CVE-2021-40969

CVE-2021-40969 affects Spotweb up to version 1.5.1, with a reflected XSS in templates/installer/step-004.inc.php via the firstname parameter. The Nuclei template confirms this as a reflected XSS risk in Spotweb

Cross site scripting

JeeCMS 1.0.1 contains a stored cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the commentText parameter...

Cross site scripting

LaraCMS v1.0.1 contains a stored cross-site scripting XSS vulnerability which allows atackers to execute arbitrary web scripts or HTML via a crafted payload in the page management module...

Elastic Kibana HTML Injection Vulnerability (ESA-2021-23)

Elastic Kibana is prone to an HTML injection vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:elastic:kibana";...

CVE-2020-19950

A cross-site scripting XSS vulnerability in the /banner/add.html component of YzmCMS v5.3 allows attackers to execute arbitrary web scripts or HTML...

Design/Logic Flaw

OpenVPN Access Server 2.9.0 through 2.9.4 allow remote attackers to inject arbitrary web script or HTML via the web login page URL...

CVE-2021-3824

OpenVPN Access Server 2.9.0–2.9.4 is affected by a cross‑site scripting (XSS) vulnerability in the web login page URL, allowing remote attackers to inject arbitrary web script/HTML. Root cause: improper handling of characters in the login page URL. Impact: potential execution of malicious script ...

PT-2021-5225 · Esri · Arcgis Server

Name of the Vulnerable Software and Affected Versions: ArcGIS Server affected versions not specified Description: The issue is related to incorrect code generation management in the server, allowing a remote attacker to execute arbitrary HTML code. A remote file inclusion vulnerability in the...

Cross-site Scripting (XSS) - Stored in evereux/flicket

Description Stored XSS in deleting departments page due to unsanitized input in many places. Proof of Concept 1. Create a new department with name 2. After creating the above department, Click on delete icon next to it and see the pop up. 3. Create a new ticket with title 4. View the ticket and s...

Liferay Portal 7.3.5 Stored XSS

A stored cross-site scripting XSS vulnerability in the Asset module's category selector input field in Liferay Portal 7.3.5 allows remote attackers to inject arbitrary web script or HTML via the comliferayassetcategoriesadminwebportletAssetCategoriesAdminPortlettitle parameter. Note that Nessus h...

ownCloud < 4.0.3 XSS Vulnerability (oC-SA-2012-019)

ownCloud is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:owncloud:owncloud"...

TikTok: HTML Injection on tiktoktutorials via firstName parameter

HTML injection was found in tiktoktutorials endpoint which could have potentially allowed attackers to modify the content of the email and trick users into visiting malicious sites. We thank @siratsami for reporting this to our team...

Drupal 9.2.x < 9.2.6 Multiple Vulnerabilities

According to its self-reported version, the instance of Drupal running on the remote web server is 8.9.x prior to 8.9.19, 9.1.x prior to 9.1.13, or 9.2.x prior to 9.2.6. It is, therefore, affected by multiple vulnerabilities. - Under some circumstances, the Drupal core JSON:API module does not...

CVE-2021-28901

Multiple cross-site scripting XSS vulnerabilities exist in SITA Software Azur CMS 1.2.3.1 and earlier, which allows remote attackers to inject arbitrary web script or HTML via the 1 NOMCLI , 2 ADRESSE , 3 ADRESSE2, 4 LOCALITE parameters to /eshop/products/json/aouCustomerAdresse; and the 5 nomlis...

DRUPAL-CORE-2021-006

The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to...

Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006

The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to...

CVE-2021-24619

The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfilteredhtml capability is disallowed, which could lead to Cross-Site Scripting issues...

CVE-2021-40223

Rittal CMC PU III Web management version V3.11.002 fails to sanitize user input on several parameters of the configuration User Configuration dialog, Task Configuration dialog and set logging filter dialog. This allows an attacker to backdoor the device with HTML and browser-interpreted content...

Design/Logic Flaw

Rittal CMC PU III Web management version V3.11.002 fails to sanitize user input on several parameters of the configuration User Configuration dialog, Task Configuration dialog and set logging filter dialog. This allows an attacker to backdoor the device with HTML and browser-interpreted content...

CVE-2021-40377

SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content, thus allowing one to inject HTML and/or JavaScript into a page that will then be processed and stored by the application...