CVE-2025-64095

=== 설명 === DNN이전 명칭 DotNetNuke은 마이크로소프트 생태계의 오픈 소스 웹 콘텐츠 관리 플랫폼CMS입니다. 10.1.1 이전 버전에서는 기본 HTML 편집기 공급자가 인증되지 않은 파일 업로드를 허용하며, 이미지가 기존 파일을 덮어쓸 수 있습니다. 인증되지 않은 사용자가 파일을 업로드하고 기존 파일을 교체하여 웹사이트 훼손이 가능하며, 다른 문제와 결합하면 XSS 페이로드를 주입할 수 있습니다. 이 취약점은 10.1.1에서 수정되었습니다...

CVE-2022-42096

Backdrop CMS 버전 1.23.0 취약점 설명: Backdrop CMS 버전 1.23.0에서 Post 콘텐츠를 통해 저장형 크로스 사이트 스크립팅XSS 취약점이 발견되었습니다. 공격 벡터: 공격자는 'Post content'에 글을 작성하고 'Body' 입력 필드에 XSS 페이로드를 삽입한 후, 저장된 XSS를 악용하기 위해 Raw HTML 편집기를 선택해야 합니다. XSS 페이로드는 저장 직후 실행됩니다. 영향을 받는 항목: http://ipaddress/backdrop/node/add/post POST...

CVE-2022-42094

Backdrop CMS 버전 1.23.0 취약점 설명: Backdrop CMS 버전 1.23.0에서 Card 콘텐츠를 통해 저장형 XSSCross-Site Scripting 취약점이 발견되었습니다. 공격 벡터: 공격자는 '카드 콘텐츠'에 무언가를 게시하고 '본문' 입력란에 XSS 페이로드를 삽입한 후 Raw HTML 편집기를 선택하여 저장형 XSS를 악용해야 합니다. XSS 페이로드는 저장 직후 실행됩니다. 영향을 받는 부분: http://ipaddress/backdrop/node/add/card POST...

CVE-2022-42097

Backdrop CMS 버전 1.23.0 취약점 설명: Backdrop CMS 버전 1.23.0에서 Comment를 통해 저장형 크로스 사이트 스크립팅XSS 취약점이 발견되었습니다. 공격 벡터: 공격자는 "댓글"에 무언가를 게시하고 "댓글" 입력란에 XSS 페이로드를 삽입한 후, 저장형 XSS를 악용하기 위해 Raw HTML 편집기를 선택해야 합니다. XSS 페이로드는 저장 직후 실행됩니다. 영향을 받는 대상: http://ipaddress/backdrop/comment/reply/idreply POST...

CVE-2022-42095

Backdrop CMS バージョン 1.23.0 脆弱性の説明: Backdrop CMS バージョン 1.23.0 には、Page コンテンツを介した格納型クロスサイトスクリプティング XSS 脆弱性が含まれていることが判明しました。 攻撃ベクター: 攻撃者は「Page content」に何かを投稿し、「Body」入力に XSS ペイロードを挿入し、Raw HTML エディタを選択して格納型 XSS を悪用する必要があります。XSS ペイロードは保存後すぐに実行されます。 影響を受けるバージョン: http://ipaddress//backdrop/node/add/page PO...

CVE-2026-40508

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious script...

EUVD-2026-62508

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious script...

CVE-2026-40508: Improper Neutralization of Input During Web Page Generation

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious script...

PT-2026-76743

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

EUVD-2026-60355

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50771: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50771

A Cross Site Scripting (XSS) vulnerability exists in Squirro Cognitive Search versions prior to 3.14.2 . This flaw allows a remote attacker to execute arbitrary code by interacting with the Email Notification , Create Evaluation Sets , and HTML Editor functions. While the description identifies t...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-63361

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

EUVD-2026-58731

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...

CVE-2026-63361 LimeSurvey Community Edition 7.0.5 - Reflected XSS in HTML editor popup

LimeSurvey Community Edition 7.0.5 contains an authenticated reflected cross-site scripting vulnerability in the HTML editor popup endpoint. The text and name query parameters are passed through a blacklist sanitizer and then rendered without context-appropriate output encoding...