CVE-2017-15941

Cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.7, when the GlobalProtect gateway or portal is configured, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Dell SonicWall SonicOS NSA CVE-2018-5281 Multiple HTML Injection Vulnerabilities

SonicWall SonicOS on Network Security Appliance NSA 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens. CVE: CVE-2018-5281 Last updated: Jan. 30, 2018, 4:12 p.m...

Dell SonicWall SonicOS NSA CVE-2018-5280 HTML Injection Vulnerability

SonicWall SonicOS on Network Security Appliance NSA 2016 Q4 devices has XSS via the Configure SSO screens. CVE: CVE-2018-5280 Last updated: Jan. 30, 2018, 4:04 p.m...

Froxlor 0.9.37 HTML Injection

Credits: John Page aka HyP3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/FROXLOR-0.9.37-HTML-INJECTION.txt + ISR: ApparitionSec Vendor: ============== www.froxlor.org Product: ============= Froxlor 0.9.37 Vulnerability Type: ===================...

Cross Site Scripting Vulnerability in PAN-OS GlobalProtect

A vulnerability exists in PAN-OS GlobalProtect when either the gateway or the portal are configured. This issue could allow for a cross-site scripting XSS attack. Ref PAN-81586 / CVE-2017-15941 Successful exploitation of this issue may allow an attacker to inject arbitrary javascript or HTML. Thi...

Cross Site Scripting in PAN-OS Captive Portal

A vulnerability exists in PAN-OS Captive Portal that could allow for a cross-site scripting XSS attack to be performed against clients viewing the captive portal page when configured in a certain way. Ref PAN-85238 / CVE-2017-16878 Successful exploitation of this issue may allow an attacker to...

PYSEC-2017-18

Cross-site scripting XSS vulnerability in the keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the "key" argument...

Synology MailPlus Server Cross-Site Scripting Vulnerability

Synology MailPlus Server is a mail server solution for businesses. A cross-site scripting vulnerability exists in the User Policy editor in Synology MailPlus Server. A remote authenticated user can exploit the vulnerability to inject arbitrary HTML via the name parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in 1 templates/admanagement/admanagement.php and 2 templates/adspot/adspot.php in the ResAds plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter...

CVE-2015-7666

Multiple cross-site scripting XSS vulnerabilities in the 1 cpupdateMessageItem and 2 cpdeleteMessageItem functions in cppppadminintmessagelist.inc.php in the Payment Form for PayPal Pro plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the cal...

CVE-2015-7324

Multiple cross-site scripting XSS vulnerabilities in helpers/comment.php in the StackIdeas Komento comkomento component before 2.0.5 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the 1 img or 2 url tag of a new comment...

Cross site scripting

Cross-site scripting XSS vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary HTML via the name parameter...

CVE-2017-16768

Cross-site scripting XSS vulnerability in User Policy editor in Synology MailPlus Server before 1.4.0-0415 allows remote authenticated users to inject arbitrary HTML via the name parameter...

Netis-WF2419 HTML Injection

Exploit Title: Netis-WF2419 HTML Injection Date: 20/12/2017 Exploit Author: Sajibe Kanti Vendor Homepage: http://www.netis-systems.com/ Version: Netis-WF2419 , V2.2.36123 Tested on: Windows 8.1 HTML Injection in Netis-WF2419 Netis-WF2419 is prone to an HTML-injection vulnerability because it fail...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in uistats.php in the bSuite plugin before 5 alpha 3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 s or 2 p parameters to index.php...

PHP Scripts Mall Readymade Video Sharing Script HTTP Injection Vulnerability

PHP Scripts Mall Readymade Video Sharing Script is a set of PHP based online video sharing website scripts by PHP Scripts Mall India. An HTML injection vulnerability exists in PHP Scripts Mall Readymade Video Sharing Script version 3.2. An attacker can exploit this vulnerability to inject HTML co...

WordPress Custom Map 1.1 Cross Site Scripting

Product: Custom Map WordPress Plugin - https://wordpress.org/plugins/custom-map/ Vendor: webdesi9 Tested version: 1.1 CVE ID: CVE-2017-17744 CVE description A cross-site scripting XSS vulnerability in the custom-map plugin through 1.1 for WordPress allows remote attackers to inject arbitrary web...

WordPress Concours 1.1 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Product: WordPress Concours Plugin - https://wordpress.org/plugins/wp-concours/ Vendor: Olyos Tested version: 1.1 CVE ID: CVE-2017-17719 CVE description A cross-site scripting XSS vulnerability in the wp-concours plugin through 1.1 for WordPre...

WordPress CSV Import-Export 1.1 Cross Site Scripting Vulnerability

WordPress CSV Import-Export plugin version 1.1 suffers from a cross site scripting vulnerability. Product: CSV Import-Export Wordpress Plugin - https://wordpress.org/plugins/csv-import-export/ Vendor: eSparkBiz Tested version: 1.1 CVE ID: CVE-2017-17753 CVE description Multiple cross-site scripti...

CVE-2017-12630

CVE-2017-12630 affects Apache Drill 1.11.0 and earlier. The vulnerability is a cross-site scripting issue where submitting a form from the Query page allows an attacker to inject arbitrary script/HTML, which can then execute on the Profile page and potentially expose cookie information. The conne...