20187 matches found
Cross-site Scripting (XSS)
Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Scripting XSS via the editentry action, which is accessible on the FAQ Q&A editor page. An admin user can disrupt other users' sessions by...
CVE-2024-56199 phpMyFAQ Vulnerable to Stored HTML Injection at FAQ
phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content into the FAQ editor at http://localhost/admin/index.php?action=editentry, resulting in a complete disruption of the FAQ page's user...
CVE-2024-56199
phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content into the FAQ editor at "http://localhost/admin/index.php?action=editentry", resulting in a complete disruption of the FAQ page's user...
CVE-2024-56199 phpMyFAQ Vulnerable to Stored HTML Injection at FAQ
phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content into the FAQ editor at http://localhost/admin/index.php?action=editentry, resulting in a complete disruption of the FAQ page's user...
CVE-2024-56199
phpMyFAQ is vulnerable from versions 3.2.10 through 4.0.1 to an HTML injection in the FAQ editor (https://.../admin/index.php?action=editentry), enabling injected HTML that disrupts the page UI and can lead to DoS and degraded user experience. The issue is fixed in version 4.0.2; upgrading to 4.0...
CVE-2024-56199 phpMyFAQ Vulnerable to Stored HTML Injection at FAQ
phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content into the FAQ editor at http://localhost/admin/index.php?action=editentry, resulting in a complete disruption of the FAQ page's user...
CVE-2024-56199: Improper Neutralization of Input During Web Page Generation
phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malicious HTML content into the FAQ editor at http://localhost/admin/index.php?action=editentry, resulting in a complete disruption of the FAQ page's user...
PT-2025-3201 · Phpmyfaq · Phpmyfaq
Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions 3.2.10 through 4.0.2 Description: The issue allows an attacker to inject malicious HTML content into the FAQ editor at "http://localhost/admin/index.php?action=editentry", resulting in a complete disruption of the FAQ page's...
CVE-2024-54451
A cross-site scripting XSS vulnerability in the graphicCustomization.do page in Kurmi Provisioning Suite before 7.9.0.38, 7.10.x through 7.10.0.18, and 7.11.x through 7.11.0.15 allows remote attackers authenticated as system administrators to inject arbitrary web script or HTML via the...
CVE-2024-41752
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
CVE-2024-41752
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
CVE-2024-41752 IBM Cognos Analytics HTML injection
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
CVE-2024-41752 IBM Cognos Analytics HTML injection
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
CVE-2024-41752
CVE-2024-41752 affects IBM Cognos Analytics. The vulnerability is an HTML injection in IBM Cognos Analytics versions 11.2.0–11.2.4 and 12.0.0–12.0.3, which could allow a remote attacker to inject HTML that renders in a victim’s browser under the hosting site’s security context. The connected IBM ...
GHSA-PX38-239G-X5MG Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page
Cross-site scripting XSS vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted...
CVE-2024-41752: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.3 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
IBM Cognos Analytics security vulnerabilities
IBM Cognos Analytics is a suite of business intelligence software from International Business Machines IBM. The software includes reports, dashboards, and scorecards, and can assist companies in adjusting their decision-making by analyzing such things as key factors versus key people. A security...
PT-2024-29553 · Ibm · Ibm Cognos Analytics
Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.2.0 through 11.2.4 IBM Cognos Analytics versions 12.0.0 through 12.0.3 Description: The issue concerns an HTML injection vulnerability. A remote attacker could inject malicious HTML code, which when viewed,...
CVE-2023-37940
Cross-site scripting XSS vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted...