Yahei-PHP Prober 0.4.7 HTML Injection

Yahei-PHP Prober v0.4.7 speed Remote HTML Injection Vulnerability Vendor: Yahei.Net Product web page: http://www.yahei.net Affected version: 0.4.7 Summary: Detection of system web server operating environment. Desc: Input passed to the GET parameter 'speed' is not properly sanitised before being...

Yahei-PHP Prober v0.4.7 (speed) Remote HTML Injection Vulnerability

Summary Detection of system web server operating environment. Description Input passed to the GET parameter 'speed' is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site. Yahei-P...

CVE-2018-18676

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board tail contents" parameter, aka the adm/boardformupdate.php bomobilecontenttail parameter...

CVE-2018-18675

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board title contents" parameter, aka the adm/boardformupdate.php bomobilesubject parameter...

CVE-2018-18676

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board tail contents" parameter, aka the adm/boardformupdate.php bomobilecontenttail parameter...

CVE-2018-18676

GNUBOARD5 5.3.1.9 contains a cross‑site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script/HTML through the mobile board tail contents parameter (adm/board_form_update.php bo_mobile_content_tail). This CVE (CVE-2018-18676) affects GNUBOARD5; exploitation details...

CVE-2018-18671

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/boardformupdate.php bomobilecontenthead parameter...

CVE-2018-18671

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/boardformupdate.php bomobilecontenthead parameter...

Design/Logic Flaw

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/boardformupdate.php bomobilecontenthead parameter...

CVE-2018-18672

GNUBOARD5 5.3.1.9 contains an XSS vulnerability in the adm/board_form_update.php endpoint via the board head contents (bo_content_head) parameter, allowing remote script execution in a victim’s browser. The issue is confirmed across multiple sources (Red Hat, CNVD, NVD, osv) and is tied to GNUBOA...

CVE-2018-18670

CVE-2018-18670 affects GNUBOARD5 version 5.3.1.9, where an XSS vulnerability exists allowing remote attackers to inject arbitrary web script or HTML via the "Extra Contents" parameter (also identified as the adm/config_form_update.php cf_1~10 parameter). The issue stems from insufficient validati...

CVE-2018-18671

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/boardformupdate.php bomobilecontenthead parameter...

XSS Vulnerability in UQCMS Single Merchant System

UQCMS Single Merchant System is an external display and shopping system suitable for running your own products. UQCMS Single Merchant System suffers from an XSS vulnerability, which can be exploited by attackers to inject arbitrary Web script or HTML...

CVE-2019-12834

In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATHINFO to the dashboards/ URI...

CVE-2019-12834

In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATHINFO to the dashboards/ URI...

Cross site scripting

A Cross Site Scripting XSS vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msg...

Cross-Site Scripting (XSS)

GROWI are vulnerable to cross-site scripting attacks. A remote, authenticated attacker could exploit the flawed New Page Handler component to inject and execute arbitrary web script or HTML into victim's browser...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2019-22260)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2019-12930

A cross-site scripting XSS vulnerability in noMenu and noSubMenu in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows remote attackers to inject arbitrary web script or HTML via the method parameter...

CVE-2019-5970

The CVE-2019-5970 entry applies to WordPress Plugin Attendance Manager (versions ≤ 0.5.6). The vulnerability is a Self-reported Stored Cross-Site Scripting (CWE-79) in which an attacker can inject arbitrary script/HTML via unspecified vectors, potentially executing code in the administrator’s bro...