WordPress GetPaid 2.4.6 HTML Injection

Exploit Title: WordPress Plugin Payments Plugin | GetPaid 2.4.6 - HTML Injection Date: 29/08/2021 Exploit Author: Niraj Mahajan Software Link: https://wordpress.org/plugins/invoicing/ Version: 2.4.6 Tested on Windows Steps to Reproduce: 1. Install Wordpress 5.8 2. Install and Activate "WordPress...

CVE-2020-19049

Cross Site Scripting XSS in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'...

Cross site scripting

Cross Site Scripting XSS in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'...

CVE-2020-19048

CVE-2020-19048 : MyBB 1.8.20 is vulnerable to a Cross Site Scripting (XSS) flaw in the Add New Forum feature. An authenticated attacker can inject arbitrary script/HTML via the Title field when making a POST to /Upload/admin/index.php?module=forum-management&action=add, potentially affecting the ...

CVE-2020-19048: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in DRK Odenwaldkreis Testerfassung March-2021 allow remote attackers to inject arbitrary web script or HTML via all parameters to HTML form fields in all components...

PT-2021-20820

Name of the Vulnerable Software and Affected Versions: DRK Odenwaldkreis Testerfassung version March-2021 Description: The issue allows remote attackers to inject arbitrary web script or HTML via all parameters to HTML form fields in all components. This can be exploited by sending malicious inpu...

Atlassian Jira cross-site scripting vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is mainly used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in Atlassian Jira Server and Data Center versions prior to 8.18.0, which originates from...

CVE-2020-18126: Improper Neutralization of Input During Web Page Generation

Multiple stored cross-site scripting XSS vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML...

PT-2021-22376

Name of the Vulnerable Software and Affected Versions Atlassian Jira Server and Data Center versions 8.5.17 and earlier, 8.6.0 through 8.13.9, and 8.14.0 through 8.18.1 Description The issue allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting XSS vulnerabilit...

Atlassian Jira cross-site scripting vulnerability

Atlassian Jira is a defect tracking management system from Atlassian Australia. The system is used to track and manage all types of issues and defects in the workplace. A security vulnerability exists in the Editor plug-in for Atlassian Jira Server and Data Center versions prior to 8.5.18, 8.6.0 ...

LocalTapiola: Cookie exfiltration through XSS on the main search request of www.lahitapiola.fi

Basic report information Summary: Adding extra search parameters generates the creation of new input fields which can be escaped, thus generating HTML injection possibilities, Cross-Site Scripting attacks, and the retrieval of the page's cookies. Description: - Observing the Bug I was researching...

Cross-site Scripting (XSS) - Reflected in azuracast/azuracast

✍️ Description The Application is Vulnerable to reflected HTML Injection 🕵️‍♂️ Proof of Concept Open the following page in the browser as admin. The page is vulnerable to HTML Injection...

CVE-2020-14161

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...

CVE-2020-14161

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...

Hardcoded credentials

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...

CVE-2020-14161

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...

CVE-2020-14161

CVE-2020-14161 affects Gotenberg and is exploited as a Server-Side Request Forgery (SSRF) via the /convert/html endpoint. The root cause is insecure handling of the src in HTML elements, enabling an attacker to reference internal files (e.g., file:// URIs) through the chromium module used by the ...

CVE-2021-20811

Cross-site scripting vulnerability in List of Assets screen of Movable Type Movable Type 7 r.4903 and earlier Movable Type 7 Series, Movable Type 6.8.0 and earlier Movable Type 6 Series, Movable Type Advanced 7 r.4903 and earlier Movable Type Advanced 7 Series, Movable Type Premium 1.44 and...

CVE-2021-20811

Cross-site scripting vulnerability in List of Assets screen of Movable Type Movable Type 7 r.4903 and earlier Movable Type 7 Series, Movable Type 6.8.0 and earlier Movable Type 6 Series, Movable Type Advanced 7 r.4903 and earlier Movable Type Advanced 7 Series, Movable Type Premium 1.44 and...