stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2023-31677 (severity: HIGH, weakness: NVD-CWE-Other)
Insecure permissions in luowice 3.5.18 allow attackers to view information for other alarm devices via modification of the eseeid parameter.
CVE-2023-31678 (severity: MEDIUM, weakness: NVD-CWE-Other)
Incorrect access control in Videogo v6.8.1 allows attackers to bind shared devices after the connection has been ended.
CVE-2023-31679 (severity: HIGH, weakness: NVD-CWE-Other)
Incorrect access control in Videogo v6.8.1 allows attackers to access images from other devices via modification of the Device Id parameter.
CVE-2023-3168 (severity: MEDIUM, weakness: NVD-CWE-Other)
The WP Reroute Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2023-31689 (severity: CRITICAL, weakness: CWE-434)
In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. It can write arbitrary strings into custom file names and upload any files, and write malicious code to execute scripts to trigger command execution.
CVE-2023-3169 (severity: MEDIUM, weakness: NVD-CWE-Other)
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not have authorisation in a REST route and does not validate as well as escape some parameters when outputting them back, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.
CVE-2023-31698 (severity: MEDIUM, weakness: CWE-79)
Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).
CVE-2023-31699 (severity: MEDIUM, weakness: CWE-79)
ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.
CVE-2023-3170 (severity: MEDIUM, weakness: CWE-79)
The tagDiv Composer WordPress plugin before 4.2, used as a companion by the Newspaper and Newsmag themes from tagDiv, does not validate and escape some settings, which could allow users with Admin privileges to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2023-31700 (severity: HIGH, weakness: CWE-77)
TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceAdd.
CVE-2023-31701 (severity: HIGH, weakness: CWE-77)
TP-Link TL-WPA4530 KIT V2 (EU)_170406 and V2 (EU)_161115 is vulnerable to Command Injection via _httpRpmPlcDeviceRemove.
CVE-2023-31702 (severity: HIGH, weakness: CWE-89)
SQL injection in the View User Profile in MicroWorld eScan Management Console 14.0.1400.2281 allows remote attacker to dump entire database and gain windows XP command shell to perform code execution on database server via GetUserCurrentPwd?UsrId=1.
CVE-2023-31703 (severity: CRITICAL, weakness: CWE-79)
Cross Site Scripting (XSS) in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter.
CVE-2023-31704 (severity: CRITICAL, weakness: CWE-863)
Sourcecodester Online Computer and Laptop Store 1.0 is vulnerable to Incorrect Access Control, which allows remote attackers to elevate privileges to the administrator's role.
CVE-2023-31705 (severity: MEDIUM, weakness: CWE-79)
A Reflected Cross-site scripting (XSS) vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malicious javascript into the page parameter.
CVE-2023-31707 (severity: CRITICAL, weakness: CWE-89)
SEMCMS 1.5 is vulnerable to SQL Injection via Ant_Rponse.php.
CVE-2023-31708 (severity: MEDIUM, weakness: CWE-352)
A Cross-Site Request Forgery (CSRF) in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a crafted HTML file to the Upload software format function.
CVE-2023-3171 (severity: HIGH, weakness: CWE-789)
A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.
CVE-2023-31710 (severity: CRITICAL, weakness: CWE-787)
TP-Link Archer AX21(US)_V3_1.1.4 Build 20230219 and AX21(US)_V3.6_1.1.4 Build 20230219 are vulnerable to Buffer Overflow.
CVE-2023-31714 (severity: CRITICAL, weakness: CWE-89)
Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.
CVE-2023-31716 (severity: HIGH, weakness: CWE-98)
FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log
CVE-2023-31717 (severity: HIGH, weakness: CWE-89)
A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.
CVE-2023-31718 (severity: HIGH, weakness: CWE-98)
FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.
CVE-2023-31719 (severity: CRITICAL, weakness: CWE-89)
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.
CVE-2023-3172 (severity: MEDIUM, weakness: CWE-22)
Path Traversal in GitHub repository froxlor/froxlor prior to 2.0.20.
CVE-2023-31722 (severity: HIGH, weakness: CWE-787)
There exists a heap buffer overflow in nasm 2.16.02rc1 (GitHub commit: b952891).
