Cross-Site Scripting (XSS)

moodle/moodle is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the introeditortext parameter or the TinyMCE HTML editor...

Progress Telerik UI for ASP.NET AJAX Code Issue Vulnerability

Progress Telerik UI for ASP.NET AJAX is an HTML editor. A code issue vulnerability exists in Progress Telerik UI for ASP.NET AJAX 2019.3.1023 and prior versions. The vulnerability stems from an improperly designed or implemented code development process for a web-based system or product. No...

PT-2019-13973 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions 3.x Description: The issue allows stored XSS within the Source/HTML editing feature of the Categories, Product, and Information pages when an attacker has login access to the admin panel. Recommendations: For OpenCart versio...

Cross-Site Scripting (XSS)

DotNetNuke.Web is vulnerable to cross-site scripting. The Telerik HTML editor allows remote attackers to inject arbitrary Javascript into a victim's browser to steal session cookies and perform unwanted actions on behalf of the user...

WordPress BBE theme <= 1.52 - Direct Object Reference vulnerability

Direct Object Reference vulnerability found by Zhihua Yao in WordPress BBE theme versions = 1.52. The vulnerability allows a direct launch of an HTML editor. Solution Update the WordPress BBE theme to the latest available version at least 1.53...

BBE theme for WordPress HTML editor vulnerability

BBE theme for WordPress is a theme plugin for the WordPress platform. A security vulnerability exists in BBE theme for WordPress versions prior to 1.53. An attacker can exploit the vulnerability to launch the HTML editor directly...

Hardcoded credentials

The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor...

CVE-2018-11244

The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor...

CVE-2018-11244

The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor...

CVE-2018-11244

The BBE theme before 1.53 for WordPress allows a direct launch of an HTML editor...

CVE-2018-11244

The CVE-2018-11244 entry concerns the WordPress BBE theme prior to version 1.53. Multiple sources describe a Direct Object Reference vulnerability that allows direct launching of the HTML editor, implying that an attacker could indirectly trigger the HTML editor through the theme. Affected softwa...

WYSIWYG HTML Editor PRO 1.0 - Arbitrary File Download

WYSIWYG HTML Editor PRO 1.0 - Arbitrary File Download Exploit Title: WYSIWYG HTML Editor PRO 1.0 - Arbitrary File Download Dork: N/A Date: 28.08.2017 Vendor Homepage: http://nelliwinne.net/ Software Link:...

Polycom VVX Web Interface Privilege Escalation

Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link: http://downloads.polycom.com/voice/voip/ucswreleasesmatrix.html Version: Polycom vvx 410 UC Software Version: 5.3.1.04...

Polycom VVX Web Interface - Change Admin Password

Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link: http://downloads.polycom.com/voice/voip/ucswreleasesmatrix.html Version: Polycom vvx 410 UC Software Version: 5.3.1.04...

Polycom VVX Web Interface - Change Admin Password

Polycom VVX Web Interface - Change Admin Password Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link: http://downloads.polycom.com/voice/voip/ucswreleasesmatrix.html...

Polycom VVX Web Interface - Change Admin Password Vulnerability

Exploit for hardware platform in category web applications Exploit Title: Polycom VVX Web Interface - Change Admin Password as User Date: January 26, 2017 Exploit Author: Mike Brown Vendor Homepage: http://www.polycom.com/ Software Link:...

CVE-2016-5124

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev14. Adding images from external sources to HTML editors by drag&drop can potentially lead to script code execution in the context of the active user. To exploit this, a user needs to be tricked to use an image from a specially...

Design/Logic Flaw

An issue was discovered in Open-Xchange OX App Suite before 7.8.1-rev14. Adding images from external sources to HTML editors by drag&drop can potentially lead to script code execution in the context of the active user. To exploit this, a user needs to be tricked to use an image from a specially...

CVE-2016-5124

Open-Xchange OX App Suite (frontend) is affected by CVE-2016-5124. Before 7.8.1-rev14, dragging and dropping images from external sources into HTML editors (e.g., E‑Mail Compose, OX Text) can inject script code in the user’s context, bypassing XSS filters. Exploitation requires user social engine...

openSUSE Security Update : roundcubemail (openSUSE-2016-1205)

This update for roundcubemail to 1.1.6 fixes several issues boo1001856. These security issues were fixed : - Fix XSS issue in href attribute on area tag - Wash position:fixed style in HTML mail for better security These non-security issues were fixed : - Searching in both contacts and groups when...