4033 matches found
Online Leave Management System 跨站脚本漏洞
Sourcecodester Online Leave Management System is an online leave management system. A security vulnerability exists in Online Leave Management System v1.0, which originates from a stored cross-site scripting XSS vulnerability in the component /leavesystem/admin/?page=maintenance/department. The...
Fortinet FortiOS 跨站脚本漏洞
Fortinet FortiOS is a security operating system from Fortinet, a US-based company dedicated to the FortiGate network security platform. A cross-site scripting vulnerability exists in Fortinet FortiOS, which stems from improper input neutralization during web page generation and could be exploited...
CVE-2022-45769
CVE-2022-45769 is a cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 that allows attackers to execute arbitrary web scripts or HTML via a crafted URL parameter. Documents identify the affected component as ClicShopping_V3, version 3.402, with the underlying issue enabling user-i...
PT-2022-26581 · Sourcecodester · Sourcecodester Human Resource Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Management System version 1.0 Description: A problematic issue has been discovered, affecting an unknown function of the file /hrm/employeeview.php. The manipulation of the search argument leads to cross-site...
CVE-2022-44946
CVE-2022-44946 – Rukovoditel v3.2.1 suffers a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. An attacker can inject arbitrary HTML/JS via the Title field, potentially affecting administrators and project data when the...
Sanitization Management System SQL注入漏洞
Sanitization Management System is a sanitization management system by Carlo Montero Personal Developer. A security vulnerability exists in Sanitization Management System v1.0, which originates from an SQL injection via /php-sms/admin/?page=services/manageservice&id=...
CVE-2022-3897
The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
CVE-2022-45225
Book Store Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in /bsmsci/index.php/book. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the booktitle parameter...
CVE-2022-41958
super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit 4d0d5966 and will be...
CVE-2022-41958
CVE-2022-41958 affects the web vulnerability scanning tool super-xray . Versions prior to 0.7 stored configuration (YAML) that could be attacked by an attacker with local access to the file, enabling a compromise of the program. The issue is addressed in commit 4d0d5966 and will be included in fu...
CVE-2022-41958 Deserialization Vulnerability by yaml config input in super-xray
super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit 4d0d5966 and will be...
CVE-2022-41958 Deserialization Vulnerability by yaml config input in super-xray
super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit 4d0d5966 and will be...
WBCE CMS 跨站脚本漏洞
WBCE CMS is an open source content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in WBCE CMS 1.5.4 and previous versions, which stems from the lack of effective filtering and escaping of user-supplied data in the Footer field of the Search Settings...
MTN Group: Reflected - XSS
The Reflected XSS vulnerability was discovered on the website www.mtn.bj. The vulnerability was triggered by entering a malicious payload in the Messages section, which resulted in the execution of the payload on the client-side...
PT-2022-7410 · Unknown +1 · Glpi Reports Plugin +1
Name of the Vulnerable Software and Affected Versions: GLPI reports plugin affected versions not specified Description: The issue is related to the incorrect neutralization of input data during web page generation, allowing a remote attacker to conduct Cross-Site-Scripting XSS attacks via a...
GLPI 跨站脚本漏洞
GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...
Six Apart Movable Type 跨站脚本漏洞
Six Apart Movable Type is an application from Six Apart USA. It provides features such as multiple users, comments, references TrackBack, and themes. A security vulnerability exists in Six Apart Movable Type, which can be exploited by an attacker to execute arbitrary scripts on a web browser, and...
HMS-PHP 安全漏洞
HMS-PHP is a CSE309 IUB final web application project by the individual developer Pingkon Augustine Rozario. A security vulnerability exists in Pingkon HMS-PHP, which stems from an unknown function in the file /admin/admin.php being affected, where manipulation of the parameter uname/pass can lea...
Online Diagnostic Lab Management System SQL注入漏洞
Online Diagnostic Lab Management System is an online diagnostic lab management system. A security vulnerability exists in Online Diagnostic Lab Management System v1.0, which stems from the id parameter of its /odlms/classes/Users.php?f=delete component that allows an attacker to implement SQL...