Fastspot BigTree 跨站脚本漏洞

Fastspot BigTree is an open source content management system CMS based on PHP and MySQL from Fastspot Inc. in the United States. BigTree-CMS 4.4.3 suffers from a cross-site scripting vulnerability that stems from a lack of proper validation of client-side data by the WEB application. An attacker...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features.Discourse suffers from a cross-site scripting vulnerability that can be exploited by attackers to conduct XSS attacks...

Six Apart Movable Type 跨站脚本漏洞

Six Apart Movable Type is an application of Six Apart, Inc. A cross-site scripting vulnerability exists in Six Apart Movable Type, which stems from the lack of proper validation of client-side data in the WEB application. An attacker could use this vulnerability to inject arbitrary script or HTML...

F5 BIG-IP 跨站脚本漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An XSS vulnerability exists in the F5 BIG-IP TMUI, which can be exploited by attackers to run JavaScript in the context of th...

firefly-iii 跨站请求伪造漏洞

firefly-iii is a free and open source personal finance manager. firefly-iii suffers from a cross-site request forgery vulnerability, which can be exploited by attackers to conduct cross-site request forgery attacks...

firefly-iii 跨站请求伪造漏洞

firefly-iii is a free and open source personal finance manager. firefly-iii is vulnerable to cross-site request forgery, and no detailed vulnerability details are currently available...

Cross-Site Request Forgery (CSRF) in firefly-iii/firefly-iii

✍️ Description Attacker able to delete Total available budget with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In...

Hospital Management System 跨站脚本漏洞

PHPGurukul Hospital Management System is a PHP and MySQL based hospital management system. PHPGurukul Hospital Management System is vulnerable to cross-site scripting, which can be exploited by attackers to execute js code via prescribe.php...

Tastylgniter 跨站脚本漏洞

TastyIgniter is a free open source restaurant online ordering system based on Laravel PHP Framework. A cross-site scripting vulnerability exists in Tastylgniter 3.0.7, which originates from the lack of validation of user-submitted data in the /account, /reservation, /admin/dashboard, and...

CVE-2020-18457

Cross Site Request Forgery CSRF vulnerability exists in bycms v1.3.0 that can add an admin account via admin.php/ucenter/add.html...

Cross-site Scripting (XSS)

Overview datatables.net is a DataTables for jQuery Affected versions of this package are vulnerable to Cross-site Scripting XSS. If an array is passed to the HTML escape entities function it would not have its contents escaped. PoC DataTables.net Name Name let test = "name" : "Hello World! " ,...

express-cart 跨站请求伪造漏洞

express-cart is a shopping cart module used in Node.js. A cross-site request forgery vulnerability exists in express-cart in Node.js, which stems from a WEB application that does not adequately validate that a request is coming from a trusted user. An attacker could use this vulnerability to send...

CKEditor 跨站脚本漏洞

CKEditor is an open source, web-based text editor. A cross-site scripting vulnerability in the CKEditor 4 Clipboard package allows users to abuse the paste function with malformed HTML, which could result in injecting arbitrary HTML into the editor...

Maccms 代码问题漏洞

Maccms is a PHP-based film and television content management system CMS. Maccms 10 is vulnerable to arbitrary file uploads, which can be exploited by attackers to bypass suffix whitelist validation and execute arbitrary code by adding a character after the file name of the uploaded file...

CVE-2020-21930

A stored cross site scripting XSS vulnerability in the webattr2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML...

Magento Commerce 跨站脚本漏洞

Magento Commerce is to provide a first-class shopping experience without the need for developer support. Magento Commerce suffers from a cross-site scripting vulnerability that exists due to insufficient cleaning of user-supplied data. A remote attacker can exploit this vulnerability to inject an...

Sonatype Nexus Repository Manager 跨站脚本漏洞

Sonatype Nexus Repository Manager NXRM is a repository manager from Sonatype, Inc. that is used to manage, store, and distribute software, among other things. Sonatype Nexus Repository Manager suffers from a cross-site scripting vulnerability that stems from the ability to run JavaScript code in...

CVE-2021-36622

Sourcecodester Online Covid Vaccination Scheduler System 1.0 is affected vulnerable to Arbitrary File Upload. The admin panel has an upload function of profile photo accessible at http://localhost/scheduler/admin/?page=user. An attacker could upload a malicious file such as shell.php with the...

Fortinet FortiOS 跨站脚本漏洞

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with a variety of security features such as firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam. A cross-site scripting...

CVE-2020-20699

A cross site scripting XSS vulnerability in S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Copyright text box under Basic Settings...