Security
Headlines
HeadlinesLatestCVEs

Tag

#xss

CVE-2022-39024: 一等一科技 U-Office Force - Reflected XSS -1

U-Office Force Bulletin function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript and perform XSS (Reflected Cross-Site Scripting) attack.

CVE
Open in Source
#xss#vulnerability#java#auth
CVE-2022-3402: Vulnerability Advisories Continued - Wordfence

The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers who can trick a site's administrator into performing an action like clicking on a link, or an authenticated user with access to a page that sends a request using user-supplied data via the server, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2022-3708: Vulnerability Advisories Continued - Wordfence

The Web Stories plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including 1.24.0 due to insufficient validation of URLs supplied via the 'url' parameter found via the /v1/hotlink/proxy REST API Endpoint. This made it possible for authenticated users to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

CVE-2021-36864: WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability - Patchstack

Auth. (editor+) Reflected Cross-Site Scripting (XSS) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 on WordPress.

CVE-2022-43170: Stored Cross Site Scripting Vulnerability on "Dashboard Configuration" in rukovoditel 3.2.1 · Issue #6 · anhdq201/rukovoditel

A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add info block".

CVE-2022-43169: Stored Cross Site Scripting Vulnerability on "Users Access Groups" in rukovoditel 3.2.1 · Issue #3 · anhdq201/rukovoditel

A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Group".

CVE-2022-43165: Stored Cross Site Scripting Vulnerability on "Global Variables" in rukovoditel 3.2.1 · Issue #5 · anhdq201/rukovoditel

A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Value parameter after clicking "Create".

CVE-2022-43166: Stored Cross Site Scripting Vulnerability on "Entities List" in rukovoditel 3.2.1 · Issue #2 · anhdq201/rukovoditel

A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Entity".

CVE-2022-43167: Stored Cross Site Scripting Vulnerability on "Users Alerts" in rukovoditel 3.2.1 · Issue #7 · anhdq201/rukovoditel

A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add".

CVE-2022-43164: Stored Cross Site Scripting Vulnerability on "Global Lists" in rukovoditel 3.2.1 · Issue #4 · anhdq201/rukovoditel

A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add".