675 matches found
CVE-2021-34228: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in parentcontrol.htm in TOTOLINK A3002R version V1.1.1-B20200824 Important Update, new UI allows attackers to execute arbitrary JavaScript by modifying the "Description" field and "Service Name" field...
PT-2021-20405
Name of the Vulnerable Software and Affected Versions: TOTOLINK A3002R version V1.1.1-B20200824 Description: Cross-site scripting in parent control.htm allows attackers to execute arbitrary JavaScript by modifying the Description field and Service Name field. Recommendations: For TOTOLINK A3002R...
TotoLink A3002RU 跨站脚本漏洞
A cross-site scripting vulnerability exists in TOTOLINK A3002RU, a wireless router product from Taiwan-based TOTOLINK, which stems from the lack of validation of client-side data for the product's ability to modify the Description and Service Name fields. An attacker could execute client-side cod...
CVE-2021-24444: Improper Neutralization of Input During Web Page Generation
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfilteredhtml capability is disallowed, leading to an authenticated Store...
pfSense 跨站脚本漏洞
pfSense is a set of network firewalls based on FreeBSD Linux. A cross-site scripting vulnerability exists in Netgate pfSense, which allows an attacker to inject malicious JavaScript code into a description text box or parameter...
PhpList 跨站脚本漏洞
phpList is an open source newsletter and email marketing software from phpList UK. A stored cross-site scripting vulnerability exists in phplist version 3.5.3. The vulnerability can be exploited to execute arbitrary web script or HTML via the "List Description" field under the "Edit List" module...
Plone Cross-Site Scripting Vulnerability (CNVD-2021-46652)
Plone is an open source content management system CMS built on the Zope application server. Plone suffers from a cross-site scripting vulnerability in versions 5.0 through 5.2.4 that stems from the fact that if a contributor creates a folder with a SCRIPT tag in the description field, the editor ...
CVE-2021-35959
In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field...
CVE-2021-35959
In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field...
Plone 跨站脚本漏洞
Plone is an open source content management system CMS built on the Zope application server. Plone suffers from a cross-site scripting vulnerability in versions 5.0 through 5.2.4 that stems from the fact that if a contributor creates a folder with a SCRIPT tag in the description field, the editor ...
CVE-2021-35959: Improper Neutralization of Input During Web Page Generation
In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field...
AKCP sensorProbe 跨站脚本漏洞
The AKCP sensorProbe is a platform-independent environmental and safety monitoring device from AKCP USA. Simply assign an IP address and connect to the embedded web server. A cross-site scripting vulnerability exists in versions prior to SP480-20210624 of the AKCP sensorProbe Embedded Web Server...
PT-2021-21080
Name of the Vulnerable Software and Affected Versions: Plone versions 5.0 through 5.2.4 Description: The issue affects Editors in the folder contents view, where a Contributor can create a folder with a SCRIPT tag in the description field, leading to XSS. Recommendations: For Plone versions 5.0...
PT-2021-10770 · Unknown · Limesurvey
Name of the Vulnerable Software and Affected Versions: LimeSurvey version 4.1.11+200316 Description: The issue is related to a Cross Site Scripting vulnerability. It affects the name and description parameters in the application/controllers/admin/PermissiontemplatesController.php file...
Typesetter cross-site scripting vulnerability (CNVD-2021-49146)
Typesetter is an open source CMS written in PHP with True WYSIWYG editing and flat file storage. Typesetter suffers from a cross-site scripting vulnerability. The vulnerability can be exploited to conduct cross-site scripting attacks via the className and Description fields in...
Typesetter 跨站脚本漏洞
Typesetter is an open source CMS written in PHP with True WYSIWYG editing and flat file storage. Typesetter suffers from a cross-site scripting vulnerability. The vulnerability can be exploited to conduct cross-site scripting attacks via the className and Description fields in...
CVE-2021-32244
Cross Site Scripting XSS in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field...
CVE-2021-32244
Cross Site Scripting XSS in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field...
