SecPod

Learn Search

Search across all Learn content

← Back to Security Research

JAMWiki ‘num’ Parameter Cross Site Scripting Vulnerability

SecPod Research Team member (Sooraj K.S) has found Cross-Site Scripting Vulnerabilities in JAMWiki. The vulnerability is caused by improper validation of “num” parameter in “Special:AllPages” pages. This may allow an attacker to steal cookie-based authentication credentials or inject arbitrary HTML ...

Mar 29, 2012By Veerendra GG1 min read

SecPod Research Team member (Sooraj K.S) has found Cross-Site Scripting Vulnerabilities in JAMWiki. The vulnerability is caused by improper validation of “num” parameter in “Special:AllPages” pages. This may allow an attacker to steal cookie-based authentication credentials or inject arbitrary HTML code and launch further attacks.

More information can be found here.

Welcome any feedback or suggestion.

Cheers!
SecPod Research Team

Featured Posts

Open Microsoft’s November 2026 Patch Tuesday: 1,093 Vulnerabilities, 63 Critical Fixes, and an Outlook Threat
Microsoft’s November 2026 Patch Tuesday: 1,093 Vulnerabilities, 63 Critical Fixes, and an Outlook Threat

CVE Research

Microsoft’s November 2026 Patch Tuesday: 1,093 Vulnerabilities, 63 Critical Fixes, and an Outlook Threat

Microsoft’s November 2026 Patch Tuesday addresses 1,093 security vulnerabilities, including 63 Critical flaws and an actively exploited Outlook zero-day. The updates tackle serious remote code execution, privilege escalation, and information disclosure vulnerabilities across Windows, Exchange Server, SharePoint, Azure, and other Microsoft products. Explore the most critical flaws, affected products, and essential remediation steps to secure your systems.

Nov 11, 2026

Open Beyond GitLab's Critical RCE: What CVE-2026-97229 Reveals About Exploitation, Patch Gaps, and Security Response
vulnerability researchBeyond GitLab's Critical RCE: What CVE-2026-97229 Reveals About Exploitation, Patch Gaps, and Security Response

CVE Research

Beyond GitLab's Critical RCE: What CVE-2026-97229 Reveals About Exploitation, Patch Gaps, and Security Response

Nov 6, 2026

Open Gorbag Targets Ukrainian Organizations with BeautyStealer and WinRAR Exploitation
malware researchGorbag Targets Ukrainian Organizations with BeautyStealer and WinRAR Exploitation

CVE Research

Gorbag Targets Ukrainian Organizations with BeautyStealer and WinRAR Exploitation

Gorbag uses spearphishing and weaponized WinRAR archives to deploy BeautyStealer against Ukrainian organizations. The malware steals browser credentials, VPN configuration files, and targeted documents before exfiltrating the data and deleting itself.

Nov 5, 2026

Open Synology NAS Under Siege: C3RB3R Ransomware Strikes Unpatched Devices
vulnerability researchSynology NAS Under Siege: C3RB3R Ransomware Strikes Unpatched Devices

CVE Research

Synology NAS Under Siege: C3RB3R Ransomware Strikes Unpatched Devices

Synology has warned customers about an ongoing wave of ransomware attacks targeting network-attached storage (NAS) devices running outdated versions of DiskStation Manager (DSM). The attacks have been associated with C3RB3R ransomware, a threat capable of encrypting stored files and demanding payment for their recovery.

Nov 4, 2026