CVE-2024-43164

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Blockspare allows Stored XSS.This issue affects Blockspare: from n/a through 3.2.0...

CVE-2024-43152

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery allows Stored XSS.This issue affects 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery: from n/a through 1.15.6...

CVE-2024-42743

In TOTOLINK X5000r v9.1.0cu.2350b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg . Authenticated Attackers can send malicious packet to execute arbitrary commands...

TOTOLINK X5000R 操作系统命令注入漏洞

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK X5000R version v9.1.0cu.2350b20230313. The vulnerability stems from the setUrlFilterRules method of /cgi-bin/cstecgi.cgi failing to properly filter constructed command...

AMTT HiBOS 安全漏洞

AMTT HiBOS is a hotel broadband operating system from AmTech Century AMTT, China. A security vulnerability exists in AMTT HiBOS version V3.0.3.151204, which originates from a SQL injection vulnerability in the /manager/card/carddetail.php page...

WordPress plugin Mediavine Control Panel 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2024-41240

A Reflected Cross Site Scripting XSS vulnerability was found in " /smsa/teacherlogin.php" in Kashipara Responsive School Management System v3.2.0, which allows remote attackers to execute arbitrary code via the "error" parameter...

PT-2024-29319 · Unknown · Kashipara Responsive School Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Responsive School Management System version 3.2.0 Description: A Reflected Cross Site Scripting XSS issue was discovered in the "/smsa/admin login.php" endpoint, allowing remote attackers to execute arbitrary code via the error...

CVE-2024-39659

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Stored XSS.This issue affects WP-PostRatings: from n/a through 1.91.1...

CVE-2024-39649

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WPDeveloper Essential Addons for Elementor allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through 5.9.26...

SourceCodester Tracking Monitoring Management System 跨站脚本漏洞

SourceCodester Tracking Monitoring Management System is a monitoring management system from SourceCodester, Inc. A cross-site scripting vulnerability exists in SourceCodester Tracking Monitoring Management System version 1.0, which is caused by a cross-site scripting vulnerability in the name...

PT-2024-28568 · Unknown · Contest Gallery

Name of the Vulnerable Software and Affected Versions: Contest Gallery versions through 23.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in Contest Gallery. Recommendations:...

The vulnerability in the script /app/tools/request-ip/index.php of the PHPIPAM IP management web application allows a attacker to execute XSS attacks.

The vulnerability in the app/tools/request-ip/index.php web application for IP address management via phpipam exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks remotely...

The vulnerability of the GLPI system’s request and incident handling process, related to improper elimination of input data during the generation of web pages, allows a malicious actor to create malicious external links.

The vulnerability of the GLPI system for handling requests and incidents is related to the improper elimination of input data during the generation of the web page. Exploiting this vulnerability allows a malicious actor to create a malicious external link...

TOTOLINK A3600R 操作系统命令注入漏洞

TOTOLINK A3600R is a 6-antenna 1200M wireless router manufactured by China's Gion Electronics TOTOLINK. The TOTOLINK A3600R suffers from an OS command injection vulnerability. The vulnerability originates in the /cgi-bin/cstecgi.cgi file stemming from improper handling of the ipDomain parameter. ...

TOTOLINK A3600R 安全漏洞

TOTOLINK A3600R is a 6-antenna 1200M wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3600R suffers from a buffer overflow vulnerability that originates from the url parameter in the setUrlFilterRules function of the /cgi-bin/cstecgi.cgi file that fails to correctly validate...

The vulnerability of the GLPI system’s request and incident handling process, related to incorrect input cancellation during the generation of web pages, allows attackers to carry out attacks using cross-site scripting.

The vulnerability of the GLPI system’s request and incident handling functionality lies in the lack of cleaning during the loading of SVG files, as well as the integration of JavaScript into user avatars. Exploiting this vulnerability allows a malicious actor to carry out an attack using cross-si...

CVE-2024-41550

CampCodes Supplier Management System v1.0 is vulnerable to SQL injection via SupplyManagementSystem/admin/viewinvoiceitems.php?id=...

CVE-2024-37223

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Nicdark Restaurant Reservations allows Stored XSS.This issue affects Restaurant Reservations: from n/a through 2.0...

CVE-2024-37116

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in sinatrateam Sinatra allows Stored XSS.This issue affects Sinatra: from n/a through 1.3...