3944 matches found
Command Execution Vulnerability in Ocean CMS
Ocean CMS seacms, Ocean Video Management System is a video-on-demand system designed for webmasters with different needs. A command execution vulnerability exists in the background of Ocean CMS. Attackers can use this vulnerability to write malicious code to execute system commands and obtain...
SQL Injection Vulnerability in ZZCMS2020 Backend (CNVD-2020-59407)
ZZCMS is a content management system. A SQL injection vulnerability exists in the backend of ZZCMS2020, which can be exploited by attackers to obtain sensitive information from the database...
jcontainer.net Cross Site Scripting vulnerability OBB-1403124
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
File Deletion Vulnerability in ShuipFCMS Content Management System
ShuipFCMS a content management system based on ThinkPHP framework as the core, using an independent grouping approach to development. ShuipFCMS content management system file deletion vulnerability, an attacker can be exploited to delete the install.lock file can lead to the reinstallation of the...
The vulnerability of the Microsoft Dynamics 365 resource planning software lies in the lack of protective measures for the website structure, allowing attackers to execute cross-site scripting attacks.
The vulnerability of the Microsoft Dynamics 365 resource planning software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using specially crafted requests...
CVE-2020-22453
Untis WebUntis before 2020.9.6 allows XSS in multiple functions that store information...
IBM Data Risk Manager Cross-Site Request Forgery Vulnerability
IBM Data Risk Manager is a data risk manager that helps discover, analyze and visualize business risks associated with data. A cross-site request forgery vulnerability exists in IBM Data Risk Manager 2.0.6. An attacker could exploit this vulnerability to perform malicious and unauthorized actions...
Reflected File Download (RFD) Attack
spring-web is vulnerable to Reflected File Download RFD attack. An incomplete fix of CVE-2015-5211 allows an attacker to bypass the protection against RFD attack via the jsessionid path parameter...
Design/Logic Flaw
IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow a remote attacker to conduct phishing attacks, using a tabnabbing attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to redirect a user to a malicious Web site that would...
Gazie Cross-Site Scripting Vulnerability
Gazie is a financial application based on PHP and MySQL. The program supports features such as invoice management, inventory management and order management. A cross-site scripting vulnerability exists in Gazie version 7.29, which originates from an improper validation of client-side data by...
CVE-2020-21731
Gazie 7.29 is affected by: Cross Site Scripting XSS via http://192.168.100.7/gazie/modules/config/adminutente.php?username=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code...
Ecommerce CodeIgniter Bootstrap Cross-Site Scripting Vulnerability (CNVD-2020-51505)
Bootstrap is an open source web front-end framework developed using HTML, CSS and JavaScript.CodeIgniter is an open source web framework written using the PHP language . Ecommerce A cross-site scripting vulnerability exists in application/modules/vendor/views/addproduct.php in previous versions o...
CVE-2020-24194
A Cross-site scripting XSS vulnerability in 'user-profile.php' in SourceCodester Daily Tracker System v1.0 allows remote attackers to inject arbitrary web script or HTML via the 'fullname' parameter...
Adobe Experience Manager (AEM) Cross-Site Scripting Vulnerability (CNVD-2020-51768)
Adobe Experience Manager is an enterprise content management solution that helps you streamline the management and delivery of your content and assets. A stored cross-site scripting vulnerability exists in Adobe Experience Manager AEM. An attacker can exploit this vulnerability to execute arbitra...
Adobe Experience Manager (AEM) Cross-Site Scripting Vulnerability (CNVD-2020-51769)
Adobe Experience Manager is an enterprise content management solution that helps you simplify the management and delivery of your content and assets. A cross-site scripting vulnerability exists in Adobe Experience Manager AEM. An attacker can exploit this vulnerability to execute arbitrary...
openSIS SQL Injection Vulnerability (CNVD-2020-50531)
openSIS is a free, open source student information system/school management software. A SQL injection vulnerability exists in the fn parameter in CheckDuplicateStudent.php in openSIS 7.3. An attacker can exploit this vulnerability by sending an HTTP request to perform a SQL injection attack...
Malicious Package in cordova-plugin-china-picker
Version 1.0.910 of cordova-plugin-china-picker contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation If version 1.0.910 of this module is foun...
moziloCMS 2.0 Cross Site Scripting
Exploit Title: moziloCMS 2.0 - Persistent Cross-Site Scripting Authenticated Date: 2020-08-31 Exploit Author: Abdulkadir Kaya Vendor Homepage: https://www.mozilo.de/ Version: 2.0 Tested on: Windows & WampServer 1- Go to following url. http://HOST/PATH/admin/ 2- Login the admin panel. 3- Go to...
Exment Cross-Site Scripting Vulnerability
Exment is a Japanese free data management Web system with a simple structure, pre-existing business templates, and links to multiple types of data to minimize the trouble of searching. It supports windows, mac and linux systems. A cross-site scripting vulnerability exists in Exment v3.6.0 and pri...