Enferas

A cross-site scripting (XSS) issue allows attackers to execute arbitrary code via the `code`, `title`, `from date`, and `to date` inputs in the file Main.php. This can lead to the execution of malicious scripts.

The issue is related to a cross site scripting (XSS) vulnerability in the file main.php. This vulnerability can be exploited via the `name` and `email` parameters to the `user add` function.

The issue allows attackers to execute arbitrary code via the `code`, `name`, and `description` inputs in the file Main.php. This is a Cross Site Scripting (XSS) vulnerability.

The issue is related to a Cross Site Scripting (XSS) vulnerability. It can be exploited via a crafted POST request to the "graphs new.php" endpoint. This vulnerability may allow a remote attacker to perform inter-site script attacks.

Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos allow attackers to execute arbitrary code. The affected parameters include: `pesquisa`, `data`, `data2`, `nome`, `descricao`, `idDocumentos`, `id`, `senha`, `nomeCliente`, `contato`, `documento`, `telefone`, `celular`, `email`, `rua`, `numero`, `complemento`, `bairro`, `cidade`, `estado`, `cep`, `idClientes`, `id`, `tipo`, `forma pagamento`, `gateway de pagamento`, `excluir id`, `confirma id`, `cancela id`, `vencimento de`, `vencimento ate`, `cliente`, `tipo`, `status`, `valor desconto`, `desconto`, `periodo`, `per page`, `urlAtual`, `vencimento`, `recebimento`, `valor`, `recebido`, `formaPgto`, `desconto parc`, `entrada`, `qtdparcelas parc`, `valor parc`, `dia pgto`, `dia base pgto`, `comissao`, `descricao parc`, `cliente parc`, `observacoes parc`, `formaPgto parc`, `tipo parc`, `pagamento`, `pago`, `valor desconto editar`, `descricao`, `fornecedor`, `observacoes`, `id`, `refGarantia`, `textoGarantia`, `idGarantias`, `email`, and `senha` in various files such as application/controllers/Arquivos.php, application/controllers/Clientes.php, application/controllers/Cobrancas.php, application/controllers/Financeiro.php, application/controllers/Garantias.php, and application/controllers/Login.php.

Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos allow attackers to execute arbitrary code. The issue affects various parameters, including `nome`, `aCliente`, `eCliente`, `dCliente`, `vCliente`, `aProduto`, `eProduto`, `dProduto`, `vProduto`, `aServico`, `eServico`, `dServico`, `vServico`, `aOs`, `eOs`, `dOs`, `vOs`, `aVenda`, `eVenda`, `dVenda`, `vVenda`, `aGarantia`, `eGarantia`, `dGarantia`, `vGarantia`, `aArquivo`, `eArquivo`, `dArquivo`, `vArquivo`, `aPagamento`, `ePagamento`, `dPagamento`, `vPagamento`, `aLancamento`, `eLancamento`, `dLancamento`, `vLancamento`, `cUsuario`, `cEmitente`, `cPermissao`, `cBackup`, `cAuditoria`, `cEmail`, `cSistema`, `rCliente`, `rProduto`, `rServico`, `rOs`, `rVenda`, `rFinanceiro`, `aCobranca`, `eCobranca`, `dCobranca`, `vCobranca`, `situacao`, `idPermissao`, `id`, `precoCompra`, `precoVenda`, `descricao`, `unidade`, `estoque`, `estoqueMinimo`, `idProdutos`, `id`, and `estoqueAtual` in files `application/controllers/Permissoes.php` and `application/controllers/Produtos.php`.

Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos allow attackers to execute arbitrary code. The affected parameters include: `dataInicial`, `dataFinal`, `tipocliente`, `format`, `precoInicial`, `precoFinal`, `estoqueInicial`, `estoqueFinal`, `de id`, `ate id`, `clientes id`, `origem`, `cliente`, `responsavel`, `status`, `tipo`, `situacao` in file application/controllers/Relatorios.php, `preco`, `nome`, `descricao`, `idServicos`, `id` in file application/controllers/Servicos.php, `senha`, `permissoes id`, `idUsuarios`, `situacao`, `nome`, `rg`, `cpf`, `cep`, `rua`, `numero`, `bairro`, `cidade`, `estado`, `email`, `telefone`, `celular` in file application/controllers/Usuarios.php, `dataVenda`, `observacoes`, `observacoes cliente`, `clientes id`, `usuarios id`, `idVendas`, `id`, `idVendasProduto`, `preco`, `quantidade`, `idProduto`, `produto`, `desconto`, `tipoDesconto`, `resultado`, `vendas id`, `vencimento`, `recebimento`, `valor`, `recebido`, `formaPgto`, `tipo` in file application/controllers/Vendas.php, `situacao`, `periodo`, `vencimento de`, `vencimento ate`, `tipo`, `status`, `cliente` in file application/views/financeiro/lancamentos.php, `year` in file application/views/mapos/painel.php, `pesquisa` in file application/views/os/os.php, `etiquetaCode` in file application/views/relatorios/imprimir/imprimirEtiquetas.php.

Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos allow attackers to execute arbitrary code. The affected parameters include: `year`, `oldSenha`, `novaSenha`, `termo`, `nome`, `cnpj`, `ie`, `cep`, `logradouro`, `numero`, `bairro`, `cidade`, `uf`, `telefone`, `email`, `id`, `app name`, `per page`, `app theme`, `os notification`, `email automatico`, `control estoque`, `notifica whats`, `control baixa`, `control editos`, `control edit vendas`, `control datatable`, `pix key`, `os status list`, `control 2vias`, `status`, `start`, `end` in file application/controllers/Mapos.php, as well as `token`, `senha`, `email`, `nomeCliente`, `documento`, `telefone`, `celular`, `rua`, `numero`, `complemento`, `bairro`, `cidade`, `estado`, `cep`, `idClientes`, `descricaoProduto`, `defeito` in file application/controllers/Mine.php, and `pesquisa`, `status`, `data`, `data2`, `dataInicial`, `dataFinal`, `termoGarantia`, `garantias id`, `clientes id`, `usuarios id`, `idOs`, `garantia`, `descricaoProduto`, `defeito`, `observacoes`, `laudoTecnico`, `id`, `preco`, `quantidade`, `idProduto`, `idOsProduto`, `produto`, `idServico`, `idOsServico`, `desconto`, `tipoDesconto`, `resultado`, `vencimento`, `recebimento`, `os id`, `valor`, `recebido`, `formaPgto`, `tipo`, `anotacao`, `idAnotacao` in file application/controllers/Os.php.

The issue is a Cross Site Scripting (XSS) vulnerability. It occurs via the `filter product` input to the file `modal product lookups.php`. This allows for potential malicious script execution.

The issue allows attackers to execute arbitrary code via the `product name` and `product price` inputs in the file print.php, specifically through a cross-site scripting (XSS) vulnerability.

The issue is related to a Cross Site Scripting (XSS) vulnerability, which allows attackers to execute arbitrary code or cause other unspecified impacts. This is achieved via the input `bgcol` in the file Weeks.php.

A cross-site scripting (XSS) issue was found in the /bsms ci/index.php/book endpoint, allowing attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the `writer` parameter.

The issue is related to a Cross Site Scripting (XSS) vulnerability. It affects the InventorySystem via the `edit store name` and `edit active` inputs in the file InventorySystem.php.

A XSS vulnerability was found in the `phoromatic r add test details.php` file. This issue allows for cross-site scripting attacks. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue is related to a header injection vulnerability. It affects the component "/admin/subnets/ripe-query.php".

The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a file name, due to a cross-site scripting (XSS) vulnerability in the browser.php component.

The issue allows attackers to execute a directory traversal.

A command injection issue was discovered in the /htdocs/utils/Files.php component. This issue is exploited via a crafted payload injected into the file name of an uploaded file.

The issue is a cross-site scripting (XSS) vulnerability. It was discovered in the component print-customoid.php.

A cross-site scripting (XSS) issue was found in LibreNMS via the component oxidized-cfg-check.inc.php. This allows for potential malicious script execution.