CVE-2022-36778

insert HTML / js code inside input how to get to the vulnerable input : Workers worker nickname inject in this input the code...

CVE-2022-23765

This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request...

The vulnerability of the Passwork password manager, which stems from the lack of protective measures for website structures, allows attackers to carry out XSS attacks.

The vulnerability of Passwork’s password managers exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

Eyes of Network Web 注入漏洞

Eyes of Network Web is a global regulatory solution for hardware status of devices, operating systems, standard applications, business applications, and performance from the Eyes of Network Web community. A security vulnerability exists in Eyes of Network Web version 5.3 that originates in the ur...

SEMCMS SQL注入漏洞

SEMCMS is a foreign trade web content management system CMS that supports multiple languages. SEMCMS suffers from a SQL injection vulnerability that stems from an unknown part of the file AntCheck.php being affected, where manipulation of the parameter DID can lead to sql injection and attacks ca...

CVE-2022-2500

A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side...

PT-2022-18099 · Sourcecodester · Sourcecodester Interview Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Interview Management System version 1.0 Description: A problematic issue was found in the system, affecting the processing of the file /addQuestion.php. The manipulation of the question argument with the input alert1 leads to...

PT-2022-22611 · Unknown · Complete Online Job Search System

Name of the Vulnerable Software and Affected Versions: Complete Online Job Search System version 1.0 Description: A cross-site scripting XSS issue was found in the Complete Online Job Search System. The vulnerability can be exploited via the U NAME parameter at the...

CVE-2022-28731

A carefully crafted request on UserPreferences.jsp could trigger an CSRF vulnerability on Apache JSPWiki before 2.11.3, which could allow the attacker to modify the email associated with the attacked account, and then a reset password request from the login page...

CVE-2022-40623

The WAVLINK Quantum D4G WN531G3 running firmware version M31G3.V5030.200325 does not utilize anti-CSRF tokens, which, when combined with other issues such as CVE-2022-35518, can lead to remote, unauthenticated command execution...

Mealie 跨站脚本漏洞

Mealie is a self-hosted recipe manager and meal planner by an individual developer in Hayden, USA. A cross-site scripting vulnerability exists in Mealie version 1.0.0beta3. An attacker can exploit this vulnerability to execute arbitrary web script or HTML via a specially crafted payload injected...

CVE-2022-34140

CVE-2022-34140 describes a stored Cross‑Site Scripting (XSS) vulnerability in Feehi CMS v2.1.1, exploitable via the username field during signup at /index.php?r=site%2Fsignup. Multiple connected sources (Exploit DB and PacketStorm) provide PoCs showing XSS payloads that trigger on sign‑up or logi...

CVE-2022-34550

Sims v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the component /addNotifyServlet. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the notifyInfo parameter...

CVE-2022-34549

Sims v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /uploadServlet. This vulnerability allows attackers to escalate privileges and execute arbitrary commands via a crafted file...

FeehiCMS 代码问题漏洞

FeehiCMS is a Php-based CMS builder from Liufee Personal Developers.FeehiCMS version v2.1.1 is vulnerable to arbitrary file uploads. The vulnerability stems from the lack of valid validation of uploaded files by the application. An attacker can exploit the vulnerability to execute arbitrary code ...

comwave.net Cross Site Scripting vulnerability OBB-2815714

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WAVLINK WN535K2 和 WN535K3 操作系统命令注入漏洞

The WAVLINK WN535K2 and WAVLINK WN535K3 are both wireless routers from the Chinese company WAVLINK. A security vulnerability exists in the WAVLINK WN535K2 and WN535K3 versions, which stems from certain unknown processing in /cgi-bin/touchlistsync.cgi, where manipulation of IP parameters may resul...

Library Management System SQL注入漏洞

Library Management System is a library management system with QR code attendance and automatic library card generation by King Albaracin Personal Developer. A security vulnerability exists in Library Management System version 1.0, which stems from an issue that affects certain unknown processing ...

Cybozu Office 跨站脚本漏洞

Cybozu Office is a web-based, cross-platform collaborative office solution from Cybozu. Cybozu Office suffers from a cross-site scripting vulnerability that can be exploited by a remote attacker to trick a victim into following a specially crafted link and executing arbitrary HTML and script code...

Oracle JD Edwards Products 输入验证错误漏洞

Oracle JD Edwards Products is a fully integrated suite of Enterprise Resource Planning ERP applications from Oracle. The products provide financial management, project management and asset lifecycle management application modules. An input validation error vulnerability exists in JD Edwards...