SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through the adminroleactions method of the papertrailversion.rb file. An attacker can manipulate SQL queries to disclose sensitive information, read and write files, or execute commands. Remediation Upgrade...

GHSA-CXWF-QC32-375F Decidim-Awesome has SQL injection in AdminAccountability

Vulnerability type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' Vendor: Decidim International Community Environment Has vendor confirmed: Yes Attack type: Remote Impact: Code Execution Escalation of Privileges Information Disclosure Affected component:...

Decidim-Awesome has SQL injection in AdminAccountability

Vulnerability type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' Vendor: Decidim International Community Environment Has vendor confirmed: Yes Attack type: Remote Impact: Code Execution Escalation of Privileges Information Disclosure Affected component:...

CVE-2024-43415 Decidim-Awesome: SQL injection in AdminAccountability

An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidimawesome-module 0.9.0 allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands...

CVE-2024-43415 Decidim-Awesome: SQL injection in AdminAccountability

An improper neutralization of special elements used in an SQL command in the papertrail/version- model of the decidimawesome-module 0.9.0 allows an authenticated admin user to manipulate sql queries to disclose information, read and write files or execute commands...

PT-2024-30573 · Unknown · Decidim Awesome-Module

Name of the Vulnerable Software and Affected Versions: decidim awesome-module versions 0.9.0 through 0.11.1 Description: An improper neutralization of special elements used in an SQL command in the papertrail/version-model of the decidim awesome-module allows an authenticated admin user to...

Decidim-Awesome has SQL injection in AdminAccountability

Vulnerability type: CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' Vendor: Decidim International Community Environment Has vendor confirmed: Yes Attack type: Remote Impact: Code Execution Escalation of Privileges Information Disclosure Affected component:...

Cross Site Scripting(XSS)

Decidim is vulnerable to a Cross-site scripting XSS. The vulnerability is due to XSS through a malformed URL in the version control feature used in resources. which allows an attacker to exploit XSS...

Decidim has a cross-site scripting vulnerability in the version control page

Impact The version control feature used in resources is subject to potential cross-site scripting XSS attack through a malformed URL. Workarounds Not available References OWASP ASVS v4.0.3-5.1.3 Credits This issue was discovered in a security audit organized by Open Source Politics against Decidi...

CVE-2024-41673

Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8...

CVE-2024-41673 Decidim has a cross-site scripting vulnerability in the version control page

Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8...

CVE-2024-41673

CVE-2024-41673 affects the Decidim framework; a cross-site scripting (XSS) vulnerability exists in the version-control feature used for resources. The issue is observable across multiple Decidim components referenced in connected docs (e.g., decidim-debates, decidim-initiatives, decidim-proposals...

CVE-2024-41673 Decidim has a cross-site scripting vulnerability in the version control page

Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8...

CVE-2024-41673 Decidim has a cross-site scripting vulnerability in the version control page

Decidim is a participatory democracy framework. The version control feature used in resources is subject to potential XSS attack through a malformed URL. This vulnerability is fixed in 0.27.8...

PT-2024-29498 · Decidim · Decidim

Name of the Vulnerable Software and Affected Versions: Decidim versions prior to 0.27.8 Description: The version control feature in Decidim is subject to a potential cross-site scripting XSS attack through a malformed URL. This issue was discovered during a security audit organized by Open Source...

Decidim has a cross-site scripting vulnerability in the version control page

Impact The version control feature used in resources is subject to potential cross-site scripting XSS attack through a malformed URL. Workarounds Not available References OWASP ASVS v4.0.3-5.1.3 Credits This issue was discovered in a security audit organized by Open Source Politics against Decidi...

Decidim 跨站脚本漏洞

Decidim is an open source participatory democracy framework from Decidim, written in Ruby on Rails. A cross-site scripting vulnerability exists in Decidim versions 0.27.7 and earlier, which stems from the use of version control functionality that may be vulnerable to cross-site scripting XSS...

Cross Site Scripting(XSS)

Decidim is vulnerable to Cross-Site Scripting XSS attacks. The vulnerability is due to improper sanitization of admin activity logs, allowing XSS payloads to be injected when an admin assigns a valuator to a proposal or performs other actions that generate logs with malicious content...

Cross Site Scripting(XSS)

Decidim is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to improper validation and sanitization of HTML content in the QuillJS WYSIWYG editor, which allows attackers to inject malicious code, such as an XSS payload, before the content is uploaded to the server...

CVE-2024-39910

decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded to the server. The attacker is able to...