CVE-2022-2546

The CVE-2022-2546 issue affects WordPress All-in-One WP Migration plugin < 7.63. The vulnerability arises from using the wrong content type and not properly escaping the ai1wm_export response, enabling an attacker to craft a request that, when submitted by a visitor, injects arbitrary HTML/Jav...

Cross-Site Scripting (XSS)

sanitize is vulnerable to Cross-Site Scripting XSS. An attacker is able to inject and execute arbitrary HTML on victim's browser due to improper sanitization when the library is configured with a custom allowlist that allows noscript elements...

Squidex security vulnerabilities

squidex is a Headless CMS and Content Management Center. A security vulnerability exists in squidex versions prior to 7.4.0, which stems from the ability to inject Html into Activity...

bootstrap: XSS in the tooltip or popover data-template attribute

A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired...

bootstrap: XSS in the tooltip or popover data-template attribute

A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired...

CVE-2022-44897: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the shownumber parameter...

VulnCheck KEV: CVE-2021-24205

In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget includes/widgets/icon-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modifi...

Dropdown Menu Manipulation leads to stored HTML Injection

Hello In the Cronjob we can change the Interval Time the Dropdown Menu "minutes" to a stored HTML Injection. The Vulnerabilities are 2: 1. First thing the Dropdown Menu should be fixed and nobody can alter or change anything which we will do 2. Second we can implement a stored HTML Injection with...

Improper Neutralization of Equivalent Special Elements

Overview Affected versions of this package are vulnerable to Improper Neutralization of Equivalent Special Elements due to a possible HTML injection via deleting an account's API key that has a payload as its label. Remediation Upgrade BTCPayServer.Client to version 1.7.5 or higher. References -...

CVE-2022-47052

The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perform Reflected XSS and HTML Injection. A malicious unauthenticated attacker can exploit this vulnerability using a specially crafted URL. This affects firmware...

CVE-2022-47052

The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perform Reflected XSS and HTML Injection. A malicious unauthenticated attacker can exploit this vulnerability using a specially crafted URL. This affects firmware...

Crlf injection

The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perform Reflected XSS and HTML Injection. A malicious unauthenticated attacker can exploit this vulnerability using a specially crafted URL. This affects firmware...

HTML Injection

Overview com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to HTML Injection. HTML uploaded payload executed successfully through /xxl-job-admin/user/add and /xxl-job-admin/user/update. Details Cross-site scripting or XSS is a code...

NETGEAR Nighthawk AC1200 Injection Vulnerability

The NETGEAR Nighthawk AC1200 is a wireless router from NETGEAR. An injection vulnerability exists in multiple firmware versions of the NETGEAR Nighthawk AC1200, which originates in its web interface and allows an unauthenticated, malicious attacker to execute reflective cross-site scripting and...

BTCPay Server Injection Vulnerability

BTCPay Server is a self-hosted open source cryptocurrency payment processor. It is secure, private, uncensored and free. A security vulnerability exists in versions of BTCPay Server prior to 1.7.5, which stems from a vulnerability that allows an attacker to implement HTML injection...

CVE-2022-47052: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perform Reflected XSS and HTML Injection. A malicious unauthenticated attacker can exploit this vulnerability using a specially crafted URL. This affects firmware...

CVE-2022-47052

The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perform Reflected XSS and HTML Injection. A malicious unauthenticated attacker can exploit this vulnerability using a specially crafted URL. This affects firmware...

CVE-2022-47052

The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perform Reflected XSS and HTML Injection. A malicious unauthenticated attacker can exploit this vulnerability using a specially crafted URL. This affects firmware...

PT-2023-15145 · NetGear · Nighthawk R6220 Ac1200 Smart Wi-Fi Router

Name of the Vulnerable Software and Affected Versions: Nighthawk R6220 AC1200 Smart Wi-Fi Router versions V1.1.0.112 1.0.1, V1.1.0.114 1.0.1 Description: The web interface of the router is susceptible to a CRLF Injection attack, which can be used to perform Reflected XSS and HTML Injection. An...

CVE-2022-46624

A cross-site scripting XSS vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter...