Search vulnerabilities

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,103

CVE-2023-3555

GZ Scripts PHP Vacation Rental Script preview.php cross site scripting

A vulnerability was found in GZ Scripts PHP Vacation Rental Script 1.8. It has been classified as problematic. This affects an unknown part of the file /preview.php. The manipulation of the argument page/layout/sort_by/property_id leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-233349 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Php Vacation Rental Script
CVE-2023-3554

GZ Scripts GZ Forum Script preview.php cross site scripting

A vulnerability was found in GZ Scripts GZ Forum Script 1.8 and classified as problematic. Affected by this issue is some unknown functionality of the file /preview.php. The manipulation of the argument catid/topicid/topic/topic_message/free_name leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233348. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Gz Forum Script
CVE-2023-3553

Exposure of Sensitive Information to an Unauthorized Actor in nilsteampassnet/teampass

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Teampass
Products
Teampass
CVE-2023-3552

Improper Encoding or Escaping of Output in nilsteampassnet/teampass

Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Teampass
Products
Teampass
CVE-2023-3551

Code Injection in nilsteampassnet/teampass

Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed
Vendors
Teampass
Products
Teampass
CVE-2023-3545

Chamilo LMS Htaccess File Upload Security Bypass

Improper sanitisation in `main/inc/lib/fileUpload.lib.php` in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of `.htaccess` file. This vulnerability may be exploited by privileged attackers or chained with unauthenticated arbitrary file write vulnerabilities, such as CVE-2023-3533, to achieve remote code execution.

CVSS 3.1 · 9.8 Critical EPSS 2.4% KEV · Not listed
Vendors
Chamilo
Products
Chamilo
CVE-2023-3544

GZ Scripts Time Slot Booking Calendar PHP load.php cross site scripting

A vulnerability was found in GZ Scripts Time Slot Booking Calendar PHP 1.8. It has been declared as problematic. This vulnerability affects unknown code of the file /load.php. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-233296. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Time Slot Booking Calendar Php
CVE-2023-3543

GZ Scripts Availability Booking Calendar PHP HTTP POST Request load.php cross site scripting

A vulnerability was found in GZ Scripts Availability Booking Calendar PHP 1.8. It has been classified as problematic. This affects an unknown part of the file load.php of the component HTTP POST Request Handler. The manipulation of the argument cid/first_name/second_name/address_1/country leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-233295. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gzscripts
Products
Availability Booking Calendar Php
CVE-2023-3542

ThinuTech ThinuCMS contact.php cross site scripting

A vulnerability was found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this issue is some unknown functionality of the file /contact.php. The manipulation of the argument name/body leads to cross site scripting. The attack may be launched remotely. VDB-233294 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Thinutech
Products
Thinu-cms
CVE-2023-3541

ThinuTech ThinuCMS author_posts.php cross site scripting

A vulnerability has been found in ThinuTech ThinuCMS 1.5 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /author_posts.php. The manipulation of the argument author with the input g6g12<script>alert(1)</script>o8sdm leads to cross site scripting. The attack can be launched remotely. The identifier VDB-233293 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Thinutech
Products
Thinu-cms
CVE-2023-3540

SimplePHPscripts NewsLetter Script PHP URL Parameter preview.php cross site scripting

A vulnerability, which was classified as problematic, was found in SimplePHPscripts NewsLetter Script PHP 2.4. Affected is an unknown function of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-233292.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Simplephpscripts
Products
Newsletter Script Php
CVE-2023-3539

SimplePHPscripts Simple Forum PHP URL Parameter preview.php cross site scripting

A vulnerability, which was classified as problematic, has been found in SimplePHPscripts Simple Forum PHP 2.7. This issue affects some unknown processing of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-233291.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Simplephpscripts
Products
Simple Forum Php
CVE-2023-3538

SimplePHPscripts Photo Gallery PHP URL Parameter preview.php cross site scripting

A vulnerability classified as problematic was found in SimplePHPscripts Photo Gallery PHP 2.0. This vulnerability affects unknown code of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-233290 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Simplephpscripts
Products
Photo Gallery Php
CVE-2023-3537

SimplePHPscripts News Script PHP Pro URL Parameter preview.php cross site scripting

A vulnerability classified as problematic has been found in SimplePHPscripts News Script PHP Pro 2.4. This affects an unknown part of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-233289 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Simplephpscripts
Products
News Script Php Pro
CVE-2023-3536

SimplePHPscripts Funeral Script PHP URL Parameter preview.php cross site scripting

A vulnerability was found in SimplePHPscripts Funeral Script PHP 3.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The identifier of this vulnerability is VDB-233288.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Simplephpscripts
Products
Funeral Script Php
CVE-2023-3534

SourceCodester Shopping Website check_availability.php sql injection

A vulnerability was found in SourceCodester Shopping Website 1.0. It has been classified as critical. Affected is an unknown function of the file check_availability.php. The manipulation of the argument email leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-233286 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sanchitkmr
Products
Shopping Website
CVE-2023-3533

Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write

Path traversal in file upload functionality in `/main/webservices/additional_webservices.php` in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Chamilo
Products
Chamilo
CVE-2023-3532

Cross-site Scripting (XSS) - Stored in outline/outline

Cross-site Scripting (XSS) - Stored in GitHub repository outline/outline prior to 0.70.1.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Getoutline
Products
Outline
CVE-2023-3531

Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass

Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.10.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Teampass
Products
Teampass