CVE-2020-26701

CVE-2020-26701 is an XSS in the Dashboards module of Kaa IoT Platform v1.2.0. The vulnerability arises from injecting scripts/HTML via the Description field, exploitable through the Dashboard editing flow in the Solutions/Dashboards area. A PoC is documented in public material (e.g., PacketStorm)...

PT-2020-16485

Name of the Vulnerable Software and Affected Versions Kaa IoT Platform version 1.2.0 Description The issue allows remote attackers to inject malicious web scripts or HTML Injection payloads via the Description parameter in the Dashboards section. This enables attackers to execute arbitrary code o...

CVE-2020-26701: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Dashboards section in Kaa IoT Platform v1.2.0 allows remote attackers to inject malicious web scripts or HTML Injection payloads via the Description parameter...

PT-2020-5021

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 87.0.4280.66 Description The issue is related to insufficient data validation in the Blink mechanism of Google Chrome, allowing a remote attacker to inject arbitrary scripts or HTML, potentially leading to...

Kaa IoT Platform 1.2.0 Cross Site Scripting

Exploit Title: Kaa IoT Platform 1.2.0 Cross Site Scripting XSS Vulnerability Date: 2020-10-01 Exploit Author: Mufaddal Masalawala Vendor Homepage: https://www.kaaproject.org/ Software Link: https://cloud.kaaiot.com/ Version: 1.2.0 Tested on: Kali Linux 2020.3 CVE: CVE-2020-26701 Proof Of Concept:...

Mail.ru: HTML injection in an email [delivery.city-mobil.ru]

It was possible to inject spoofed HTML content into delivery.city-mobil.ru registration e-mail message via forged user name...

Cross site scripting

touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0...

CVE-2020-26218 HTML Injection in touchbase.ai

touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0...

CVE-2020-26218

touchbase.ai before version 2.0 is vulnerable to Cross-Site Scripting. The vulnerability allows an attacker to inject HTML payloads which could result in defacement, user redirection to a malicious webpage/website etc. The issue is patched in version 2.0...

CVE-2020-26218

CVE-2020-26218 affects touchbase.ai prior to version 2.0 and is a Cross-Site Scripting vulnerability that lets attackers inject HTML payloads, potentially causing defacement and user redirection to malicious pages. The issue is mitigated by upgrading to version 2.0, which patches the vulnerabilit...

BugPoC: Solution for XSS challenge wacky.buggywebsite.com

Summary: Found a HTML injection in https://wacky.buggywebsite.com/frame.html?param=Injected Bypasswing CSP : CSP : script-src 'nonce-txjohfomwjdo' 'strict-dynamic'; frame-src 'self'; object-src 'none'; Then found a vuln code in https://wacky.buggywebsite.com/frame.html js window.fileIntegrity =...

USN-4620-1 phpldapadmin vulnerability

It was discovered that phpLDAPadmin didn't properly sanitize before being echoed to the user. A remote attacker could inject arbitrary HTML/Javascript code in a user's context and cause a crash, resulting in denial of service or potential execution of arbitrary code...

CVE-2020-15951

Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML content that is rendered as part of the application. An attacker could leverage this to redirect application users to a phishing website in an attempt to steal...

Design/Logic Flaw

Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML content that is rendered as part of the application. An attacker could leverage this to redirect application users to a phishing website in an attempt to steal...

CVE-2020-15951

CVE-2020-15951 affects Immuta v2.8.2, where user-supplied project names are not properly sanitized. This allows injection of arbitrary HTML content that can be rendered by the application, enabling attackers to redirect users to phishing sites and attempt credential theft. The available sources c...

CVE-2020-15951

Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML content that is rendered as part of the application. An attacker could leverage this to redirect application users to a phishing website in an attempt to steal...

CVE-2020-15951: Improper Neutralization of Input During Web Page Generation

Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML content that is rendered as part of the application. An attacker could leverage this to redirect application users to a phishing website in an attempt to steal...

PT-2020-16910

Name of the Vulnerable Software and Affected Versions AudimexEE versions prior to 14.1.1 Description The issue allows remote attackers to inject arbitrary web script or HTML via 'action, cargo, panel' parameters, potentially leading to data leakage. This occurs when the recommended security...

PT-2020-14732

Name of the Vulnerable Software and Affected Versions Immuta version 2.8.2 Description The issue allows attackers to inject arbitrary HTML content into the application by supplying malicious project names. This could be used to redirect users to a phishing website in an attempt to steal...

httpd: limited cross-site scripting in mod_proxy error page

A cross-site scripting vulnerability was found in Apache httpd, affecting the modproxy error page. Under certain circumstances, a crafted link could inject content into the HTML displayed in the error page, potentially leading to client-side exploitation...