CVE-2022-43712

POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. If an unauthorized user is able to bypass other security filters they are able to post unauthorized data to the server because of CVE-2022-22965...

CVE-2021-39421

A cross-site scripting XSS vulnerability in SeedDMS v6.0.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-3849

A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this...

Bug Finder SASS BILLER 跨站脚本漏洞

Bug Finder SASS BILLER is a SASS-based invoicing and billing platform from Bug Finder, Inc. A cross-site scripting vulnerability exists in Bug Finder SASS BILLER version 1.0, which stems from the presence of certain unknown processing in the file /company/store, leading to cross-site scripting vi...

Perch v3.2 - Remote Code Execution (RCE)

Exploit Title: Perch v3.2 - Remote Code Execution RCE Application: Perch Cms Version: v3.2 Bugs: RCE Technology: PHP Vendor URL: https://grabaperch.com/ Software Link: https://grabaperch.com/download Date of found: 21.07.2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC...

Cisco Small Business SPA500 Series IP Phones 跨站脚本漏洞

Cisco Small Business SPA500 Series IP Phones is an SPA500 series IP phone from Cisco USA. A cross-site scripting vulnerability exists in the Cisco Small Business SPA500 Series IP Phones, which can be exploited by an attacker to execute arbitrary script code in the context of an affected interface...

CVE-2023-3757

A vulnerability classified as problematic has been found in GZ Scripts Car Rental Script 1.8. Affected is an unknown function of the file /EventBookingCalendar/load.php?controller=GzFront/action=checkout/cid=1/layout=calendar/showheader=T/local=3. The manipulation of the argument...

PT-2023-26009 · Unknown · Creativeitem Mastery Lms

Name of the Vulnerable Software and Affected Versions: Creativeitem Mastery LMS version 1.2 Description: A problematic vulnerability has been found in Creativeitem Mastery LMS. This issue affects an unknown part of the file /browse. The manipulation of the argument search/featured/recommended/ski...

Vulnerabilities fixed in Citrix ADC and Citrix Gateway

Citrix has fixed vulnerabilities in NetScaler ADC and NetScaler Gateway. A malicious party could exploit the vulnerabilities to execute a cross-site scripting attack, obtain elevated privileges or execute arbitrary code. Citrix reports that the vulnerability with attribute CVE-2023-3519 is being...

CVE-2022-47172

Cross-Site Request Forgery CSRF vulnerability in HasThemes ShopLentor plugin = 2.6.2 versions...

CVE-2023-3186

The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype...

Exploit for OS Command Injection in Hikvision Ds-A71024_Firmware

CVE-2022-28171-POC I originally published this on ExploitDB,...

Cross site scripting

A cross-site scripting XSS vulnerability in Teacher Subject Allocation System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search text box...

DEBIAN-CVE-2023-29454

Stored or persistent cross-site scripting XSS is a type of XSS where the attacker first sends the payload to the web application, then the application saves the payload e.g., in a database or server-side text files, and finally, the application unintentionally executes the payload for every victi...

CVE-2023-29457

Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts...

CVE-2023-37189

A stored cross site scripting XSS vulnerability in index.php?menu=billingrates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Name or Prefix fields under the Create New Rate module...

promopitstop.ca Cross Site Scripting vulnerability OBB-3500757

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-42080

An attacker is able to launch a Reflected XSS attack using a crafted URL. POC: Visit the following URL https://:8153/qstorapi/echo?inputMessage=...

CVE-2023-33664

ai-dev aicombinationsonfly before v0.3.1 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php...

The vulnerability of the J-Web interface of Juniper Networks Junos OS allows a attacker to load arbitrary files into temporary directories on the device.

The vulnerability of the J-Web interface in Juniper Networks Junos OS systems is related to improper authentication. Exploiting this vulnerability allows a malicious actor, who lacks valid authentication, to upload arbitrary files to temporary directories on the device...