bootstrap: XSS in the tooltip or popover data-template attribute

A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired...

Joomla Publisher 3.0.19 Cross Site Scripting

Exploit Title: Joomla Publisher V 3.0.19 Stored XSS Date: 03.11.2020 Author: Vincent666 ibn Winnie Software Link: https://publisher.ijoomla.com/demo Tested on: Windows 10 Web Browser: Mozilla Firefox Blog : https://pentest.vincent.blogspot.com/ PoC:...

CVE-2020-27359

A cross-site scripting XSS issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Messenger feature. It was found that the filename of the image or file attached in a message could be used to perform this XSS attack. A user could craft a messag...

TikTok: HTML Injection on Company Name on Email

By changing the company name to any HTML code on the TikTok Creator Marketplace, an attacker could potentially use this to send phishing emails to users containing injected HTML payload. We thank @gnux for reporting this to our team and confirming the resolution!...

bettercap-proxy-modules

This is a collection of HTTP proxy modules for the BetterCap framework, a tool for performing network attacks and penetration testing. The modules are designed to be used with the BetterCap proxy server, which can be configured to intercept and modify HTTP traffic between a client and a server. T...

PT-2020-16794

Name of the Vulnerable Software and Affected Versions Citadel WebCit versions prior to 926 Description Multiple cross-site scripting XSS vulnerabilities allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. This issue was reported to the vendor in a...

CVE-2020-27741: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Citadel WebCit through 926 allow remote attackers to inject arbitrary web script or HTML via multiple pages and parameters. NOTE: this was reported to the vendor in a publicly archived "Multiple Security Vulnerabilities in WebCit 926" thread...

CVE-2020-27182

Multiple cross-site scripting XSS vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, jobjacketdetail.jsp, ixedit/editorcomponent.jsp, or the login form...

PT-2020-16653

Name of the Vulnerable Software and Affected Versions konzept-ix publiXone versions prior to 2020.015 Description The issue allows remote attackers to inject arbitrary JavaScript or HTML, which can be achieved via several endpoints, including "appletError.jsp", "job jacket detail.jsp",...

CVE-2018-8062

A cross-site scripting XSS vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04R02.A2pD035g.d23i firmware allows remote attackers to inject arbitrary web script or HTML via the Service Description parameter while creating a WAN service...

Cross site scripting

A cross-site scripting XSS vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04R02.A2pD035g.d23i firmware allows remote attackers to inject arbitrary web script or HTML via the Service Description parameter while creating a WAN service...

U.S. Dept Of Defense: CSRF to Stored HTML injection at https://www.█████

Description: I have found out that on the https://www.███████ domain, you initiate POST request in order to look up for case studies, the parameter keyword on the request, allows the usage of bad characters such as Click here to win 1000$!" 3. Save the POST request and craft CSRF payload. HTML...

Design/Logic Flaw

This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ... . As such, it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which...

CVE-2020-7749

The CVE-2020-7749 issue affects all versions of osm-static-maps where user input is passed directly to a template without escaping ({{{ ... }}}). This enables injection of arbitrary HTML/JS, leading to XSS in the rendered page and, in server contexts (e.g., Puppeteer), potential SSRF and Local Fi...

TinyMCE 5 HTML Injection

Exploit Title: iframe Injection\Html Injection TinyMCE 5 HTML WYSIWYG Date:18.10.2020 Author: Vincent666 ibn Winnie Software Link: https://www.tiny.cloud/features/ Tested on: Windows 10 Web Browser: Mozilla Firefox Blog : https://pentest-vincent.blogspot.com/ PoC:...

Cross site scripting

Multiple stored cross-site scripting XSS vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations Best-fit Mapping, as demonstrated by the full-width variants of the less-than sign...

CVE-2020-13893

CVE-2020-13893 affects Sage EasyPay 10.7.5.10 with multiple stored XSS vulnerabilities. The issue arises from handling Unicode Transformations (Best-fit Mapping), enabling authenticated attackers to inject arbitrary web script or HTML via multiple parameters, demonstrated by full-width variants o...

PT-2020-13758

Name of the Vulnerable Software and Affected Versions Sage EasyPay version 10.7.5.10 Description The issue allows authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations Best-fit Mapping, as demonstrated by the full-width variants of...

CVE-2020-16270

OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of...

Basecamp: Possible DOM XSS on app.hey.com

Summary: Hello Team, While testing it was observed that on https://app.hey.com/, on Search box there is a possibility of XSS. Although the payload is reflected in the DOM but the CSP blocks the execution of the script, the XSS can happen if the CSP is somehow bypassed. The Subject parameter is...