3943 matches found
CVE-2022-44349
NAVBLUE S.A.S N-Ops & Crew 22.5-rc.50 is vulnerable to Cross Site Scripting XSS...
CVE-2023-40592
In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk...
CVE-2023-23565
An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to retrieve PHP files from the server via Local File Inclusion...
PT-2023-5430 · Cacti · Cacti
Name of the Vulnerable Software and Affected Versions: Cacti versions 0.8.7g and earlier Description: A reflected cross-site scripting XSS vulnerability allows unauthenticated remote attackers to inject arbitrary web script or HTML in the ref parameter at "auth changepassword.php". This issue is...
Online Travel Agency System 跨站脚本漏洞
Online Travel Agency System is an online travel agency system. Online Travel Agency System v1.0 version of a cross-site scripting vulnerability, the vulnerability stems from the insert.php parameter description of the user-supplied data lack of effective filtering and escaping, an attacker can...
signalpeptide.de Cross Site Scripting vulnerability OBB-3586268
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PYSEC-2023-141
A stored cross-site scripting XSS vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Custom Link templates...
CVE-2023-36306
A Cross Site Scripting XSS vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components...
CVE-2023-37682
Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-jms/deductScores.php...
Digital Ant E-Commerce Cross-Site Scripting Vulnerability
Digital Ant E-Commerce is an e-commerce platform from Digital Ant, Inc. A cross-site scripting vulnerability exists in versions of Digital Ant E-Commerce Software prior to version 11, which arises from improperly neutralized input during web page generation...
Advantech Cross-Site Scripting Vulnerability
Advantech, an Advantech application in China, provides intelligent electric bus management systems. A cross-site scripting vulnerability exists in Advantech EKI-1524, EKI-1522, EKI-1521 1.21 and earlier versions, which stems from the presence of a stored cross-site scripting vulnerability...
PT-2023-28040 · Emby · Media Browser Emby Server
Name of the Vulnerable Software and Affected Versions: Media Browser Emby Server version 4.7.13.0 Description: A vulnerability was found in the processing of the file /web/, which leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and...
Adiscon LogAnalyzer Cross-Site Scripting Vulnerability
Adiscon LogAnalyzer is a set of web front-end tools for system logs and other network event data. The tool provides log browsing, search and basic analysis, and graphical display. A security vulnerability exists in Adiscon LogAnalyzer version v.4.1.13. An attacker could exploit this vulnerability...
social-media-skeleton SQL Injection Vulnerability
social-media-skeleton is an unfinished social media project implemented in php, css, javascript and html by the individual developer fobybus. A SQL injection vulnerability exists in social-media-skeleton, which stems from the presence of a UNION-based SQL injection vulnerability...
CVE-2023-37499
A Persistent Cross-site Scripting XSS vulnerability can be carried out in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks...
CVE-2023-21410
User provided input is not sanitized on the AXIS License Plate Verifier specific “api.cgi” allowing for arbitrary code execution...
ZKTeco BioTime 安全漏洞
ZKTeco BioTime is a powerful web-based time and attendance management software from ZKTeco, China. A password reset vulnerability exists in ZKTeco BioTime, which can be exploited by an attacker to arbitrarily reset the administrator's password via a crafted web request...
CVE-2023-36118
Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the page parameter...