16010 matches found
CVE-2023-48838
The CVE-2023-48838 entry concerns PHPJabbers Appointment Scheduler v3.0, with multiple HTML injection vulnerabilities triggered via the SMS API Key or Default Country Code. Root cause details indicate HTML injection (XSS) in the web interface, enabling an attacker to inject payloads through those...
CVE-2023-48837
CVE-2023-48837 affects PHPJabbers Car Rental Script v3.0. It is vulnerable to multiple HTML injection (XSS) via the SMS API Key and Default Country Code fields due to inadequate input sanitization. Impact is described as HTML injection; CVSS v3.1 base score 5.4 (Medium). Exploitation details are ...
CVE-2023-48837
Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code...
Car Rental Script Security Vulnerability
Car Rental Script is an open source vehicle rental script from GZ Script. Car Rental Script v3.0 version has a security vulnerability , the vulnerability stems from the existence of multiple HTML injection vulnerabilities...
PT-2023-30969 · Unknown · Availability Booking Calendar
Name of the Vulnerable Software and Affected Versions: Availability Booking Calendar version 5.0 Description: The issue concerns Multiple HTML Injection problems. These issues can be exploited via the SMS API Key or the Default Country Code. Recommendations: For Availability Booking Calendar...
CVE-2023-49293 Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite
Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts ..., it is possible to inject arbitrary HTML into the transforme...
PHPJabbers Appointment Scheduler 3.0 HTML Injection
Exploit Title: PHPJabbers Appointment Scheduler v3.0 - Multiple HTML Injection Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/appointment-scheduler/ Version: v3.0 Tested on: Window...
PHPJabbers Availability Booking Calendar 5.0 HTML Injection
Exploit Title: PHPJabbers Availability Booking Calendar v5.0 - HTML Injection Date: 13/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/availability-booking-calendar/sectionDemo Version: v5.0...
PT-2023-7610
Name of the Vulnerable Software and Affected Versions Vite versions prior to 4.4.12 Vite versions prior to 4.5.1 Vite versions prior to 5.0.5 Description The issue is related to Vite's HTML transformation when invoked manually via server.transformIndexHtml. If the original request URL is passed i...
PHPJabbers Time Slots Booking Calendar 4.0 HTML Injection
Exploit Title: PHPJabbers Time Slots Booking Calendar v4.0 - HTML Injection Date: 13/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/time-slots-booking-calendar/ Version: v4.0 Tested on:...
PHPJabbers Car Rental 3.0 HTML Injection
Exploit Title: PHPJabbers Car Rental v3.0 - HTML Injection Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/car-rental-script/ Version: v3.0 Tested on: Windows 10, Windows 11, Linux...
Cross site scripting
A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...
CVE-2023-48881
A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...
Cross Site Scripting
github.com/mattermost/mattermost is vulnerable to Cross Site Scripting. The vulnerability is due to Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete. This allows an attacker to inject HTML to a victim's page by create a channel name...
CVE-2023-35075
Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...
Hardcoded credentials
Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...
CVE-2023-35075
CVE-2023-35075 : Mattermost webapp vulnerability where channel names set during autocomplete do not use innerText/textContent, enabling HTML injection into a victim’s page when a name contains HTML. The attack does not produce XSS according to the sources. Affected component is the Mattermost web...
CVE-2023-35075 HTML injection via channel autocomplete
Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...
CVE-2023-35075 HTML injection via channel autocomplete
Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...
PT-2023-25131 · Mattermost · Mattermost
Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to use innerText or textContent when setting the channel name in the webapp during autocomplete. This allows an attacker to inject HTML into a...