pnr.dgrsdt.dz Cross Site Scripting vulnerability OBB-2896160

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Password Reset Poisoning

Description Humhub uses the HTTP Host-Header in a password reset request to generate the password reset link that is sent to the user in an email without any filters or checks. This allows an attacker to craft a password reset request using a manipulated host header, resulting in reset-token...

agencecafeine.com Cross Site Scripting vulnerability OBB-2893366

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-36639

CVE-2022-36639 describes a stored XSS in Garage Management System v1.0, exploitable via /client.php name parameter. The vulnerability stems from insufficient input filtering/escaping, allowing arbitrary scripts/UIHTML when a crafted payload is submitted for the name field. Affected component: /cl...

CVE-2022-36600

CVE-2022-36600 affects BlogEngine v3.3.8.0, with a cross-site scripting (XSS) vulnerability in the /blogengine/api/posts component. The issue allows injection of arbitrary web scripts/HTML via the Description field. Documents from NVD, OSV, CNNVD and others confirm the vulnerable product/version ...

web.iisfalcone-righi.edu.it Cross Site Scripting vulnerability OBB-2883821

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

komtasmakine.com.tr Cross Site Scripting vulnerability OBB-2877649

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

webquestfacil.com.br Cross Site Scripting vulnerability OBB-2875540

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-36573

This CVE affects Pagekit CMS v1.0.18, where a cross-site scripting (XSS) vulnerability exists in the Markdown text box used when editing a blog post at /blog/post/edit. The issue is exposed by injecting a crafted payload that leads to arbitrary web scripts/HTML execution. The PT-2022-23480 adviso...

greenwood-direct.co.uk Cross Site Scripting vulnerability OBB-2871502

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Ingredients Stock Management System SQL注入漏洞

Ingredients Stock Management System is an ingredient stock management system from Carlo Montero's personal developer. v1.0 of Ingredients Stock Management System is vulnerable to SQL injection, which originates from a security issue in the /stocks/manage A security issue exists in the id paramete...

CVE-2022-36548

CVE-2022-36548 concerns Edoc-doctor-appointment-system v1.0.1, where a stored cross-site scripting (XSS) flaw exists in the /patient/settings.php endpoint. The vulnerability arises from unsafely handling user input in the Name field, permitting attackers to inject arbitrary scripts or HTML that c...

galerieferrero.com Cross Site Scripting vulnerability OBB-2865946

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-36527

Jfinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the post title text field under the publish blog module...

CVE-2022-36527

CVE-2022-36527 affects Jfinal CMS v5.1.0. Multiple connected sources confirm a cross-site scripting (XSS) vulnerability where an attacker can inject arbitrary web scripts or HTML via a crafted payload into the post title text field under the publish blog module. The underlying issue is the handli...

U.S. Dept Of Defense: Host Header Injection on https://███/████████/Account/ForgotPassword

Dear DoD Team, I found one high bug on your another domain. This is from Hack US Program. Affected domain is https://█████/ An attacker can manipulate the Host header as seen by the web application and cause the application to behave in unexpected ways. Very often multiple websites are hosted on...

portal.frontierspm.com Cross Site Scripting vulnerability OBB-2863216

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

studna.cz Cross Site Scripting vulnerability OBB-2859178

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Mozilla Firefox 安全漏洞

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP and POP mail protocols as well as the HTML mail format. A security vulnerability exists in Mozilla Firefox prior to version 104,...

WP Hotel Booking < 2.0.1 - Unauthenticated Arbitrary Settings Update

The plugin does not have authorisation and CSRF checks in place when updating its settings, which could allow unauthenticated attackers to change them. PoC All settings are affected, example, to change the Thousands Separator one, run the below command in the developer console of the web browser...