CVE-2020-23184

CVE-2020-23184 is a stored XSS vulnerability in PHP-Fusion 9.03.60. The issue affects the /administration/settings_registration.php script where user input in the Registration field can be stored and later executed as script/html by authenticated users. Impact is web-script execution and HTML ren...

CVE-2020-23181

CVE-2020-23181 is a reflected cross-site scripting (XSS) vulnerability in PHP-Fusion 9.03.60. The flaw occurs in /administration/theme.php and can be exploited by an authenticated attacker who injects a crafted payload into the “Manage Theme” field to execute arbitrary web scripts or HTML in the ...

CVE-2020-23179

CVE-2020-23179 describes a stored XSS in PHP-Fusion 9.03.50 via the Site footer field in administration/settings_main.php. An authenticated user can inject script/HTML that is stored and later rendered to other users. Affected component: PHP-Fusion’s admin settings_main.php; vulnerability type: s...

CVE-2020-23214

CVE-2020-23214 is a stored XSS vulnerability in phplist 3.5.3 that allows an attacker to inject and execute arbitrary web scripts/HTML through the Configure categories field in the Categorise Lists module. Public references across multiple sources (NVD, OSV, CNVD, Red Hat, etc.) confirm the same ...

CVE-2020-23209

phplist 3.5.3 contains a stored XSS in the List Description field of the Edit A List module. The issue allows execution of arbitrary scripts/HTML via crafted input; root cause is unsanitized/unsafe input handling. Affected component: List Description in phplist 3.5.3. Remediation: update to a new...

CVE-2020-23205

CVE-2020-23205 is a stored XSS vulnerability in Monstra CMS 3.0.4 . The flaw allows an attacker to inject and execute arbitrary web scripts or HTML by crafting a payload into the Site Name field in the Site Settings module. Current sources describe the vulnerability as a stored XSS with impact li...

Online Voting System 1.0 Remote Code Execution

Exploit Title: Online Voting System 1.0 - Remote Code Execution Authenticated Exploit Author: deathflash1411 Date 30.06.2021 Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/php/4808/voting-system-php.html Version 1.0 Tested on: Ubuntu 20.04 Proof of...

Simple Traffic Offense System 1.0 - Stored Cross Site Scripting (XSS)

Exploit Title: Simple Traffic Offense System 1.0 - 'Multiple' Stored Cross Site Scripting XSS Date: 30-06-2021 Exploit Author: Barış Yıldızoğlu Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/trafic.zip Version:...

Homebrew: clickjacking at brew.sh

hello , While performing security testing of your website i have found the vulnerability called Clickjacking. URL is in scope and vulnerable to Clickjacking. What is Clickjacking ? Clickjacking User Interface redress attack, UI redress attack, UI redressing is a malicious technique of tricking a...

U.S. Dept Of Defense: RXSS ON https://██████████

Description: Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differe...

Design/Logic Flaw

Through complicated navigations with new windows, an HTTP page could have inherited a secure lock icon from an HTTPS page. This vulnerability affects Firefox ESR 78.10, Thunderbird 78.10, and Firefox 88...

CVE-2020-23962

This CVE-2020-23962 is a documented XSS vulnerability in Catfish CMS 4.9.90. The flaw allows an attacker to inject arbitrary web scripts/HTML via the announcement_gonggao parameter, enabling script execution in the victim’s browser. The affected component is Catfish CMS (version 4.9.90); the root...

CVE-2021-34243

CVE-2021-34243 affects Ice Hrm 29.0.0.OS with a stored XSS flaw in the Document Management tab. A crafted file uploaded to that tab can cause arbitrary web scripts/HTML to execute when a user visits the upload location. The available sources reiterate the same condition but do not provide concret...

OWASP ESAPI 安全漏洞

OWASP ESAPI is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. A security vulnerability exists in OWASP ESAPI version 2.0 RC2 and prior versions. The vulnerability stems from an oracle padding attack...

CVE-2020-20468

White Shark System WSS 1.3.2 is vulnerable to CSRF. Attackers can use the usereditpassword.php file to modify the user password...

CVE-2021-31521

Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting XSS vulnerability in the product's Captive Portal...

CVE-2021-31521

Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting XSS vulnerability in the product's Captive Portal...

Cross site scripting

Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting XSS vulnerability in the product's Captive Portal...

CVE-2021-31521

Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting XSS vulnerability in the product's Captive Portal...

CVE-2021-31521

Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting XSS vulnerability in the product's Captive Portal...