CVE-2023-31723 (severity: MEDIUM, weakness: NVD-CWE-Other)
yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function expand_mmac_params at /nasm/nasm-pp.c.
CVE-2023-31724 (severity: HIGH, weakness: NVD-CWE-Other)
yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function do_directive at /nasm/nasm-pp.c.
CVE-2023-31725 (severity: MEDIUM, weakness: CWE-416)
yasm 1.3.0.55.g101bc was discovered to contain a heap-use-after-free via the function expand_mmac_params at yasm/modules/preprocs/nasm/nasm-pp.c.
CVE-2023-31726 (severity: HIGH, weakness: CWE-863)
AList 3.15.1 is vulnerable to Incorrect Access Control, which can be exploited by attackers to obtain sensitive information.
CVE-2023-31728 (severity: HIGH, weakness: NVD-CWE-Other)
Teltonika RUT240 devices with firmware before 07.04.2, when bridge mode is used, sometimes make SSH and HTTP services available on the IPv6 WAN interface even though the UI shows that they are only available on the LAN interface.
CVE-2023-31729 (severity: CRITICAL, weakness: CWE-77)
TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command Injection via /cgi-bin/cstecgi.cgi.
CVE-2023-3173 (severity: CRITICAL, weakness: CWE-307)
Improper Restriction of Excessive Authentication Attempts in GitHub repository froxlor/froxlor prior to 2.0.20.
CVE-2023-31740 (severity: HIGH, weakness: CWE-77)
There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters WL_atten_bb, WL_atten_radio, and WL_atten_ctl in the apply.cgi interface, thereby gaining shell privileges.
CVE-2023-31741 (severity: HIGH, weakness: CWE-77)
There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ssid, wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.
CVE-2023-31742 (severity: HIGH, weakness: CWE-77)
There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.
CVE-2023-31746 (severity: CRITICAL, weakness: CWE-77)
There is a command injection vulnerability in the adslr VW2100 router with firmware version M1DV1.0. An unauthenticated attacker can exploit the vulnerability to execute system commands as the root user.
CVE-2023-31747 (severity: HIGH, weakness: CWE-428)
Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerability allows attackers to launch processes with elevated privileges.
CVE-2023-31748 (severity: HIGH, weakness: CWE-732)
Insecure permissions in MobileTrans v4.0.11 allows attackers to escalate privileges to local admin via replacing the executable file.
CVE-2023-3175 (severity: MEDIUM, weakness: NVD-CWE-Other)
The AI ChatBot WordPress plugin before 4.6.1 does not adequately escape some settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2023-31752 (severity: CRITICAL, weakness: CWE-89)
SourceCodester Employee and Visitor Gate Pass Logging System v1.0 is vulnerable to SQL Injection via /employee_gatepass/classes/Login.php.
CVE-2023-31753 (severity: CRITICAL, weakness: CWE-89)
SQL injection vulnerability in diskusi.php in eNdonesia 8.7, allows an attacker to execute arbitrary SQL commands via the "rid=" parameter.
CVE-2023-31754 (severity: MEDIUM, weakness: CWE-79)
Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Admin panel.
CVE-2023-31756 (severity: MEDIUM, weakness: CWE-78)
A command injection vulnerability exists in the administrative web portal in TP-Link Archer VR1600V devices running firmware Versions <= 0.1.0. 0.9.1 v5006.0 Build 220518 Rel.32480n which allows remote attackers, authenticated to the administrative web portal as an administrator user to open an operating system level shell via the 'X_TP_IfName' parameter.
CVE-2023-31757 (severity: MEDIUM, weakness: CWE-79)
DedeCMS up to v5.7.108 is vulnerable to XSS in sys_info.php via parameters 'edit___cfg_powerby' and 'edit___cfg_beian'
CVE-2023-31759 (severity: HIGH, weakness: CWE-294)
Weak Security in the 433MHz keyfob of Kerui W18 Alarm System v1.0 allows attackers to gain full access via a code replay attack.
CVE-2023-3176 (severity: HIGH, weakness: CWE-89)
A vulnerability, which was classified as critical, was found in SourceCodester Lost and Found Information System 1.0. Affected is an unknown function of the file admin\user\manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-231150 is the identifier assigned to this vulnerability.
