114 matches found
PT-2023-28456 · Liferay · Liferay Dxp +1
Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.1.0 through 7.4.3.87 Liferay DXP versions 7.0 fix pack 83 through 102 Liferay DXP versions 7.1 fix pack 28 and earlier Liferay DXP versions 7.2 fix pack 20 and earlier Liferay DXP versions 7.3 update 33 and earlier...
CVE-2023-40177
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...
Privilege escalation
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...
CVE-2023-40177
CVE-2023-40177 affects XWiki Platform: a vulnerability where any registered user can use the user profile content field to execute arbitrary scripts with programming rights, effectively escalating privileges. Root cause: AppWithinMinutes.Content displayer executes content with the rights of the A...
CVE-2023-40177 XWiki Platform privilege escalation (PR) from account through AWM content fields
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...
CVE-2023-40177 XWiki Platform privilege escalation (PR) from account through AWM content fields
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...
GHSA-5MF8-V43W-MFXP XWiki Platform privilege escalation (PR) from account through AWM content fields
Impact Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. The problem is present since version 4.3M2 when AppWithinMinutes Application added support for the Content field,...
Server-Side Template Injection leads to Remote Code Execution
Description Admin or Staff with "Mass mailer" permission can perform a Server-Side Template Injection attack Proof of Concept Log in as an admin or a staff who has "Mass mailer" permission, edit a message In the "Email content" field, insert the following value and click "Update and preview" %...
[SECURITY] Fedora 36 Update: drupal7-link-1.11-1.fc36
The link module can be count to the top 50 modules in Drupal installations and provides a standard custom content field for links. With this module links can be added easily to any content types and profiles and include advanced validating and different ways of storing internal or external links...
[SECURITY] Fedora 37 Update: drupal7-link-1.11-1.fc37
The link module can be count to the top 50 modules in Drupal installations and provides a standard custom content field for links. With this module links can be added easily to any content types and profiles and include advanced validating and different ways of storing internal or external links...
CVE-2022-40472
ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module...
ZKTeco ZKBio Time 安全漏洞
A cross-site scripting vulnerability exists in ZKTeco ZKBio Time version 8.0.7, which originates from the "Content" text field of the "Add New Message" module. Content" text field of the "Add New Message" module lacks effective filtering and escaping of user-supplied data, which can be exploited ...
Shimo Document 跨站脚本漏洞
Wuhan Chuxin Technology Shimo Document is an online document editing and processing tool from Wuhan Chuxin Technology, China. A security vulnerability exists in Shimo Document version v2.0.1, which can be exploited by an attacker to execute arbitrary web script or HTML via a specially crafted loa...
HTMLy Cross-Site Scripting Vulnerability (CNVD-2021-94954)
htmly is a simple and fast database-free PHP blogging platform and flat file CMS. htmly version 2.8.1 has a vulnerability in the "content" field of the "regular post" page in the "add content" menu of the dashboard. field of the "add content" menu in the dashboard is vulnerable to a stored...
CVE-2021-36702
The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting XSS vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through...
CVE-2020-23219
Monstra CMS 3.0.4 allows attackers to execute arbitrary code via a crafted payload entered into the "Snippet content" field under the "Edit Snippet" module...
Monstra CMS 代码注入漏洞
Monstra is a lightweight content management system CMS. A remote code execution vulnerability exists in Monstra version 3.0.4. The vulnerability can be exploited to execute arbitrary code via the "Snippet content" field under the "Edit Snippet" module...
CVE-2020-19618
Cross Site Scripting XSS vulnerability in mblog 3.5 via the post content field to /post/editing...