Public details confirm the affected software/component and impact, but ...

CVE-2024-25876

Enhavo CMS v0.13.1’s Header module is vulnerable to Cross‑Site Scripting (XSS) via a crafted payload injected into the Title field. The root cause is inadequate sanitization of user-supplied input in Title, enabling execution of arbitrary scripts in the affected context. Public advisories and vul...

backinmotion.com.au Cross Site Scripting vulnerability OBB-3855963

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

playterritory.com Cross Site Scripting vulnerability OBB-3855768

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-1081

The 3D FlipBook – PDF Flipbook WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bookmark feature in all versions up to, and including, 1.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2024-25603

The CVE-2024-25603 issue affects Liferay Portal and Liferay DXP where a stored XSS flaw exists in the Dynamic Data Mapping (DDMForm) component. The vulnerability allows remote authenticated users to inject arbitrary web script or HTML via the instanceId parameter. Affected versions include Portal...

CVE-2022-45169

CVE-2022-45169 affects LIVEBOX Collaboration vDesk (through v031). It describes an Open Redirect: an authenticated user can trigger a URL redirection via /api/v1/notification/createnotification to send a push notification to another user that can include an invisible clickable link. Reported metr...

CVE-2024-25895

CVE-2024-25895 affects ChurchCRM 5.5.0. The vulnerability is a reflected cross-site scripting (XSS) in the /EventAttendance.php endpoint, exploitable via the type parameter. The underlying cause is improper handling of user-supplied input in that parameter, allowing an attacker to inject arbitrar...

WEBIGniter 28.7.23 Cross Site Scripting

Exploit Title: WEBIGniter v28.7.23 Stored Cross Site Scripting XSS Exploit Author: Sagar Banwa Date: 19/10/2023 Vendor: https://webigniter.net/ Software: https://webigniter.net/demo Reference: https://portswigger.net/web-security/cross-site-scripting Tested on: Windows 10/Kali Linux CVE :...

CVE-2024-0656

CVE-2024-0656 affects the Password Protected – Ultimate Plugin to Password Protect Your WordPress Content with Ease for WordPress, all versions up to 2.6.6. It enables Stored XSS via the Google Captcha Site Key due to insufficient input sanitization/output escaping. Exploitation requires administ...