Cross-site Scripting (XSS)

Liferay Portal is vulnerable to stored cross-site scripting. The vulnerability is due to the improper neutralization of input during web page generation which allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name te...

Cross-site Scripting (XSS)

Liferay Portal is vulnerable to Stored cross-site scripting XSS. The vulnerability is due to inadequate input validation, allowing remote authenticated users to inject arbitrary web script or HTML via a crafted payload into a document's “Title” text field...

Cross-site Scripting (XSS)

The Calendar module in Liferay Portal is vulnerable to Cross-site Scripting. The vulnerability is due to not escaping the user-supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event...

Cross-Site Scripting

Liferay portal is vulnerable to reflected cross-site scripting XSS. The vulnerability is due to insufficient input validation that allows remote attackers to inject arbitrary web script or HTML via a crafted payload into the “Blocked Email Domains” text field in the instance settings for Accounts...

Cross-Site Scripting

liferay portal is vulnerable to cross-site scripting XSS. The vulnerability is due to improper input validation in the portlet.js module of the Frontend JS library. This flaws allowing attackers to inject arbitrary web script or HTML via the anchor hash part of a URL...

Withdrawn Advisory: Kirby CMS HTML injection vulnerability

Withdrawn Advisory This advisory has been withdrawn because the vendor reports that some HTML formatting such as with an H1 element is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur. Original Advisory An HTML injection...

GHSA-QV4X-V2V4-F8P9 Withdrawn Advisory: Kirby CMS HTML injection vulnerability

Withdrawn Advisory This advisory has been withdrawn because the vendor reports that some HTML formatting such as with an H1 element is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur. Original Advisory An HTML injection...

Cross-Site Scripting

liferay portal is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper validation of the filename of an attachment in the Message Board widget, allowing remote authenticated users to inject arbitrary web script or HTML...

CVE-2024-26482

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is backend sanitization such that the reporter's mentioned "injecti...

Design/Logic Flaw

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is backend sanitization such that the reporter's mentioned "injecti...

Enhavo CMS Security Vulnerability

Enhavo CMS is a content management system from Enhavo Inc. A security vulnerability exists in Enhavo CMS version v0.13.1, which stems from the presence of an HTML injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted payload...

CVE-2024-26482

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is backend sanitization such that the reporter's mentioned "injecti...

CVE-2024-25873

Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2024-25873

Enhavo v0.13.1 contains an HTML injection vulnerability in the Blockquote module’s Author text field that can execute arbitrary code via a crafted payload. Public sources identify the affected component (Author field in Blockquote) and the impact (arbitrary code execution). No explicit patches ar...

Kirby security breach

Kirby is a file-based content management system CMS. A security vulnerability exists in Kirby CMS version v4.1.0 that stems from the presence of an HTML injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted payload...

CVE-2024-25873

Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

PT-2024-21177 · Enhavo · Enhavo

Name of the Vulnerable Software and Affected Versions: Enhavo version 0.13.1 Description: The issue is related to an HTML injection vulnerability in the Author text field under the Blockquote module. This allows attackers to execute arbitrary code via a crafted payload. Recommendations: For Enhav...

CVE-2024-26482

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is backend sanitization such that the reporter's mentioned "injecti...

PT-2024-21302

Name of the Vulnerable Software and Affected Versions mjml versions 0.10.0 through 0.10.x mjml version 0.11.0 is not affected, as it contains the fix for this issue. However, versions prior to 0.10.0 are also not affected. Description The issue affects users of the mjml-python library who insert...

CVE-2024-26482

The CVE-2024-26482 entry concerns Kirby CMS v4.1.0, specifically the Edit Content Layout module, with an HTML injection vulnerability. The NVD entry notes a vendor dispute over the impact, citing that some HTML formatting is allowed and backend sanitization would prevent malicious script injectio...