CVE-2022-45928

A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 16.2.19.1803. Multiple endpoints allow the user to pass the parameter htmlFile, which is included in the HTML output rendering pipeline of a request. Because the Content Server evaluates and executes Oscript...

Cross-site Scripting (XSS)

krayin/laravel-crm is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in the v-html parameter in table-body.vue, allowing an attacker to inject and execute malicious javascript...

Afi Solutions WebAcms 跨站脚本漏洞

Afi Solutions WebAcms is an Edi converter from Afi Solutions, Germany. A cross-site scripting vulnerability exists in Afi Solutions WebAcms, which originates from the product's Index.html file's ID parameter that does not effectively filter user input data. The vulnerability can be exploited to...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in emlog version = pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parameter...

CVE-2021-31731

A directory traversal issue in KiteCMS 1.1.1 allows remote administrators to overwrite arbitrary files via ../ in the path parameter to index.php/admin/Template/fileedit, with PHP code in the html parameter...

Passing in a non-string 'html' argument can lead to unsanitized output

A type-confusion vulnerability can cause striptags to concatenate unsanitized strings when an array-like object is passed in as the html parameter. This can be abused by an attacker who can control the shape of their input, e.g. if query parameters are passed directly into the function. Impact XS...

CVE-2021-32696: Improper Handling of Unexpected Data Type

The npm package "striptags" is an implementation of PHP's striptags in Typescript. In striptags before version 3.2.0, a type-confusion vulnerability can cause striptags to concatenate unsanitized strings when an array-like object is passed in as the html parameter. This can be abused by an attack...

CVE-2021-1420

A vulnerability in certain web pages of Cisco Webex Meetings could allow an unauthenticated, remote attacker to modify a web page in the context of a user's browser. The vulnerability is due to improper checks on parameter values in affected pages. An attacker could exploit this vulnerability by...

CVE-2013-3366

Undocumented TELNET service in TRENDnet TEW-812DRU when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg24Mhw3...

Hardcoded credentials

Undocumented TELNET service in TRENDnet TEW-812DRU when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg24Mhw3...

Hardcoded credentials

Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML parameter of password and a value of j78G¬DFdg24Mhw3...

CVE-2019-15873

The profilegrid-user-profiles-groups-and-communities plugin before 2.8.6 for WordPress has remote code execution via an wp-admin/admin-ajax.php request with the action=pmtemplatepreview&html=?php substring followed by PHP code...

CVE-2018-17590

AirTies Air 5442 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter...

CVE-2018-17589

AirTies Air 5650 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter...

LocalTapiola: Multiple Reflected XSS /webApp/lahti (viestinta.lahitapiola.fi)

Vulnerable script: /webApp/lahti Vulnerable parameters: ctxvarshtml, ctxvarszoom, ctxvarsLat, ctxvarsLng PoC 1 html parameter https://blackfan.ru/localtapiola4567uytr567tre4567ytr/poc1html.html Result: html alertdocument.location PoC 2 zoom parameter...

Home Web Server <= r1.7.1 (build 147) Gui Thread-Memory Corruption

No description provided by source. Home Web Server =r1.7.1 build 147 Gui Thread-Memory Corruption Exploit. By: Aodrulez. Homepage : http://downstairs.dnsalias.net/homewebserver.html Product Released : 22.4.2009/21:16:58 Description: This web server when fed with 1006 bytes of chr0x0d,with the htm...

JAMF Casper Suite MDM CSRF Vulnerability

Exploit for jsp platform in category web applications CVE-2012-4051 - JAMF Casper Suite MDM CSRF Vulnerability Exploit Title: JAMF Software's Casper Suite MDM Solution CSRF Date: Discovered and reported July 2012 Author: Jacob Holcomb/Gimppy042 Software JAMF Software Casper Suite...

WHMCompleteSolution (WHMCS) 5.0 - KnowledgeBase.php?search Cross-Site Scripting

WHMCompleteSolution WHMCS 5.0 - KnowledgeBase.php?search Cross-Site Scripting source: https://www.securityfocus.com/bid/53740/info WHMCS is prone to a cross-site scripting vulnerability and multiple HTML-parameter-pollution vulnerabilities because it fails to properly sanitize user-supplied input...

WHMCompleteSolution (WHMCS) 5.0 - Cross-Site Request Forgery (Multiple Application Function)

WHMCompleteSolution WHMCS 5.0 - Cross-Site Request Forgery Multiple Application Function source: https://www.securityfocus.com/bid/53740/info WHMCS is prone to a cross-site scripting vulnerability and multiple HTML-parameter-pollution vulnerabilities because it fails to properly sanitize...

WHMCompleteSolution (WHMCS) 5.0 - 'KnowledgeBase.php?search' Cross-Site Scripting

source: https://www.securityfocus.com/bid/53740/info WHMCS is prone to a cross-site scripting vulnerability and multiple HTML-parameter-pollution vulnerabilities because it fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code would run in the context of the...