Security
Headlines
HeadlinesLatestCVEs

Tag

#php

CVE-2022-44952: Stored Cross Site Scripting Vulnerability on "Application Settings" in rukovoditel 3.2.1 · Issue #9 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking "Add".

CVE
Open in Source
#xss#vulnerability#web#php#auth
CVE-2022-44953: Stored Cross Site Scripting Vulnerability Bypass filter on "Files" feature in webtareas 2.4p5 · Issue #8 · anhdq201/webtareas

webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".

CVE-2022-44954: Stored Cross Site Scripting Vulnerability Bypass filter on "Contacts" feature in webtareas 2.4p5 · Issue #10 · anhdq201/webtareas

webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcontacts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name field after clicking "Add".

CVE-2022-44961: Stored Cross Site Scripting Vulnerability Bypass filter on "Forums" feature in webtareas 2.4p5 · Issue #7 · anhdq201/webtareas

webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

CVE-2022-44950

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

CVE-2022-44962

webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject field.

CVE-2022-44948: Stored Cross Site Scripting Vulnerability on "Entities groups" in rukovoditel 3.2.1 · Issue #8 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".

CVE-2022-44947: Stored Cross Site Scripting Vulnerability on "Highlight row" in rukovoditel 3.2.1 · Issue #13 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note field after clicking "Add".

CVE-2022-44944: Stored Cross Site Scripting Vulnerability on "Help system" in "Add announcement" function in rukovoditel 3.2.1 · Issue #14 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.

CVE-2022-44946: Stored Cross Site Scripting Vulnerability on "Help system" in "Add page" function in rukovoditel 3.2.1 · Issue #15 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.