Cross-Site Request Forgery (CSRF) in e107inc/e107

✍️ Description Attacker or malicious user is able to change delete any banning record if a logged in user visits attacker website. because lack of CSRF token "checking" 🕵️‍♂️ Proof of Concept 1.when you logged in open this POC.html in a browser 2.you can check unintentionally blacklist record with...

Xxe

An XML external entity XXE injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions 2.5. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's processing of...

CVE-2021-38555

Apache Any23 is affected by CVE-2021-38555 due to an XML External Entity (XXE) vulnerability in StreamUtils.java, affecting versions before 2.5. The issue allows an attacker to manipulate XML processing and potentially view server files or reach back‑end systems accessible to the application. Rem...

webinars.governing.com Cross Site Scripting vulnerability OBB-2137860

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

CVE-2020-19295

Jeesns 1.4.2 is affected by a reflected XSS in the /weibo/topic component. A crafted payload in the system error message text field can execute arbitrary scripts/HTML in a victim’s browser. The issue is documented as CVE-2020-19295. Affected product: Jeesns 1.4.2 (reflected XSS) with the vulnerab...

CVE-2020-19292

CVE-2020-19292 affects Jeesns 1.4.2, with a stored XSS in the /question/ask component. The vulnerability allows an attacker to inject and execute arbitrary web scripts or HTML via a crafted payload in a posted question. The provided documents do not include exploitation details or an official rem...

CVE-2020-19291

Summary: CVE-2020-19291 is a stored cross-site scripting (XSS) vulnerability in the /weibo/publishdata component of JEESNS 1.4.2 that allows attackers to execute arbitrary web scripts or HTML via a crafted payload in a posted Weibo. Affected product/component: JEESNS 1.4.2; vulnerable path is /we...

CVE-2020-19290

CVE-2020-19290 is a stored cross-site scripting (XSS) vulnerability in the Jeesns 1.4.2 application, specifically in the /weibo/comment component. The issue enables an attacker to inject and execute arbitrary web scripts or HTML via a crafted payload submitted in Weibo comments. Connected sources...

CVE-2020-19288

Jeesns 1.4.2 has a stored XSS in the /localhost/u component that allows attackers to inject and execute arbitrary scripts via a crafted payload in a private message. Public references confirm the vulnerability and its impact; no specific exploit details or remediation are provided in the connecte...

CVE-2020-19285

The CVE-2020-19285 entry describes a stored XSS vulnerability in Jeesns 1.4.2. Affected component: /group/apply, where an attacker can inject arbitrary web scripts via the Name field, enabling script execution in a user’s browser. Root cause is improper input handling in the group/apply payload p...

CVE-2020-19281

Jeesns 1.4.2 is affected by a stored XSS in the /manage/loginusername field. The vulnerability allows attackers to inject arbitrary web scripts or HTML via a crafted payload in the username parameter. The connected documents confirm the affected component and entry point but do not provide a patc...

CVE-2020-19266

A stored XSS vulnerability exists in Dswjcms 1.6.4, specifically in index.php/Dswjcms/Site/articleList, allowing attackers to execute arbitrary web scripts/HTML. The root cause is lack of input validation/escaping for the affected parameter. No explicit exploitation details or remediation are pro...

CVE-2021-38723

FUEL CMS 1.5.0 allows SQL Injection via parameter 'col' in /fuel/index.php/fuel/pages/items...

The vulnerability of the conference communication component of the Mitel ST 14.2 telecommunications system, related to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the conference communication component in Mitel ST 14.2 telecommunications systems is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

The vulnerability of the PopojiCMS content management system arises from the lack of measures taken to protect the website structure. This allows attackers to execute arbitrary web or HTML scripts.

The vulnerability in the /admin.php?mod=user&act=addnew function of the PopojiCMS content management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary web or HTML scripts by using a special...

borabeynakliyat.com Cross Site Scripting vulnerability OBB-2134709

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

littledutch.lt Cross Site Scripting vulnerability OBB-2133177

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

What is the Reverse Proxy❓ Reverse vs. Forward Proxy

Reverse proxies help in shielding web workers from assaults while further developing execution and dependability. Continue reading to learn more about data about forward and invert proxies.‍ What is a proxy server? Forward proxies are commonly known as proxies, web proxies, or internet servers, are...

websiteparade.de Cross Site Scripting vulnerability OBB-2133166

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

umedia.world Cross Site Scripting vulnerability OBB-2133013

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...