20187 matches found
CVE-2024-32472: Improper Neutralization of Input During Web Page Generation
excalidraw is an open source virtual hand-drawn style whiteboard. A stored XSS vulnerability in Excalidraw's web embeddable component. This allows arbitrary JavaScript to be run in the context of the domain where the editor is hosted. There were two vectors. One rendering untrusted string as...
CVE-2024-32338
WonderCMS version v3.4.3 is vulnerable to a cross-site scripting (XSS) flaw within the Settings section. The root cause is the improper neutralization of input, specifically when a crafted payload is injected into the PAGE TITLE parameter under the Current Page module. This allows an attacker to ...
Google Chrome security vulnerabilities
Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a Data Validation Error vulnerability, which can be exploited by attackers to inject script or HTML into a privileged page via a malicious file...
CVE-2024-31649: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter...
CVE-2024-31652: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS in Cosmetics and Beauty Product Online Store v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter...
CVE-2024-26362
HTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML code via creation of crafted note...
CVE-2024-26362
HTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML code via creation of crafted note...
CVE-2024-27476
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...
CVE-2024-27476
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...
CVE-2024-26362
The Enpass Password Manager Desktop Client version 6.9.2 for both Windows and Linux is affected by an HTML injection vulnerability (CWE-94). This flaw allows an attacker to execute arbitrary HTML code by creating a crafted note or carefully crafted comments . The impact of this vulnerability is c...
Leantime Systems Leantime security vulnerabilities
Leantime Systems Leantime is an open source PHP and MySQL based project management system from Leantime Systems, Inc. A security vulnerability exists in Leantime Systems Leantime version 3.0.6 that stems from vulnerability to HTML injection attacks...
CVE-2024-27476: Improper Control of Generation of Code
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...
CVE-2024-27476
Leantime 3.0.6 is vulnerable to HTML Injection via /dashboard/show/tickets/newTicket...
CVE-2024-26362
HTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML code via creation of crafted note...
PT-2024-21915 · Leantime · Leantime
Name of the Vulnerable Software and Affected Versions: Leantime version 3.0.6 Description: The issue allows for HTML Injection via the /dashboard/show/tickets/newTicket API endpoint. Recommendations: For Leantime version 3.0.6, update to a version that fixes this issue, however at the moment, the...
CVE-2024-26362: Improper Control of Generation of Code
HTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML code via creation of crafted note...
CVE-2024-27476
The project management system Leantime version 3.0.6 is vulnerable to HTML Injection via the /dashboard/show#/tickets/newTicket endpoint. This flaw allows an attacker to inject malicious HTML code through href attributes or anchor tags . Practical consequences include the ability to redirect vict...
CVE-2024-26362
HTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to run arbitrary HTML code via creation of crafted note...