CVE Vulnerability Catalog

The PHPGurukul Online Fire Reporting System version 1.2 has a Cross Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload injected into the search field.

The Hostel Management System v2.1 has a Cross-Site Scripting (XSS) vulnerability that allows an attacker to execute arbitrary code via a crafted payload in the search booking field.

The PHPGurukul Online Security Guards Hiring System version 1.0 has a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload in the search booking box.

The Hostel Management System v2.1 has a Cross Site Scripting vulnerability that allows an attacker to execute arbitrary code via crafted input in the Guardian name, Guardian relation, complimentary address, city, permanent address, and city fields on the Book Hostel & Room Details page.

Improper handling of additional special elements in GitHub repository squidex/squidex prior to version 7.4.0.

A vulnerability has been identified in version 7.11.8 of HadSky in an unknown functionality of the User Handler component, leading to cross-site request forgery (CSRF). The attack can be launched remotely.

A critical vulnerability was found in DedeCMS version 5.7.109, affecting an unknown functionality of the file co_do.php. Manipulation of the argument rssurl leads to server-side request forgery.

Improper authorization exists in the GitHub repository pimcore/customer-data-framework prior to version 3.4.1.

An Open Redirect vulnerability exists in the GitHub repository alextselegidis/easyappointments prior to version 1.5.0.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository nilsteampassnet/teampass prior to version 3.0.10. An attacker can exploit this vulnerability to inject malicious scripts in the user's context.

The Float menu WordPress plugin before 5.0.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

The EventON WordPress plugin before version 2.1.2 does not validate that the event_id parameter in its eventon_ics_download ajax action is a valid Event. This allows unauthenticated visitors to access any Post (including unpublished or protected posts) content via the ics export functionality by providing the numeric id of the post.

The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

The MStore API WordPress plugin before version 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.

The URL Shortify WordPress plugin before 1.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

The Export All URLs plugin for WordPress before version 4.6 does not sanitize and escape a parameter before outputting it back on the page, leading to a Reflected Cross-Site Scripting vulnerability.

The WP Dummy Content Generator plugin by Deepak Anand versions <= 2.3.0 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of an authenticated user.

KodExplorer version 4.51 contains a Cross-Site Scripting (XSS) vulnerability in the Description box of the Light App creation feature. An attacker can exploit this vulnerability by injecting XSS syntax into the Description field.

Sourcecodester Online Pizza Ordering System v1.0 has a Cross-site scripting (XSS) vulnerability in '/admin/index.php?page=categories' Category item.

The Albert Peschar WebwinkelKeur plugin versions up to 3.24 contains a Cross-Site Request Forgery (CSRF) vulnerability. This may allow attackers to perform unauthorized actions on behalf of users.