HackerOne: HTML injection that may lead to XSS on HackerOne.com through H1 Triage Wizard Chrome Extension

An HTML injection vulnerability was discovered on HackerOne.com through the H1 Triage Wizard Chrome Extension. An attacker could inject malicious code into the triage questionnaire modal, potentially leading to the compromise of confidential information or impacting its integrity...

HTML Injection

Description HTML Injection vulnerability was discovered in Accounting module that allow authenticated user to inject malicious HTML code inside "accountnumber" parameter. Proof of Concept Video...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the artname parameter under ART TYPE option in the navigation bar...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter...

Stored XSS

Description answer has a feature to customize the "Site Name" during installation or in the settings page , due to a bad sanitization it allows to put arbitrary html code which allows to execute javascript code. Everytime a user enter in the website, the xss is triggered. Injected payload...

HTML Injection

froxlor/froxlor is vulnerable to HTML Injection. The vulnerability is due to the Interval Time in the Dropdown Menu of the cronjob page, which doesn't validate the input, allowing an attacker to change to time to a stored HTML Injection due to the update function in Cronjobs.php...

CVE-2023-23942 Self reflected HTML injection in Desktop client

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation...

CVE-2023-23942 Self reflected HTML injection in Desktop client

The Nextcloud Desktop Client is a tool to synchronize files from a Nextcloud Server with your computer. Versions prior to 3.6.3 are missing sanitisation on qml labels which are used for basic HTML elements such as strong, em and head lines in the UI of the desktop client. The lack of sanitisation...

CVE-2022-48085

Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter...

CVE-2022-48085

Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter...

Design/Logic Flaw

Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter...

Self reflected HTML injection in Desktop client

None...

CVE-2022-48085

Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter...

CVE-2022-48085

Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter...

CVE-2022-48085

CVE-2022-48085 affects Softr v2.0, with a reported HTML injection vulnerability in the Work Space Name parameter. The CVSS 3.1 base score is 5.4 (Medium) with Network attack vector, low attack complexity, privileges required: Low, user interaction required, and impact primarily on confidentiality...

Html Injection in Contributors

Description Html injection in Contributors and just only need html payload in Display Name and fire in Contributors list Proof of Concept 1. Login to squidex 2. Create an app with random name. 2. Go to Edit Profile then Edit users display name with html payload = Sanket722 3. Go to...

CVE-2023-23937

CVE-2023-23937 affects Pimcore/pimcore. The issue is in the upload functionality for updating a user profile, where content-type validation is insufficient, allowing an authenticated user to bypass checks by supplying a valid signature (e.g., GIF89) and sending mismatched content-type. This can e...

GHSA-8XV4-JJ4H-QWW6 Pimcore contains Unrestricted Upload of File with Dangerous Type

Impact The upload functionality for updating user profile does not properly validate the file content-type, allowing any authenticated user to bypass this security check by adding a valid signature p.e. GIF89 and sending any invalid content-type. This could allow an authenticated attacker to uplo...

CVE-2022-2546

The CVE-2022-2546 issue affects WordPress All-in-One WP Migration plugin < 7.63. The vulnerability arises from using the wrong content type and not properly escaping the ai1wm_export response, enabling an attacker to craft a request that, when submitted by a visitor, injects arbitrary HTML/Jav...

Cross-Site Scripting (XSS)

sanitize is vulnerable to Cross-Site Scripting XSS. An attacker is able to inject and execute arbitrary HTML on victim's browser due to improper sanitization when the library is configured with a custom allowlist that allows noscript elements...