CVE Vulnerability Catalog

A vulnerability was found in GZ Scripts PHP GZ Appointment Scheduling Script version 1.8 that allows cross-site scripting (XSS) attacks by manipulating the arguments first_name, second_name, phone, address_1, and country in the /load.php file.

A vulnerability has been identified in GZ Scripts Event Booking Calendar version 1.8 that allows cross-site scripting (XSS) attacks through manipulation of the first_name, second_name, phone, address_1, and country arguments in the /load.php file.

A vulnerability was found in GZ Scripts Property Listing Script version 1.0, rated as problematic. The issue affects some unknown processing of the file /preview.php, where manipulation of the argument page/layout/sort_by leads to cross-site scripting.

A vulnerability was found in GZ Scripts Car Listing Script PHP version 1.8, affecting unknown code in the /preview.php file. Manipulation of the page/sort_by argument leads to cross-site scripting.

A vulnerability was found in GZ Scripts PHP Vacation Rental Script version 1.8, classified as problematic. Manipulation of the argument page/layout/sort_by/property_id leads to cross-site scripting.

A vulnerability was found in GZ Forum Script 1.8 that allows cross-site scripting (XSS) attacks through manipulation of arguments in the /preview.php file.

The MStore API WordPress plugin before 3.9.7 does not secure most of its AJAX actions by implementing privilege checks, nonce checks, or a combination of both.

A vulnerability in Apache Camel allows unauthorized exposure of sensitive information. It affects versions from 3.X to 3.14.8, 3.18.X to 3.18.7, 3.20.X to 3.20.5, and 4.X to 4.0.0-M3.

In the Winter content management system, prior to version 1.2.3, users with the `backend.manage_branding` permission could upload SVG files as application logos without sanitization, potentially leading to XSS attacks. Version 1.2.3 introduces fixes that provide full support for SVG uploads and automatic sanitization of these files.

A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP version 1.8, allowing cross-site scripting (XSS) attacks through manipulation of the arguments first_name, second_name, phone, address_1, and country in the /load.php file.

A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8, classified as problematic. It affects an unknown part of the file load.php of the HTTP POST Request Handler, leading to cross-site scripting attacks.

The Tekton Pipelines project does not validate child UIDs in version 0.35.0 and later, allowing users with access to create TaskRuns to create their own Tasks that the Pipelines controller accepts as child Tasks.

A vulnerability was found in ThinuTech ThinuCMS version 1.5 that allows cross site scripting (XSS) attacks through manipulation of arguments in the /contact.php file.

A vulnerability has been found in ThinuTech ThinuCMS version 1.5 that allows cross-site scripting (XSS) attacks through manipulation of the 'author' argument in the /author_posts.php file. Injecting malicious scripts can lead to unauthorized code execution in users' browsers.

A vulnerability CVE-2023-3540 was found in SimplePHPscripts NewsLetter Script PHP 2.4, affecting an unknown function in the /preview.php file, which is susceptible to cross site scripting. An attacker can remotely manipulate data, leading to the execution of malicious code.

A vulnerability has been found in SimplePHPscripts Simple Forum PHP version 2.7 that leads to cross site scripting (XSS) attacks through manipulation of the /preview.php file. The issue affects some unknown processing in the URL Parameter Handler component.

A vulnerability was found in SimplePHPscripts Photo Gallery PHP 2.0 that allows cross site scripting (XSS) attacks through manipulation of code in the /preview.php file. The attack can be initiated remotely.

A vulnerability CVE-2023-3537 has been found in SimplePHPscripts News Script PHP Pro 2.4 affecting the /preview.php file related to URL Parameter Handler. Manipulation of this file leads to cross site scripting (XSS) attacks.

A vulnerability was found in SimplePHPscripts Funeral Script PHP 3.1, rated as problematic. It affects some unknown functionality of the file /preview.php of the URL Parameter Handler component, leading to cross site scripting attacks.

A vulnerability was found in SimplePHPscripts FAQ Script PHP 2.3, affecting an unknown functionality of the file /preview.php in the URL Parameter Handler component. The manipulation leads to cross site scripting.