4006 matches found
The vulnerability of Adobe Experience Manager’s content and media management system lies in its lack of measures to protect the structure of web pages. This allows attackers to inject malicious scripts into vulnerable form fields.
The vulnerability of the Adobe Experience Manager content and media management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to inject malicious scripts into vulnerable fields within the system...
Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection
A command injection vulnerability in web components of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance. id: CVE-2024-21887 info: name: Ivanti Connect Secure...
EUVD-2026-36767
An issue in the api/plugin.php component of Bludit v3.19.0 allows attackers to execute a directory traversal via supplying a crafted request...
web-vuln-scanner
Web Vulnerability Scanner Basic web application vulnerability...
web-vulnerability-scanner
No d...
Systems-and-Cyber-Security-Coursework
CSI6SCS2526 — Systems and Cyber Security Coursework Gr...
CVE-2026-25860
OpenClinic GA 5.351.19 contains a reflected cross-site scripting vulnerability in the DICOM image upload handler that allows attackers to execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in DICOM file metadata fields. Attackers can craft a DICOM file with...
EUVD-2026-35451
A vulnerability in which an attacker can provide a crafted external URL that may redirect a user to an unintended website...
EUVD-2026-35371
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML int...
GHSA-3CHG-M5W7-QFV5 Spring Framework Cross-site Scripting via JavaScriptUtils
Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape may lead to JavaScript code injection in the browser, potentially resulting in a cross-site scripting XSS vulnerability. Affected versions: Spring Framework 7.0.0 through 7.0.7; 6.2.0 through 6.2.18; 6.1.0 through 6.1.27; 5.3....
Microsoft Office Sharepoint Server 跨站脚本漏洞
Microsoft Office SharePoint is an enterprise content collaboration and document management platform developed by the American company Microsoft. Microsoft Office SharePoint has a cross-site scripting vulnerability, which stems from improper input during the web page generation process. This...
CVE-2026-11507
A vulnerability was found in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /admin/deleteleavetype.php. The manipulation of the argument leavetype results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used...
Web_Vulnerability_Assessment
🕸️ Week 03 — Web Vulnerability Assessment & Exploitation In...
Web_Vulnerability_Assessment
🕸️ Week 03 — Web Vulnerability Assessment & Exploitation In...
CVE-2026-11488
The CVE-2026-11488 entry concerns code-projects Simple Flight Ticket Booking System 1.0. It identifies a SQL injection in the POST Parameter Handler, specifically in checkUser.php via the Username argument. Impact is limited to confidentiality and integrity with a low severity in CVSS metrics, an...
Session Fixation
Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Session Fixation via session fixation...
The vulnerability of the ConfigurationHandler component in the Flask-AppBuilder web development framework allows a attacker to redirect users to arbitrary URL addresses.
The vulnerability of the Flask-AppBuilder web development framework lies in the redirection of URLs to unreliable websites. Exploiting this vulnerability allows a malicious actor to remotely redirect users to arbitrary URL addresses by manipulating the Host header in HTTP requests...
CVE-2025-56537
A stored cross-site scripting XSS vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the virtual network template parameter...
CVE-2025-27852
The locally served web site on the Garmin WDU v1 1.4.6 and v2 5.0 allows a reflected cross site scripting XSS attack. This allows an attacker on the local network segment to execute arbitrary JavaScript code within the context of the WDU webpage. Full administrator level access to the device is...