Hrsale Cross-Site Scripting Vulnerability

Hrsale is an HRMS written in PHP by the Hrsale team. A cross-site scripting vulnerability exists in HRSALE 2.0.0. The vulnerability can be exploited by an attacker to conduct a cross-site scripting attack via the admin/project/projectscalendar setdate parameter...

News Script PHP Pro SQL Injection Vulnerability

News Script PHP Pro is a PHP/MySQL based web script from Simple PHP Scripts for displaying news on your website. News Script PHP Pro 2.3 suffers from a SQL injection vulnerability. The vulnerability can be exploited to conduct SQL injection attacks via the id parameter in the editNews action...

VestaCP v0.9.8-26 - Session Validation Web Vulnerability

Document Title: =============== VestaCP v0.9.8-26 - Session Validation Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2238 Release Date: ============= 2020-11-25 Vulnerability Laboratory ID VL-ID: ====================================...

SQL injection vulnerability in yycms yy***_us***.php file

yycms is a movie and television system. The yycms yyus.php file suffers from a SQL injection vulnerability, which can be exploited by an attacker to obtain sensitive information from the database...

Puncsky Touchbase.ai cross-site scripting vulnerability (CNVD-2020-66598)

Puncsky Touchbase.ai is a web platform for interpersonal relationships by Puncsky Individual Developers. A cross-site scripting vulnerability exists in versions prior to touchbase.ai 2.0, which can be exploited by an attacker to send malicious JavaScript code that hijacks a user's cookie session...

KonaWiki 跨站脚本漏洞

KonaWiki3 is a very simple PHP Wiki engine.KonaWiki3 is vulnerable to cross-site scripting. An attacker can exploit this vulnerability to execute arbitrary scripts on a user's Web browser via specially crafted URLs...

SourceCodester Online Clothing Store Code Issue Vulnerability

SourceCodester Online Clothing Store is a website builder system from SourceCodester, Inc. that provides online clothing store functionality. A security vulnerability exists in SourceCodester Online Clothing Store version 1.0, which is caused by an arbitrary file upload in the image upload functi...

Code Projects Artworks Gallery Code Issues Vulnerabilities

Code Projects Artworks Gallery is an online artwork management website builder organized by Code Projects. A security vulnerability in ARTWORKS GALLERY, which exists within the Edit Configuration File feature in PHP, CSS, JAVASCRIPT, and MYSQL 1.0, can be exploited by remote attackers to upload...

Puncsky Touchbase.ai Cross-Site Scripting Vulnerability

Puncsky Touchbase.ai is a web platform for interpersonal relationships by Puncsky Individual Developers. A cross-site scripting vulnerability exists in versions prior to touchbase.ai 2.0, which can be exploited by an attacker to inject an HTML payload, resulting in damage, user redirection to a...

SugarCRM 6.5.18 Cross Site Scripting

Document Title: =============== SugarCRM v6.5.18 - Contacts Persistent Cross Site Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2249 Release Date: ============= 2020-11-16 Vulnerability Laboratory ID VL-ID:...

IBM Content Navigator Cross-Site Scripting Vulnerability (CNVD-2020-62468)

IBM Content Navigator is a Web client that provides users with a console that enables them to access, manage, and use corporate content anytime, anywhere, from any location in the organization on virtually any mobile device. A stored cross-site scripting vulnerability exists in IBM Content...

IBM Maximo Spatial Asset Management Web Local Storage Vulnerability

IBM Maximo Spatial Asset Management is used to visually manage the spatial relationships between assets and other mapped elements. A web page local storage vulnerability exists in IBM Maximo Spatial Asset Management 7.6.0.3, 7.6.0.4, 7.6.0.5, and 7.6.1.0. An attacker could exploit the vulnerabili...

USN-4620-1 phpldapadmin vulnerability

It was discovered that phpLDAPadmin didn't properly sanitize before being echoed to the user. A remote attacker could inject arbitrary HTML/Javascript code in a user's context and cause a crash, resulting in denial of service or potential execution of arbitrary code...

rutor.download Cross Site Scripting vulnerability OBB-1475598

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Command Execution Vulnerability in 162100 Website Navigation 3

162100 url navigation 3 is a website source code of url navigation category developed by php+MySQL. 162100 url navigation 3 has a command execution vulnerability. An attacker can exploit the vulnerability to write to a php file, resulting in command execution...

Microsoft SharePoint Server Cross-Site Scripting Vulnerability (CNVD-2020-61067)

Microsoft SharePoint is an enterprise business collaboration platform from Microsoft. The platform is used to consolidate business information and enable sharing of work, collaborating with others, organizing projects and workgroups, and searching for people and information. A cross-site scriptin...

SQL Injection Vulnerability in Five Fingers CMS

Five Fingers CMS is an open source content management system. Five Fingers CMS suffers from a SQL injection vulnerability. An attacker can exploit the vulnerability to obtain sensitive database information...

CVE-2020-26649

AtomXCMS 2.0 is affected by Incorrect Access Control via admin/dump.php...

CVE-2020-6367

There is a reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework, versions - 7.20, 7.30, 7.31, 7.40, 7.50. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end users browser has no way to know that t...

Cross-site Scripting (XSS)

Overview lightning-server is a lightning dataviz notebooks server. Affected versions of this package are vulnerable to Cross-site Scripting XSS. It is possible to inject malicious JavaScript code as part of a session controller. PoC POST...