CVE Vulnerability Catalog

The thorsten/phpmyfaq GitHub repository prior to version 3.2.0-beta.2 is vulnerable to reflected Cross-site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts that will be executed in users' browsers.

A stored Cross-Site Scripting (XSS) vulnerability was found in firmware version 2.2.6733 of the Multilaser RE 170 router. It allows an attacker to inject a malicious script that will execute in other users' browsers.

The affected TBox RTUs are missing authorization for running some API commands. An attacker could exploit these commands to reveal sensitive information such as software versions and web server file contents.

Tuleap has an issue with managing user permissions after changing project visibility. Restricted users who were project administrators before the visibility switch retain access to the project and can perform administrative actions.

ILIAS versions 7.21 and 8.0_beta1 through 8.2 are vulnerable to reflected Cross-Site Scripting (XSS).

ILIAS versions 7.21 and 8.0_beta1 through 8.2 are vulnerable to stored Cross Site Scripting (XSS).

Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.

An issue was discovered in the Cargo extension for MediaWiki through version 1.39.3, allowing the storage of javascript: URLs in URL fields and automatically linking these URLs.

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the 'get edits' type is vulnerable to HTML injection through the User-Agent HTTP request header.

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3 related to XSS. This can occur in Special:CargoQuery via a crafted page item when using the default format.

An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3, where the googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent the use of javascript: URLs.

Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.

A critical vulnerability was found in SourceCodester Shopping Website 1.0, related to the forgot-password.php file. Manipulation of the contact argument leads to SQL injection, which can be exploited remotely.

A critical vulnerability was found in SourceCodester Shopping Website 1.0, affecting an unknown function in the index.php file. Manipulation of the username argument leads to SQL injection.

The Online Hotel Management System Project in PHP version 1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote code execution can be achieved by entering malicious code in the date selection box.

A ReDoS issue was discovered in the URI component before version 0.12.2 for Ruby. The URI parser mishandles invalid URLs with specific characters, leading to increased execution time when parsing strings to URI objects.

MCL-Net version 4.3.5.8788 has a Directory Browsing vulnerability that allows attackers to gain sensitive information about the configured databases via the '/file' endpoint.

The 'Submission Web Form' of the Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form where students submit their reports for similarity/plagiarism checks.

Annet AC Centralized Management Platform version 1.02.040 is vulnerable to Stored Cross-Site Scripting (XSS). An attacker can inject malicious code that will be stored and executed in users' browsers.

A Cross Site Scripting vulnerability in PHPgurukl User Registration Login and User Management System with admin panel v.1.0 allows a local attacker to execute arbitrary code via a crafted script to the signup.php.