CVE-2017-5453

A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. This vulnerability allows for spoofing but no scripted content can be run. This vulnerability affects Firefox 53...

CVE-2016-9901

CVE-2016-9901 affects Mozilla Firefox and Firefox ESR. Un-sanitized HTML from the Pocket server could execute JavaScript in the unprivileged about:pocket-saved context, gaining access to Pocket’s messaging API via HTML injection. Impact stated as high/critical by CVSS. Remediation: update to Fire...

CVE-2016-9901

HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" unprivileged page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR 45.6 and Firefox...

CVE-2016-9903

CVE-2016-9903 is a cross-site scripting (XSS) vulnerability in Mozilla Firefox’s Add-ons SDK. The issue arises from a world-accessible resource that can be loaded as a document due to another vulnerability, enabling an attacker to inject content and script into the add-on context and potentially ...

CVE-2016-9903

Mozilla's add-ons SDK had a world-accessible resource with an HTML injection vulnerability. If an additional vulnerability allowed this resource to be loaded as a document it could allow injecting content and script into an add-on's context. This vulnerability affects Firefox 50.1...

WordPress Grifus Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports personal blogging sites on servers with PHP and MySQL.Grifus is one of the themes. A cross-site scripting vulnerability exists in WordPress Grifus. An attacker can exploit...

santo-ildefonso.empreendimentos.com.pt XSS vulnerability

Open Bug Bounty ID: OBB-629174 Description| Value ---|--- Affected Website:| santo-ildefonso.empreendimentos.com.pt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3...

CVE-2017-7636

Cross-site scripting XSS vulnerability in QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to inject arbitrary web script or HTML...

CVE-2017-16043

CVE-2017-16043 affects the IRC client shout (versions 0.44.0–0.49.3). The root cause is that the /topic command is not escaped, allowing an attacker to inject HTML scripts that run in the victim’s browser (XSS). Documented impact is cross-site scripting in affected versions; no broader exploit de...

Design/Logic Flaw

XSS in sexstatic element used in directory name...

CVE-2018-3755

XSS in sexstatic element used in directory name...

Liberapay: Current CSP Policy chained with HTML Injection can lead to Data Exfiltration

Hi Team, Summary While reviewing the CSP headers for en.liberapay.com i noticed that img-src has a source set to which means any source on the internet. The following is found in the current CSP Header config. img-src blob: data: Description: If the site is vulnerable to HTML Injection its possib...

CVE-2018-3755

XSS in sexstatic element used in directory name...

CVE-2018-3755

Summary (CVE-2018-3755) : The vulnerability affects the static file server module sexstatic (versions ≤ 0.6.2). Affected component is the directory listing code in showdir.js where the directory name (pathname) is used in HTML output without sanitization, enabling a stored XSS if an attacker prov...

Cross site scripting

Cross-site scripting XSS vulnerability in File Sharing Notify Toast in Synology Drive before 1.0.2-10275 allows remote authenticated users to inject arbitrary web script or HTML via the malicious file name...

Cross site scripting

A reflected XSS vulnerability on Ruckus ICX7450-48 devices allows remote attackers to inject arbitrary web script or HTML...

Magento has multiple vulnerabilities

Magento is an open source PHP e-commerce system from Magento, which provides permission management, search engine and payment gateway. Magento suffers from HTML injection, multiple remote code execution, local file inclusion and arbitrary file deletion vulnerabilities. An attacker can steal...

wityCMS 0.6.1 - Cross-Site Scripting

Exploit Title: wityCMS 0.6.1 Persistent XSS on "Website's name" field Date: 05/28/2018 Exploit Author: Nathu Nandwani Website: http://nandtech.co/ Vendor Homepage: https://creatiwity.net/witycms Software Link: https://github.com/Creatiwity/wityCMS/releases/tag/0.6.1 Version: 0.6.1 Tested on:...

GitLab: HTML TAG INJECTION ON PROFILE NAME

Allows me to change the profile name to an image tag and convert it into an html code and this tag appears perfectly on the "snippets" page. Suppose I include an image tag with source and when another user sees it on the "https://gitlab.com/snippets/1718284" page it will appear an image of an...

Citrix XenMobile Server Cross-Site Scripting Vulnerability (CNVD-2018-10356)

Citrix XenMobile Server is a mobility management solution from Citrix Systems. The solution is capable of managing mobile devices, developing mobile policies and compliance rules, and providing insight into the operation of mobile mobile networks. A cross-site scripting vulnerability exists in...