20192 matches found
CVE-2022-32442
u5cms version 8.3.5 is vulnerable to Cross Site Scripting XSS. When a user accesses the default home page if the parameter passed in is http://127.0.0.1/? "Onmouseover=%27tzgl 96502%27bad=", it can cause html injection...
PT-2022-21323
Name of the Vulnerable Software and Affected Versions u5cms version 8.3.5 Description The issue allows for Cross Site Scripting XSS when a user accesses the default home page with a specific parameter. The parameter Onmouseover can be used to inject HTML code, potentially leading to security...
CVE-2022-32442: Improper Neutralization of Input During Web Page Generation
u5cms version 8.3.5 is vulnerable to Cross Site Scripting XSS. When a user accesses the default home page if the parameter passed in is http://127.0.0.1/? "Onmouseover=%27tzgl 96502%27bad=", it can cause html injection...
Textpattern CMS <= 4.8.7 HTML Injection Vulnerability
Textpattern CMS is prone to a HTML injection vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
HTML Injection
typo3/cms is vulnerable to HTML injection. The vulnerability exists due to the lack of sanitization used in the receiverName parameter in PasswordRecovery.html, allowing an attacker to inject and execute malicious html content on the web page...
Panther Labs: reflected XSS on panther.com
Summary: When visiting runpanther.io I got redirected to panther.com and the application failed to sanitise user's input resulting into HTML injection and possible XSS. Steps To Reproduce: F1774502 1. Go to...
Acronis: HTML Injection in E-mail Not Resolved ()
Summary On this report " https://hackerone.com/reports/1536899 " You closed the report and changed the status to Resolved. But it's Not Resolved The Bug It's Still there Steps To Reproduce 1.Please register at https://www.acronis.com/en-us/products/cyber-protect/trial/registration with the victim...
CVE-2021-40658
Textpattern 4.8.7 is affected by a HTML injection vulnerability through “ContentWriteBody”...
CVE-2021-40658
Textpattern 4.8.7 is affected by a HTML injection vulnerability through “ContentWriteBody”...
CVE-2021-40658
Textpattern 4.8.7 is affected by a HTML injection vulnerability through “ContentWriteBody”...
Design/Logic Flaw
Textpattern 4.8.7 is affected by a HTML injection vulnerability through “ContentWriteBody”...
CVE-2021-40658
Textpattern 4.8.7 is affected by a HTML injection vulnerability in the Body field of Content>Write>Body. The vulnerability is described as a HTML injection issue in Textpattern CMS
CVE-2021-40658
Textpattern 4.8.7 is affected by a HTML injection vulnerability through “ContentWriteBody”...
Textpattern CMS cross-site scripting vulnerabilities
Textpattern CMS is a Php-based content management system from the Textpattern team. A cross-site scripting vulnerability exists in Textpattern CMS version 4.8.7, which stems from the "Body" parameter being vulnerable to HTML injection...
CVE-2021-40658: Improper Neutralization of Input During Web Page Generation
Textpattern 4.8.7 is affected by a HTML injection vulnerability through “ContentWriteBody”...
PT-2022-11293 · Unknown · Textpattern
Name of the Vulnerable Software and Affected Versions: Textpattern version 4.8.7 Description: The issue is related to a HTML injection vulnerability. It can be exploited through the "ContentWriteBody" section. Recommendations: For version 4.8.7, consider restricting access to the "ContentWriteBod...
CVE-2022-24876
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scriptin...
PT-2022-16948
Name of the Vulnerable Software and Affected Versions GLPI versions prior to 10.0.1 Description The issue is related to a cross-site scripting vulnerability in the Kanban view of GLPI, which can be exploited by injecting HTML code in a user's name. Users are advised to upgrade to a newer version ...
CVE-2022-24876: Improper Neutralization of Input During Web Page Generation
GLPI is a Free Asset and IT Management Software package, that provides ITIL Service Desk features, licenses tracking and software auditing. Kanban is a GLPI view to display Projects, Tickets, Changes or Problems on a task board. In versions prior to 10.0.1 a user can exploit a cross site scriptin...
GitLab: CSP-bypass XSS in project settings page
Summary This javascript function is vulnerable: javascript deployKeyRowHtmlkey, isActive const isActiveClass = isActive || ''; return $key.title $sprintf 'Owned by %imagetag', imagetag: , , false, $escape key.fullname, $key.username ; It is used to render a deployment key in a dropdown item...