Code injection

IBM PowerSC 1.3, 2.0, and 2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the...

PT-2024-14050 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI versions up to and including 2024R1 Description: A stored cross-site scripting XSS vulnerability in the NOC component allows low-privileged users to execute malicious HTML or JavaScript code via the audio file upload functionality...

Cross site scripting

A stored cross-site scripting XSS vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the location parameter at /travel-journal/write-journal.php...

WordPress plugin CBX Bookmark & Favorite cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerability...

CVE-2024-22292

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.2.8...

CVE-2024-22569

Stored Cross-Site Scripting XSS vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=index&step=2&isinstalldb=0...

TOTOLINK N200RE 安全漏洞

The TOTOLINK N200RE is a wireless router for the SOHO market. The TOTOLINK N200RE suffers from a buffer overflow vulnerability that originates from a stack-based buffer overflow in the command parameter of the setDiagnosisCfg function of /cgi-bin/cstecgi.cgi. No detailed vulnerability details are...

Cups Easy 跨站脚本漏洞

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from insufficient escaping of the stateid parameter on the /cupseasylive/statecreate.php page. An attacker could use...

Cups Easy 跨站脚本漏洞

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from a failure to adequately escape the description parameter on the /cupseasylive/taxstructuredisplay.php page. An...

Cups Easy 跨站脚本漏洞

Cups Easy is a PHP-based purchasing and inventory software that may become a full-fledged ERP in the future. Cups Easy suffers from a cross-site scripting vulnerability that stems from a failure to adequately escape the description parameter on the /cupseasylive/taxstructurelist.php page. An...

kafka-ui OS Command Injection Vulnerability

kafka-ui is an open source Web UI for Apache Kafka. A security vulnerability in kafka-ui versions 0.4.0 through 0.7.1 exists that originates from a vulnerability that could allow a remote attacker to execute arbitrary code via parameter q in /api/clusters/local/topics/messages...

FusionPBX vulnerable to cross-site scripting

Overview FusionPBX contains a stored cross-site scripting vulnerability CWE-79. Satoshi Horikoshi reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may be executed on the web browser of the...

whiskyforum.gr Improper Access Control vulnerability OBB-3837405

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-20257

CVE-2023-20257 affects Cisco Prime Infrastructure and Cisco EPNM web-based management interfaces. The flaw stems from improper validation of user-supplied input, allowing an authenticated, remote attacker to submit malicious content that is stored and can trigger cross-site scripting against othe...

CVE-2023-51722

CVE-2023-51722 affects Skyworth Router CM5100, version 4.1.1.24. The vulnerability arises from insufficient validation of input to the Time Server 3 parameter on the web interface, allowing a remote attacker to craft input that yields a stored XSS condition on the target system. The connected sou...

Stupid Simple CMS 安全漏洞

Stupid Simple CMS is a content management system. Stupid Simple CMS suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an attacker to execute arbitrary web script or HTML by...

Simple Online Hotel Reservation System 跨站脚本漏洞

Simple Online Hotel Reservation System is an online hotel reservation system. A cross-site scripting vulnerability exists in Simple Online Hotel Reservation System version 1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the addreserve.php file, and can ...

Online Lawyer Management System SQL Injection Vulnerability

Online Lawyer Management System is an online lawyer management system. A security vulnerability exists in version 1.0 of the Online Lawyer Management System, which stems from a parameter experience in the file searchLawyer.php that can lead to SQL injection...

Hospital Management System 跨站脚本漏洞

A Hospital Management System HMS is a computerized system that helps manage healthcare-related information and helps healthcare providers do their jobs effectively. A cross-site scripting vulnerability exists in Hospital Management System V4.0, which stems from the application's lack of effective...

Community by PeepSo < 6.3.1.2 - Reflected XSS

Description The plugin does not sanitise and escape various parameters and generated URLs before outputting them back attributes, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open When the register your copy noti...