166 matches found
CVE-2024-7398
CVE-2024-7398 describes a stored XSS vulnerability in Concrete CMS (versions 9 up to 9.3.3 and older than 8.5.19) in the calendar event addition feature, where the event name is not sanitized on output. This permits users with permission to create or modify event calendars to embed or execute scr...
CVE-2024-7398 Concrete CMS Stored XSS Vulnerability in Calendar Event Addition Feature
Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with...
CVE-2024-7398 Concrete CMS Stored XSS Vulnerability in Calendar Event Addition Feature
Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with...
CVE-2024-7398 Concrete CMS Stored XSS Vulnerability in Calendar Event Addition Feature
Concrete CMS versions 9 through 9.3.3 and versions below 8.5.19 are vulnerable to stored XSS in the calendar event addition feature because the calendar event name was not sanitized on output. Users or groups with permission to create event calendars can embed scripts, and users or groups with...
CVE-2024-27730
Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature...
CVE-2024-27729
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature...
CVE-2024-27730
Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature...
CVE-2024-27729
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature...
CVE-2024-27729
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature...
CVE-2024-27730
CVE-2024-27730 – Normal mode Affected product: Friendica v2023.12. Vulnerability: Insecure Permissions allowing a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature. Impact: High (per CVSS 3.1 metrics: CVSS:3.1/AV:N/AC:L/...
CVE-2024-27729
Cross Site Scripting vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature...
CVE-2024-27730
Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature...
CVE-2024-27729
CVE-2024-27729 describes a Cross Site Scripting vulnerability in the Friendica 2023.12 calendar event feature, where an attacker can obtain sensitive information via the calendar event’s location parameter. The affected software is Friendica (version 2023.12) and the underlying issue is a reflect...
CVE-2024-27730
Insecure Permissions vulnerability in Friendica v.2023.12 allows a remote attacker to obtain sensitive information and execute arbitrary code via the cid parameter of the calendar event feature...
CVE-2024-39031
In Silverpeas Core = 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when...
Moodle Cross-Site Scripting Vulnerability (CNVD-2025-11216)
Moodle is a free, open-source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in Moodle that stems from insufficient escaping of calendar event titles, no details of the...
Cross-site Scripting (XSS)
moodle/moodle is vulnerable to Cross-site Scripting XSS. The vulnerability is due to insufficient escaping of calendar event titles, leading to a stored XSS risk in the event deletion prompt...
GHSA-P5CG-6RFR-6MX8 Moodle stored XSS via calendar's event title when deleting the event
Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt...
