D-Link DSL-2750U 跨站脚本漏洞

The D-Link DSL-2750U is a wireless router from China-based AUO D-Link. The D-Link DSL-2750U R5B017 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter PortMappingDescription, which can be exploited b...

Gradio 跨站脚本漏洞

Gradio, an open source Python library open-sourced by Hugging Face, is a method for demonstrating machine learning models through a friendly web interface. Gradio suffers from a cross-site scripting vulnerability that originates from an authenticated user being able to upload files containing...

PT-2024-31954 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.6 Description: The issue is a command injection vulnerability that allows attackers to execute arbitrary commands via supplying a crafted HTTP message. This is achieved through the sub 2C920 function at the...

Exploit for CVE-2024-42718

Welcome Hello!!! My name is Jacopo and I have been worki...

DEBIAN-CVE-2024-43362

Cacti is an open source performance and fault management framework. The fileurl parameter is not properly sanitized when saving external links in links.php . Morever, the said fileurl is placed in some html code which is passed to the print function in link.php and index.php, finally leading to...

CVE-2024-47381

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Averta Depicter Slider allows Stored XSS.This issue affects Depicter Slider: from n/a through 3.2.2...

CVE-2024-47630

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in ElementInvader ElementInvader Addons for Elementor allows Stored XSS.This issue affects ElementInvader Addons for Elementor: from n/a through 1.2.7...

Cross-site Scripting (XSS)

Overview tribalsystems/zenario is a Zenario is a web-based content management system for sites with one or many languages. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Organizer tags field. An attacker can manipulate the output or behavior of the applicatio...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the block/locale endpoint due to improper sanitization of the locale parameter. PoC html https://redacted.de/cookiebar/block/dens82w%22%3E%3Cimg%20src%3da%20onerror%3dalert1%3Ew9qt...

Code-Projects Student Record System SQL注入漏洞

Code-Projects Student Record System is a Code-Projects open source student record system. Code-Projects Student Record System version 1.0 has a SQL injection vulnerability that originates from SQL injection of the pincode parameter in the /pincode-verification.php file...

Code-Projects Blood Bank Management System SQL注入漏洞

Code-Projects Blood Bank Management System is a Code-Projects open source blood bank management system. A SQL injection vulnerability exists in Code-Projects Blood Bank Management System version 1.0, which originates from a SQL injection vulnerability in the username/password parameters in the...

PT-2024-39375 · Unknown · Crmgo Saas

Name of the Vulnerable Software and Affected Versions: CodeCanyon CRMGo SaaS versions up to 7.2 Description: A problematic issue has been found in the software, affecting some unknown processing of the file "/project/task/task id/show". The manipulation of the comment argument leads to cross-site...

VulnCheck KEV: CVE-2018-18775

Microstrategy Web, version 7, does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting XSS vulnerability via the Login.asp Msg parameter. NOTE: this is a deprecated product...

Bus Pass Management System pass-bwdates-reports-details.php file cross-site scripting vulnerability

Bus Pass Management System is a bus pass management system. Bus Pass Management System has a cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the fromdate and todate parameters in the...

PT-2024-38799 · WordPress · Accordion Image Menu

Name of the Vulnerable Software and Affected Versions: Accordion Image Menu WordPress plugin versions 3.1.3 and earlier Description: The issue is related to the lack of CSRF checks in some areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add...

CVE-2024-8708

A vulnerability was found in SourceCodester Best House Rental Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file categories.php. The manipulation leads to cross site scripting. The attack may be initiated remotely...

Pegasystem PEGA Platform 安全漏洞

Pegasystem PEGA Platform is a suite of application development platforms from Pegasystem, USA. The platform is used to develop applications such as BPM Business Process Management, Case Management, Real-Time Decision Making and CRM Customer Relationship Management. A security vulnerability exists...

CVE-2024-8473

Cross-Site Scripting XSS vulnerability, whereby user-controlled input is not sufficiently encrypted. Exploitation of this vulnerability could allow an attacker to retrieve the session details of an authenticated user through useremail parameter in /jobportal/admin/login.php...

Cassandra Web File Read

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cassandra Web File Read Vulnerability', 'Description' = %q This module exploits an unauthenticated directory traversal vulnerability in Cassandra...

Grocy 跨站脚本漏洞

Grocy is a web-based self-hosted grocery and home management solution from Grocy Open Source. A cross-site scripting vulnerability exists in Grocy 4.2.0 and earlier versions, which stems from the parameter forceserveas in the file /api/files/recipepictures/ can lead to cross-site scripting attack...