CVE-2023-49078 Cross-Site Scripting vulnerability in raptor-web 0.4.4

raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In version 0.4.4 of raptor-web, it is possible to craft a malicious URL that will result in a reflected cross-site scripting vulnerability. A user controlled URL parameter is loaded int...

CVE-2023-49078 Cross-Site Scripting vulnerability in raptor-web 0.4.4

raptor-web is a CMS for game server communities that can be used to host information and keep track of players. In version 0.4.4 of raptor-web, it is possible to craft a malicious URL that will result in a reflected cross-site scripting vulnerability. A user controlled URL parameter is loaded int...

PT-2023-31046 · Unknown · Raptor-Web

Name of the Vulnerable Software and Affected Versions: raptor-web version 0.4.4 Description: The issue is a reflected cross-site scripting vulnerability in raptor-web, a CMS for game server communities. It allows an attacker to craft a malicious URL that, when clicked by a victim, can execute...

Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats.

Impact A Cross-Site Scripting XSS vulnerability was found in the HTML output of chats. XSS is intended to be mitigated by Jinja's escape function. However, autoescape=True was missing when setting the environment. Although the actual impact is low, considering the HTML file is being viewed offlin...

GHSA-X77J-W7WF-FJMW Nunjucks autoescape bypass leads to cross site scripting

Impact In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the...

Nunjucks autoescape bypass leads to cross site scripting

Impact In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the...

PT-2023-18187 · Nunjucks +1 · Nunjucks +1

Name of the Vulnerable Software and Affected Versions: Nunjucks versions prior to 3.2.4 Description: The issue allows bypassing the restrictions provided by the autoescape functionality in Nunjucks. If two user-controlled parameters are on the same line in the views, it is possible to inject...

GHSA-XFRW-HXR5-GHQF Cross-site Scripting in wagtail

Impact When the % includeblock % template tag is used to output the value of a plain-text StreamField block CharBlock, TextBlock or a similar user-defined block derived from FieldBlock, and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This...

Cross-site Scripting in wagtail

Impact When the % includeblock % template tag is used to output the value of a plain-text StreamField block CharBlock, TextBlock or a similar user-defined block derived from FieldBlock, and that block does not specify a template for rendering, the tag output is not properly escaped as HTML. This...

SImiik <=v1.6.2.1 xss + rce

1.XSS Examples: python3 -m simiki.cli new -t "Hello S...

CVE-2016-10547

Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting XSS vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as name=alert1, it is possible to...

CVE-2016-10547

Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting XSS vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as name=alert1, it is possible to...

Cross site scripting

Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting XSS vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as name=alert1, it is possible to...

CVE-2016-10547

CVE-2016-10547 affects the JavaScript templating engine Nunjucks. Versions ≤ 2.4.2 expose an XSS in autoescape mode: using an array for keys (e.g., name[]=) can bypass escaping and inject content into the DOM. The issue is tied to how template variables are escaped in autoescape mode (noted acros...

CVE-2016-10547

Nunjucks is a full featured templating engine for JavaScript. Versions 2.4.2 and lower have a cross site scripting XSS vulnerability in autoescape mode. In autoescape mode, all template vars should automatically be escaped. By using an array for the keys, such as name=alert1, it is possible to...