CVE-2019-16954

SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...

CVE-2019-16954

SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...

Design/Logic Flaw

Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report...

Design/Logic Flaw

SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...

CVE-2019-16962

The provided connected documents describe a concrete vulnerability in Zoho ManageEngine Desktop Central 10.0.430: HTML injection via a modified Report Name in a New Custom Report. The issue is documented across sources (NVD, Red Hat, CNVD, CVE lists) and is confirmed as an HTML injection vulnerab...

CVE-2019-16962

Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report...

CVE-2019-16954

CVE-2019-16954 affects SolarWinds Web Help Desk 12.7.0 with an HTML injection vulnerability via the Comment in a Help Request ticket. The provided connected documents indicate the flaw is caused by accepting user input in a Comment and injecting it into HTML, but do not provide explicit exploit s...

CVE-2019-16954

SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...

CVE-2019-16954: Improper Neutralization of Input During Web Page Generation

SolarWinds Web Help Desk 12.7.0 allows HTML injection via a Comment in a Help Request ticket...

PT-2021-8996

Name of the Vulnerable Software and Affected Versions Zoho ManageEngine Desktop Central version 10.0.430 Description The issue allows HTML injection via a modified Report Name in a New Custom Report. This can occur when a user creates a new custom report and modifies the report name to include...

CVE-2019-16962: Improper Neutralization of Input During Web Page Generation

Zoho ManageEngine Desktop Central 10.0.430 allows HTML injection via a modified Report Name in a New Custom Report...

PT-2021-8992

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk version 12.7.0 Description The issue allows HTML injection via a Comment in a Help Request ticket. This can potentially lead to malicious activities such as stealing user sessions or conducting phishing attacks...

SolarWinds Web Help Desk injection vulnerability

SolarWinds Web Help Desk is a web-based help desk work order and IT asset management software. An HTML injection vulnerability exists in SolarWinds Web Help Desk 12.7.0. The vulnerability can be exploited to conduct an HTML injection attack via a Comment in a Help Request work order...

ZOHO ManageEngine Desktop Central injection vulnerability

Zoho ManageEngine Desktop Central is integrated desktop and mobile device management software that helps manage servers, laptops, desktops, smartphones and tablets from a central location. An HTML injection vulnerability exists in Zoho ManageEngine Desktop Central 10.0.430. The vulnerability can ...

TikTok: HTML Injection through Account Name field on TikTok ads portal being rendered on emails

The Account Name field on the TikTok Ads Portal did not have restrictions on HTML tag injections which an attacker could have potentially used for phishing attacks. We thank @nagli for reporting this to our team and confirming the resolution...

CVE-2020-27515: Improper Neutralization of Input During Web Page Generation

A Cross Site Scripting XSS vulnerability in Savsoft Quiz v5.0 allows remote attackers to inject arbitrary web script or HTML via the Skype ID field...

CVE-2020-28184

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

CVE-2020-28184

Cross-site scripting XSS vulnerability in TerraMaster TOS = 4.2.06 allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to /module/index.php...

PT-2020-16939

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions 4.2.06 and earlier Description The issue allows remote authenticated users to inject arbitrary web script or HTML via the mod parameter to "/module/index.php" API endpoint. This enables attackers to execute malicious...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Uncanny Groups for LearnDash before v3.7 allow authenticated remote attackers to inject arbitrary JavaScript or HTML via the ulgmcoderedeem POST Parameter in user-code-redemption.php, the ulgmuserfirst POST Parameter in...