BookStack vulnerable to cross-site scripting

Overview BookStack contains a cross-site scripting vulnerability CWE-79. Kenichi Okuno of Mitsui Bussan Secure Directions, Inc reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary script may be...

JVN#41035278: BookStack vulnerable to cross-site scripting

BookStack contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the user's web browser. Solution Update the Software Update the software to the latest version according to the information provided by the developer. The developer states as follows; Aft...

CVE-2020-12718

In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle...

PHP-Fusion cross-site scripting vulnerability (CNVD-2021-31477)

PHP-Fusion is a Malaysian company PHP-Fusion open source lightweight content management system based on MySql and PHP . The system contains modules such as news, articles and forums. A cross-site scripting vulnerability exists in the Preview Comment function of the administration/comments.php fil...

CVE-2020-12718

In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle...

CVE-2020-12718

In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle...

CVE-2020-11055

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the...

CVE-2020-11055

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the...

Cross site scripting

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the...

CVE-2020-11055 Cross-site Scripting in BookStack

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the...

CVE-2020-11055

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the...

CVE-2020-11055

BookStack versions >= 0.18.0 and

CVE-2020-12718: Improper Neutralization of Input During Web Page Generation

In administration/comments.php in PHP-Fusion 9.03.50, an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle...

PT-2020-12516

Name of the Vulnerable Software and Affected Versions BookStack versions 0.18.0 through 0.29.1 Description The issue allows a user with permission to create comments to inject custom JavaScript code, which could be executed on other users' machines. This is particularly impactful in scenarios whe...

CVE-2020-11055: Improper Neutralization of Input During Web Page Generation

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the...

PT-2020-13226

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50 Description The issue concerns a stored XSS vulnerability in the Preview Comment feature of the administration/comments.php file. An authenticated attacker can exploit this by bypassing the protection mechanism using...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...

CVE-2020-8775

Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting XSS vulnerability in the comment tags...