20195 matches found
CVE-2020-27851: Improper Neutralization of Input During Web Page Generation
Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privileged role...
PT-2021-11429
Name of the Vulnerable Software and Affected Versions: Rocketgenius Gravity Forms versions prior to 2.4.21 Description: The issue allows remote attackers to inject arbitrary HTML code via poll or quiz answers in the "poll" and "quiz" features of an additional paid add-on. This code is interpreted...
Informatica: Html injection on ██████.informatica.com via search.html?q=1
hello dear I have found HTML injection on ██████.informatica.com parameters injectable search.html?q=1 URL : https://████████.informatica.com/search.html?q=1%22%3E%3Cimg%20src=https://www.no-gods-no-masters.com/imagesdesigns/anonymous-gandhi-d001001207265.png%3E%E2%80%[email protected]%20%22 payload ; 1"”@x...
WordPress FV Flowplayer Video Player plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.FV Flowplayer Video Player is a video player plugin used in it. relevant is a relevant content display plugin used in it. A cross-site...
Cross site scripting
A stored cross-site scripting XSS issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/post.php request with the posttitle parameter...
CVE-2020-35582
A stored cross-site scripting XSS issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/post.php request with the posttitle parameter...
Design/Logic Flaw
This affects the package @scullyio/scully before 1.0.9. The transfer state is serialised with the JSON.stringify function and then written into the HTML page...
Arbitrary Code Injection
json-sanitizer is vulnerable to arbtirary code injection. An attacker could potentially inject arbitrary HTML and XML into embedding documents as closing SCRIPT tags and CDATA section delimiters may be emitted for certain input...
CVE-2021-23899
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents...
CVE-2021-23899
CVE-2021-23899 affects the OWASP json-sanitizer library prior to version 1.2.2. The vulnerability arises when the sanitizer emits closing SCRIPT tags and CDATA section delimiters for crafted input, enabling injection of arbitrary HTML or XML into embedding documents. Affected component: json-sani...
CVE-2021-23899
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents...
CVE-2021-23899
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents...
CVE-2021-23899: Improper Restriction of XML External Entity Reference
OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents...
Owasp Json-sanitizer Code Issue Vulnerability
Owasp Json-sanitizer is a Java-based code library from the Owasp Foundation that generates Json format data from Json-like text content. A code issue vulnerability exists in OWASP json-sanitizer version 1.2.2, which stems from the possibility that the program may emit closed script tags and CDATA...
PT-2021-15600
Name of the Vulnerable Software and Affected Versions: OWASP json-sanitizer versions prior to 1.2.2 Description: The issue allows an attacker to inject arbitrary HTML or XML into embedding documents by emitting closing SCRIPT tags and CDATA section delimiters for crafted input. Recommendations: F...
Slack: Denial of Service via Hyperlinks in Posts
Summary Via html injection its possible to override all document functions, causing the application to crash because its using the element as a function. Brief explanation of how its possible override document functions with html injection: In some html elements, the name attribute becomes a...
CVE-2020-16030
Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...
SolarWinds Web Help Desk HTML Injection Vulnerability
SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. An HTML injection vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct an HTML injection attack via a Comment in a Help Request work order...
Zoho ManageEngine Desktop Central HTML Injection Vulnerability
Zoho ManageEngine Desktop Central is integrated desktop and mobile device management software that helps manage servers, laptops, desktops, smartphones and tablets from a central location. An HTML injection vulnerability exists in Zoho ManageEngine Desktop Central 10.0.430. The vulnerability can ...
