580 matches found
CVE-2021-43611
Belledonne Belle-sip before 5.0.20 can crash applications such as Linphone via " \ " in the display name of a From header...
CVE-2021-37463
In NCH Quorum v2.03 and earlier, XSS exists via User Display Name stored...
CVE-2020-24666
The Analysis Report in Hitachi Vantara Pentaho through 7.x - 8.x contains a stored Cross-site scripting vulnerability, which allows an authenticated remote users to execute arbitrary JavaScript code. Specifically, the vulnerability lies in the 'Display Name' parameter. Remediated in = 9.1.0.1...
CVE-2020-2194
Jenkins ECharts API Plugin 4.7.0-3 and earlier does not escape the display name of the builds in the trend chart, resulting in a stored cross-site scripting vulnerability...
CVE-2012-1000
Multiple cross-site scripting XSS vulnerabilities in LEPTON 1.1.3 and other versions before 1.1.4 allow remote attackers to inject arbitrary web script or HTML via the 1 message parameter to admins/login/forgot/index.php, or the 2 displayname or 3 email parameter to account/preferences.php...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the renderFormField function in templatefunc.go. If an application is using RenderForm, an attacker can execute scripts by supplying malicious input in fields like DisplayName. Details Cross-site scripting or...
PT-2025-6192 · WordPress · Geodirectory – Wp Business Directory Plugin
Name of the Vulnerable Software and Affected Versions: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress versions up to, and including, 2.8.97 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitizati...
WordPress GeoDirectory plugin <= 2.8.97 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display_name Parameter vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via Displayname Parameter vulnerability discovered by Tim Coen in WordPress Plugin GeoDirectory versions = 2.8.97...
The vulnerability of the Device Settings module in the LibreNMS network monitoring system allows a violator to perform cross-site scripting attacks.
The vulnerability of the Device Settings module in the LibreNMS network monitoring system is related to the lack of protective measures taken for the website structure when processing the Display Name field. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...
CVE-2024-45390
@blakeembrey/template is a string template library. Prior to version 1.2.0, it is possible to inject and run code within the template if the attacker has access to write the template name. Version 1.2.0 contains a patch. As a workaround, don't pass untrusted input as the template display name, or...
CVE-2024-10847
The Storely theme for WordPress is vulnerable to Stored Cross-Site Scripting via a malicious display name in all versions up to, and including, 16.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...
WordPress plugin Storely 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site...
GHSA-PM8J-3V64-92CQ LibreNMS Display Name Stored Cross-site Scripting vulnerability
Description: XSS on the parameters Replace $DEVICEID with your specific $DEVICEID value:/device/$DEVICEID/edit - param: display of Librenms versions 24.9.0, 24.10.0, and 24.10.1 https://github.com/librenms/librenms allows remote attackers to inject malicious scripts. When a user views or interact...
LibreNMS Display Name Stored Cross-site Scripting vulnerability
Description: XSS on the parameters Replace $DEVICEID with your specific $DEVICEID value:/device/$DEVICEID/edit - param: display of Librenms versions 24.9.0, 24.10.0, and 24.10.1 https://github.com/librenms/librenms allows remote attackers to inject malicious scripts. When a user views or interact...
Cross-site Scripting (XSS)
Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS in Url.php, accessible via the "display name" parameter under Device Settings. PoC "alert1...
CLSA-2024-1734643401 Fix CVE(s): CVE-2024-6923
SECURITY UPDATE: Improper quoting of newlines in email headers - debian/patches/CVE-2024-6923.patch: Fix serialization of display name in originator or destination address fields with both encoded words and special chars - CVE-2024-6923...
Cross-site Scripting (XSS)
Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Display Name parameter. An attacker can execute arbitrary web scripts or HTML by...
LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section
A stored cross-site scripting XSS vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name parameter...
WordPress plugin NewsMash 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
PT-2024-35746 · Librenms · Librenms
Name of the Vulnerable Software and Affected Versions: LibreNMS versions 24.9.0 through 24.10.0 Description: A stored cross-site scripting XSS vulnerability in the Device Settings section of LibreNMS allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the...