16988 matches found
CVE-2022-45038
WBCE CMS v1.5.4 suffers a stored XSS in /admin/settings/save.php, exploitable via a crafted payload in the Website Footer field. Impact described: arbitrary script execution in users' browsers, with risks such as data theft, session hijacking, or page defacement. Affected component: admin/setting...
CVE-2022-45036
WBCE CMS 1.5.4 contains an XSS in the Search Settings module, exploitable via a crafted payload in the No Results field. The vulnerability can lead to execution of arbitrary scripts/HTML in affected pages. Current documents do not provide a remediation or patch details; no exploit status is speci...
CVE-2022-45037
WBCE CMS v1.5.4 contains a stored cross-site scripting (XSS) vulnerability in /admin/users/index.php. The issue allows an attacker to inject arbitrary web scripts or HTML via the Display Name field, potentially leading to execution in pages viewed by other users. Nuclei templates label this as St...
fuerstenfeld.de Cross Site Scripting vulnerability OBB-3069675
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
barlinus.com Cross Site Scripting vulnerability OBB-3069024
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
kurume-catholic.jp Cross Site Scripting vulnerability OBB-3068300
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-45280
CVE-2022-45280 describes a cross-site scripting (XSS) vulnerability in the Url parameter of the "/login.php" endpoint in EyouCMS v1.6.0 . The issue allows an attacker to inject and execute arbitrary web scripts or HTML in a victim’s browser. Multiple sources consistently identify the vulnerable c...
Wowza Streaming Engine Manager Detection (HTTP)
HTTP base detection for Wowza Streaming Engine Manager. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
safesites.info Cross Site Scripting vulnerability OBB-3065337
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Mozilla: Cross-Site Tracing was possible via non-standard override headers
The Mozilla Foundation Security Advisory describes this flaw as: Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies inaccessible to JavaScript such as cookies protected by HTTPOnly. To mitiga...
CVE-2022-45013
A cross-site scripting XSS vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Section Header field...
wallfahrtskirche-vilsbiburg.de Cross Site Scripting vulnerability OBB-3064308
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
3 Types of SQLi in `s` param - (Time/Boolean/Error Based)
Description I have found 3 types of SQLi on the s parameter Proof of Concept Time-Based Time-based SQL Injection is an inferential SQL Injection technique that relies on sending an SQL query to the database which forces the database to wait for a specified amount of time in seconds before...
protechkorea.com Cross Site Scripting vulnerability OBB-3058976
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-42118
A Cross-site scripting XSS vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 15, and 7.3 before service pack 3 allows remote attackers to inject arbitrary web script or HTML via the tag parameter...
123flower.vn Cross Site Scripting vulnerability OBB-3051755
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
beautytherapymedgroup.gr Cross Site Scripting vulnerability OBB-3049198
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
Arches vulnerable to execution of arbitrary SQL
Impact With a carefully crafted web request, it's possible to execute certain unwanted sql statements against the database. Anyone running the impacted versions =7.0.0, =7.1.1 should upgrade as soon as possible. Patches The problem has been patched in the following versions: 6.1.2, 6.2.1, and 7.2...
CVE-2022-43754
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed...
meirinkan-ac.jp Cross Site Scripting vulnerability OBB-3045071
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...