Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescaped…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the category axis label,…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute.…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes.…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from public/uploads,…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user may become a victim of a phishing attack.
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argument Hsn_Code results in cross site scripting. It is…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_item of the file modules/ui_extra_networks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID.
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href,…
Opis źródłowy NVD · ENCVSS 5,1 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
CVSS
5,1
EPSS
0,18 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescaped…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the category axis label,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to host arbitrary HTML by triggering a failed Pocket HTML, Pocket CSV or Shaarli import. Attackers can upload an HTML file with script but no anchor elements, leaving it at the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes feature_price_name and impact_value POST values unescaped after validation fails. Attackers can lure an authenticated back-office user into submitting a crafted…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The file…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Content-Type parameters. Attackers can upload an SVG typed 'image/svg+xml; x' via /api/v1/media so GET /uploads/{uuid} serves it…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes.…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from public/uploads,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PUT /admin/api/news/update, which checks NEWS_DELETE instead of NEWS_EDIT. Attackers holding addnews and delnews can read the…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
"Handmade Marketplace App - Creema" provided by CREEMA LTD. contains an open redirect vulnerability. When accessing a specially crafted URL, a website set up by the attacker may be displayed within the app's screen of a user. As a result, the user may become a victim of a phishing attack.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,21 % · rekomendacja wg zapisanej polityki
A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argument Hsn_Code results in cross site scripting. It is…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
A security flaw has been discovered in philz1337x clarity-upscaler up to cfbdb842c6c839c8e97741722b8cf9a4b7662d98. This impacts the function create_html_for_item of the file modules/ui_extra_networks.py of the component Extra Networks Card Rendering. The manipulation of the argument Description…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,2 % · rekomendacja wg zapisanej polityki
"ゲオアプリ" provided by GEO CORPORATION is vulnerable to improper authorization in handler for a custom URL scheme. An attacker may be able to cause the application's in-app browser to access an arbitrary website, potentially leading to phishing attacks or disclosure of a service's session ID.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,19 % · rekomendacja wg zapisanej polityki
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass sanitization using XML DTD custom entities. Attackers can upload an SVG defining an entity that expands to javascript in an anchor href,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 5,1 · EPSS 0,18 % · rekomendacja wg zapisanej polityki
5,1
0,18 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.