CVE-2023-31761 (severity: HIGH, weakness: CWE-294)
Weak security in the transmitter of Blitzwolf BW-IS22 Smart Home Security Alarm v1.0 allows attackers to gain full access to the system via a code replay attack.
CVE-2023-31762 (severity: HIGH, weakness: CWE-294)
Weak security in the transmitter of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to gain full access to the system via a code replay attack.
CVE-2023-31763 (severity: HIGH, weakness: CWE-294)
Weak security in the transmitter of AGShome Smart Alarm v1.0 allows attackers to gain full access to the system via a code replay attack.
CVE-2023-3177 (severity: HIGH, weakness: CWE-89)
A vulnerability has been found in SourceCodester Lost and Found Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin\inquiries\view_inquiry.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231151.
CVE-2023-31779 (severity: MEDIUM, weakness: CWE-79)
Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript code in in "Reaction to comment" feature.
CVE-2023-3178 (severity: MEDIUM, weakness: CWE-352)
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack.
CVE-2023-3179 (severity: HIGH, weakness: CWE-352)
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).
CVE-2023-31794 (severity: MEDIUM, weakness: CWE-674)
MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
CVE-2023-31799 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter.
CVE-2023-3180 (severity: MEDIUM, weakness: CWE-122)
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.
CVE-2023-31800 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter.
CVE-2023-31801 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter.
CVE-2023-31802 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters.
CVE-2023-31803 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters.
CVE-2023-31804 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the course category parameters.
CVE-2023-31805 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function.
CVE-2023-31806 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function.
CVE-2023-31807 (severity: MEDIUM, weakness: CWE-79)
Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function.
CVE-2023-31808 (severity: HIGH, weakness: CWE-798)
Technicolor TG670 10.5.N.9 devices contain multiple accounts with hard-coded passwords. One account has administrative privileges, allowing for unrestricted access over the WAN interface if Remote Administration is enabled.
CVE-2023-3181 (severity: HIGH, weakness: CWE-379)
The C:\Program Files (x86)\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Temp~nsu.tmp and copies itself to it as Au_.exe. The C:\Windows\Temp~nsu.tmp\Au_.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI repair using Splashtop Streamer’s Windows Installer. Since the C:\Windows\Temp~nsu.tmp folder inherits permissions from C:\Windows\Temp and Au_.exe is susceptible to DLL hijacking, standard users can write a malicious DLL to it and elevate their privileges.
CVE-2023-31814 (severity: CRITICAL, weakness: CWE-706)
D-Link DIR-300 firmware <=REVA1.06 and <=REVB2.06 is vulnerable to File inclusion via /model/__lang_msg.php.
CVE-2023-31816 (severity: MEDIUM, weakness: CWE-79)
IT Sourcecode Content Management System Project In PHP and MySQL With Source Code 1.0.0 is vulnerable to Cross Site Scripting (XSS) via /ecodesource/search_list.php.
CVE-2023-31818 (severity: HIGH, weakness: CWE-668)
An issue found in Marukyu Line v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.
CVE-2023-31819 (severity: HIGH, weakness: CWE-311)
An issue found in KEISEI STORE Co, Ltd. LIVRE KEISEI v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.
CVE-2023-3182 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Membership WordPress plugin before 3.2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2023-31820 (severity: HIGH, weakness: CWE-311)
An issue found in Shizutetsu Store v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp function.
CVE-2023-31821 (severity: HIGH, weakness: CWE-312)
An issue found in ALBIS Co. ALBIS v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp ALBIS function.
CVE-2023-31822 (severity: HIGH, weakness: CWE-311)
An issue found in Entetsu Store v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Entetsu Store function.
CVE-2023-31823 (severity: HIGH, weakness: CWE-319)
An issue found in Marui Co Marui Official app v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Marui Official Store function.
CVE-2023-31824 (severity: HIGH, weakness: CWE-522)
An issue found in DERICIA Co. Ltd, DELICIA v.13.6.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp DELICIA function.
CVE-2023-31825 (severity: HIGH, weakness: CWE-311)
An issue found in Inageya v.13.4.1 allows a remote attacker to gain access to sensitive information via the channel access token in the miniapp Inageya function.
CVE-2023-31826 (severity: HIGH, weakness: CWE-862)
Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data.
