CVE-2021-3964

elgg is vulnerable to Authorization Bypass Through User-Controlled Key...

CVE-2011-3733

Elgg 1.7.6 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by vendors/simpletest/test/visualtest.php and certain other files...

CVE-2011-2936

Elgg through 1.7.10 has a SQL injection vulnerability...

CVE-2011-2935

Elgg through 1.7.10 has XSS...

CVE-2021-4072

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

POST Based Reflected Cross Site Scripting in installation page

Description The installation page in Elgg ≤ v4.3.3 is vulnerable to Cross-Site Scripting attack via 'dataroot' parameter. Steps to Reproduce 1. Freshly install the Elgg in your web-server and proceed to "Database Installation Page". 2. Enter the following payload in "Data Directory" field and fil...

Password Reset Poisoning

Description Elgg uses the HTTP Host-Header in a password reset request to generate the password reset link that is sent to the user in an email without any filters or checks. This allows an attacker to craft a password reset request using a manipulated host header, resulting in reset-token leakag...

Elgg Cross-Site Scripting Vulnerability (CNVD-2022-38755)

Elgg is a set of open source social networking engine. The product blogs, file sharing, groups and other features. elgg has a cross-site scripting vulnerability, there are no details of the vulnerability provided...

Elgg open redirect

Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect...

GHSA-R6H7-846C-8M78 Elgg open redirect

Elgg before 1.12.18 and 2.3.x before 2.3.11 has an open redirect...

Elgg Reflected XSS Vulnerability

VULNERABILITY DESCRIPTION The internalname parameter is not properly sanitized, which allows attacker to conduct Cross Site Scripting attack. This may allow an attacker to create a specially crafted URL that would execute arbitrary script code in a victim's browser PROOF-OF-CONCEPT/EXPLOIT http...

GHSA-MCFM-J5G6-W26F Elgg Reflected XSS Vulnerability

VULNERABILITY DESCRIPTION The internalname parameter is not properly sanitized, which allows attacker to conduct Cross Site Scripting attack. This may allow an attacker to create a specially crafted URL that would execute arbitrary script code in a victim's browser PROOF-OF-CONCEPT/EXPLOIT http...

elgg is vulnerable to Cross-site Scripting

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

GHSA-2XW8-J43J-5VXP elgg is vulnerable to Cross-site Scripting

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross-site Scripting (XSS)

elgg/elgg is vulnerable to cross-site scripting XSS attacks. Improper input neutralization during web page generation allows malicious users to inject and execute arbitrary javascript through address parameter in add.php...

CVE-2021-4072

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-4072

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-4072

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross site scripting

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-4072 Cross-site Scripting (XSS) - Stored in elgg/elgg

elgg is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...