Informatica: Reflected Cross-Site Scripting/HTML Injection

The default ASP page at https://███/redirect/default.asp is vulnerable to reflected Cross-Site Scripting in the "url" parameter. To reproduce the issue just visit the following URL and an alert should pop up: - https://██████████/redirect/?url=%3Cscript%3Ealertdocument.domain%3C/script%3E It seem...

CVE-2020-23050

TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of the user account input field. This vulnerability allows attackers to execute phishing attacks, external redirects, and arbitrary code...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields...

Design/Logic Flaw

TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of the user account input field. This vulnerability allows attackers to execute phishing attacks, external redirects, and arbitrary code...

CVE-2020-23050

TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a HTML injection vulnerability in the userFirstName parameter of the user account input field. This vulnerability allows attackers to execute phishing attacks, external redirects, and arbitrary code...

CVE-2020-23050

TAO Open Source Assessment Platform v3.3.0 RC02 contains a HTML injection vulnerability in the userFirstName field of the user account input. The issue enables phishing, external redirects, and arbitrary code execution. Root cause is HTML injection in the userFirstName parameter. Related advisori...

PT-2021-10826 · Unknown · Tao Open Source Assessment Platform

Name of the Vulnerable Software and Affected Versions: TAO Open Source Assessment Platform version 3.3.0 RC02 Description: The issue allows attackers to execute phishing attacks, external redirects, and arbitrary code due to a HTML injection vulnerability in the userFirstName parameter of the use...

TikTok: HTML Injection via TikTok Ads Email Share

A HTML injection was found on a TikTok Ads endpoint via the "SenderName" parameter. We thank @lu3ky-13 for reporting this to our team...

Portlandlabs Concrete5 Cross-Site Scripting Vulnerability (CNVD-2021-94046)

Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, Inc. A cross-site scripting vulnerability exists in Portlandlabs Concrete5 crete5-legacy 5.6.4.0 and prior versions, which can be exploited by remote attackers to "rel" parameter to inject arbitrary web scri...

Cross site scripting

A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a web administration session, possibly tricking a...

HackerOne: HTML injection in email at https://www.hackerone.com/

HTML injection was possible in emails sent via the HackerOne platform by filling the first name and last name fields with HTML tags on the pentest community application form. This could allow an attacker to send malicious emails and inject HTML into them...

CVE-2021-32609

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...

CVE-2021-32609

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...

Design/Logic Flaw

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...

EUVD-2021-0021

Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page...

CVE-2021-32609

CVE-2021-32609: Apache Superset up to 1.1 is affected by an XSS vulnerability on the Explore page due to unsanitized chart titles. An attacker with Explore access can save a chart with a malicious title, injecting HTML (including scripts) into the page. Connected sources (BIT-SUPERSET-2021-32609,...

PT-2021-19806 · Apache · Apache Superset

Name of the Vulnerable Software and Affected Versions: Apache Superset versions up to and including 1.1 Description: The issue allows an attacker with Explore access to save a chart with a malicious title, injecting html including scripts into the page, due to incorrect sanitization of titles on...

Juniper Junos OS Vulnerability (JSA11220)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA11220 advisory. - A persistent cross-site scripting XSS vulnerability in the captive portal graphical user interface of Juniper Networks Junos OS may allow a remote authenticated user to...

Verint Systems Verint Workforce Optimization Injection Vulnerability

Verint Systems Verint Workforce Optimization WFO is an employee performance management solution from Verint Systems, Inc. The product supports workforce management, call logging, automated quality management, performance management, text and desktop analytics, etc. An injection vulnerability exis...

in fisharebest/webtrees

Description The program allows to upload files with dangerous file types in the media upload section, leading to XSS and other exploits like shell uploads, HTML injection leading to Social Engineering attacks, etc ..., I have demonstrated HTML file upload leading to XSS here. Proof of Concept mov...