CVE-2023-3183 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in SourceCodester Performance Indicator System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/addproduct.php. The manipulation of the argument prodname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-231163.
CVE-2023-3184 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in SourceCodester Sales Tracker Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /classes/Users.php?f=save. The manipulation of the argument firstname/middlename/lastname/username leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-231164.
CVE-2023-31842 (severity: HIGH, weakness: CWE-89)
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/index.php?page=edit_faculty&id=.
CVE-2023-31843 (severity: HIGH, weakness: CWE-89)
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/view_faculty.php?id=.
CVE-2023-31844 (severity: HIGH, weakness: CWE-89)
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_subject.php?id=.
CVE-2023-31845 (severity: HIGH, weakness: CWE-89)
Sourcecodester Faculty Evaluation System v1.0 is vulnerable to SQL Injection via /eval/admin/manage_class.php?id=.
CVE-2023-31847 (severity: MEDIUM, weakness: NVD-CWE-Other)
In davinci 0.3.0-rc after logging in, the user can connect to the mysql malicious server by controlling the data source to read arbitrary files on the client side.
CVE-2023-31848 (severity: HIGH, weakness: CWE-918)
davinci 0.3.0-rc is vulnerable to Server-side request forgery (SSRF).
CVE-2023-31851 (severity: MEDIUM, weakness: CWE-79)
Cudy LT400 1.13.4 is has a cross-site scripting (XSS) vulnerability in /cgi-bin/luci/admin/network/wireless/status via the iface parameter.
CVE-2023-31852 (severity: MEDIUM, weakness: CWE-79)
Cudy LT400 1.13.4 is vulnerable to Cross Site Scripting (XSS) in cgi-bin/luci/admin/network/wireless/config via the iface parameter.
CVE-2023-31853 (severity: MEDIUM, weakness: CWE-79)
Cudy LT400 1.13.4 is vulnerable Cross Site Scripting (XSS) in /cgi-bin/luci/admin/network/bandwidth via the icon parameter.
CVE-2023-31854 (severity: None, weakness: NVD-CWE-Other)
std::bad_alloc is mishandled in Precomp 0.4.8. NOTE: this is disputed because it should be categorized as a usability problem.
CVE-2023-31856 (severity: CRITICAL, weakness: CWE-77)
A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute arbitrary commands via a crafted http packet.
CVE-2023-31857 (severity: CRITICAL, weakness: CWE-434)
Sourcecodester Online Computer and Laptop Store 1.0 allows unrestricted file upload and can lead to remote code execution. The vulnerability path is /classes/Users.php?f=save.
CVE-2023-3186 (severity: CRITICAL, weakness: NVD-CWE-Other)
The Popup by Supsystic WordPress plugin before 1.10.19 has a prototype pollution vulnerability that could allow an attacker to inject arbitrary properties into Object.prototype.
CVE-2023-31860 (severity: MEDIUM, weakness: CWE-79)
Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.
CVE-2023-31861 (severity: HIGH, weakness: CWE-22)
ZLMediaKit 4.0 is vulnerable to Directory Traversal.
CVE-2023-31862 (severity: MEDIUM, weakness: CWE-79)
jizhicms v2.4.6 is vulnerable to Cross Site Scripting (XSS). The content of the article published in the front end is only filtered in the front end, without being filtered in the background, which allows attackers to publish an article containing malicious JavaScript scripts by modifying the request package.
CVE-2023-31867 (severity: HIGH, weakness: CWE-1236)
Sage X3 version 12.14.0.50-0 is vulnerable to CSV Injection.
CVE-2023-31868 (severity: MEDIUM, weakness: CWE-79)
Sage X3 version 12.14.0.50-0 is vulnerable to Cross Site Scripting (XSS). Some parts of the Web application are dynamically built using user's inputs. Yet, those inputs are not verified nor filtered by the application, so they mathed the expected format. Therefore, when HTML/JavaScript code is injected into those fields, this code will be saved by the application and executed by the web browser of the user viewing the web page. Several injection points have been identified on the application. The major one requires the user to be authenticated with a common account, he can then target an Administrator. All others endpoints need the malicious user to be authenticated as an Administrator. Therefore, the impact is diminished.