CVE-2024-24819

icingaweb2-module-incubator is a working project of bleeding edge Icinga Web 2 libraries. In affected versions the class gipfl\Web\Form is the base for various concrete form implementations 1 and provides protection against cross site request forgery CSRF by default. This is done by automatically...

WordPress Seotheme Shell Upload

Exploit Title: Wordpress Seotheme - Remote Code Execution Unauthenticated Date: 2023-09-20 Author: Milad Karimi Ex3ptionaL Category : webapps Tested on: windows 10 , firefox import sys , requests, re from multiprocessing.dummy import Pool from colorama import Fore from colorama import init...

CVE-2024-24115

CVE-2024-24115 concerns a stored XSS vulnerability in the Edit Page feature of Cotonti CMS v0.9.24. According to the documents, authenticated attackers can inject and execute arbitrary web scripts or HTML via a crafted payload. The vulnerability is described consistently across multiple sources; ...

celoxis.com Cross Site Scripting vulnerability OBB-3849984

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

riv.ipn.mx Cross Site Scripting vulnerability OBB-3849750

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

birddogsforever.com Cross Site Scripting vulnerability OBB-3849046

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

SISQUAL WFM 7.1.319.103 Host Header Injection Vulnerability

Exploit Title: SISQUAL WFM 7.1.319.103 Host Header Injection Exploit Author: Omer Shaik unknownexploit Vendor Homepage: https://www.sisqualwfm.com Version: 7.1.319.103 Tested on: SISQUAL WFM 7.1.319.103 Affected Version: sisqualWFM - 7.1.319.103 Fixed Version: sisqualWFM - 7.1.319.111 CVE :...

zimmersuche24.com Cross Site Scripting vulnerability OBB-3848736

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2024-20615 · Unknown · Pt Sign Ups

Name of the Vulnerable Software and Affected Versions: PT Sign Ups – Beautiful volunteer sign ups and management made easy versions 1.0.4 and earlier Description: The issue affects the PT Sign Ups – Beautiful volunteer sign ups and management made easy software, allowing Stored XSS due to imprope...

CVE-2023-50962

IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" HSTS web security policy mechanism. IBM X-Force ID: 276004...

Design/Logic Flaw

IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" HSTS web security policy mechanism. IBM X-Force ID: 276004...

CVE-2023-50962 IBM PowerSC information disclosure

IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" HSTS web security policy mechanism. IBM X-Force ID: 276004...

CVE-2023-50962 IBM PowerSC information disclosure

IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" HSTS web security policy mechanism. IBM X-Force ID: 276004...

CVE-2023-50962

This CVE (CVE-2023-50962) affects IBM PowerSC 1.3, 2.0, and 2.1 MFA, which do not implement HTTP Strict Transport Security (HSTS). The Red Hat advisory confirms the same product set. Affected components/versions: PowerSC 1.3, 2.0, 2.1 (MFA). Impact described: information disclosure risk due to mi...

Easy Digital Downloads < 3.2.7 - Shop Manager+ Stored XSS

Description The plugin is vulnerable to Stored Cross-Site Scripting via the variable pricing option title due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manger-level access, to inject arbitrary web scripts in pages that wi...

CVE-2023-51509

CVE-2023-51509 concerns the WordPress plugin RegistrationMagic (Metagauss)

CVE-2023-52194

CVE-2023-52194 applies to the WordPress plugin “oEmbed Gist” (WordPress oEmbed Gist) up to version 4.9.1. The issue is a Cross-Site Scripting (Stored XSS) vulnerability caused by improper neutralization of input during web page generation. Public references indicate the vulnerability exists in af...

CVE-2024-21750

CVE-2024-21750 affects the WordPress Shortcodes Finder plugin ( 1.5.5 (i.e., 1.5.6 or later) to mitigate exploitation. The connected materials also corroborate the vulnerability’s classification as Cross-Site Scripting and list the affected component as the Shortcodes Finder plugin for WordPress.

CVE-2024-24041

CVE-2024-24041 describes a stored XSS in Travel Journal Using PHP and MySQL with Source Code v1.0, via a crafted payload injected into the location parameter on /travel-journal/write-journal.php. Affected: Travel Journal app v1.0. Impact: could allow arbitrary script execution. Root cause: input ...

CVE-2024-24945

CVE-2024-24945 describes a stored XSS in Travel Journal Using PHP and MySQL with Source Code v1.0. The vulnerability affects the “Share Your Moments” input (endpoint /travel-journal/write-journal.php), where crafted payloads can be stored and executed in a victim’s browser, allowing arbitrary web...