CVE-2024-44684

TpMeCMS 1.3.3.2 is vulnerable to Cross Site Scripting XSS in /h.php/page?ref=addtabs via the "Title," "Images," and "Content" fields...

CVE-2024-35621

A cross-site scripting XSS vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field...

CVE-2024-35621

A cross-site scripting XSS vulnerability in the Edit function of Formwork before 1.13.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field...

Formwork 安全漏洞

Formwork is a flat file based content management system CMS from Formwork open source. It is used to build and manage simple websites. A security vulnerability exists in formwork versions prior to 1.13.0, which stems from a cross-site scripting XSS vulnerability in the Content field...

PT-2024-26571 · Formwork · Formwork

Name of the Vulnerable Software and Affected Versions: Formwork versions prior to 1.13.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field. Users with access to the administration panel wit...

CVE-2024-22636

PluXml Blog v5.8.9 was discovered to contain a remote code execution RCE vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field...

UBUNTU-CVE-2024-22636

PluXml Blog v5.8.9 was discovered to contain a remote code execution RCE vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field...

PluXml Security Vulnerability

PluXml is a free and open source content management system that does not require a database to work. A security vulnerability exists in PluXml Blog version v5.8.9, which stems from a remote code execution vulnerability contained in a static page that can be used to execute remote code by injectin...

CVE-2024-22636

PluXml Blog v5.8.9 was discovered to contain a remote code execution RCE vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field...

PT-2024-19512 · Unknown · Pluxml Blog

Name of the Vulnerable Software and Affected Versions: PluXml Blog version 5.8.9 Description: The issue is related to a remote code execution RCE vulnerability in the Static Pages feature of PluXml Blog. This vulnerability can be exploited by injecting a crafted payload into the Content field...

CVE-2024-22636

PluXml Blog v5.8.9 was discovered to contain a remote code execution RCE vulnerability in the Static Pages feature. This vulnerability is exploited via injecting a crafted payload into the Content field...

CVE-2023-42628

Stored cross-site scripting XSS vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 through 102, 7.1 fix pack 28 and earlier, 7.2 fix pack 20 and earlier, 7.3 update 33 and earlier, and 7.4 before update 88 allows remote attackers to inject...

PT-2023-28456 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.1.0 through 7.4.3.87 Liferay DXP versions 7.0 fix pack 83 through 102 Liferay DXP versions 7.1 fix pack 28 and earlier Liferay DXP versions 7.2 fix pack 20 and earlier Liferay DXP versions 7.3 update 33 and earlier...

CVE-2023-40177

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...

Privilege escalation

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...

CVE-2023-40177 XWiki Platform privilege escalation (PR) from account through AWM content fields

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...

CVE-2023-40177 XWiki Platform privilege escalation (PR) from account through AWM content fields

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...

CVE-2023-40177

CVE-2023-40177 affects XWiki Platform: a vulnerability where any registered user can use the user profile content field to execute arbitrary scripts with programming rights, effectively escalating privileges. Root cause: AppWithinMinutes.Content displayer executes content with the rights of the A...

GHSA-5MF8-V43W-MFXP XWiki Platform privilege escalation (PR) from account through AWM content fields

Impact Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. The problem is present since version 4.3M2 when AppWithinMinutes Application added support for the Content field,...

Server-Side Template Injection leads to Remote Code Execution

Description Admin or Staff with "Mass mailer" permission can perform a Server-Side Template Injection attack Proof of Concept Log in as an admin or a staff who has "Mass mailer" permission, edit a message In the "Email content" field, insert the following value and click "Update and preview" %...