HTML Injection

marky-markdown is vulnerable to HTML Injection. The vulnerability exists as it improperly validates style attribute in img tag, allowing an attacker to pass malicious value...

HTML Injection

marky-markdown is vulnerable to HTML Injection. The vulnerability exists as it improperly validates youtube.com as the source value of the iframes. An attacker is able to pass in a value such as youtube.com.evil.com and bypass the validation...

Cross site scripting

A cross-site scripting XSS vulnerability in the Import People functionality in Gluu Identity Configuration 4.0 allows remote attackers to inject arbitrary web script or HTML via the filename parameter...

HTML Injection

Overview All versions of marky-markdown are vulnerable to HTML Injection due to a validation bypass. The package only allows iframes where the source is youtube.com but it is possible to bypass the validation with sources where youtube.com is the sub-domain, such as youtube.com.evil.co. This...

HTML Injection

Overview All versions of marky-markdown are vulnerable to HTML Injection. The package fails to sanitize style attributes in img tags of the markdown input. This may allow attackers to affect the size of images in the rendered HTML. Recommendation This package is no longer maintained. Please upgra...

Cross-site Scripting (XSS)

Overview written is a rich Markdown editor for the web. Note: This package is deprecated EOL Affected versions of this package are vulnerable to Cross-site Scripting XSS. When parsing and converting markdown into HTML, it is possible to inject malicious JavaScript elements that can result in XSS...

CVE-2014-3827

Multiple cross-site scripting XSS vulnerabilities in the MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the 1 edit or 2 add action in the user-users module or the 3 finduser action or the name parameter in a...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the MyBB aka MyBulletinBoard before 1.8.4 allow remote authenticated users to inject arbitrary web script or HTML via the title parameter in the 1 edit or 2 add action in the user-users module or the 3 finduser action or the name parameter in a...

Cross site scripting

Cross-site scripting XSS vulnerability in MyBB before 1.6.13 allows remote authenticated users to inject arbitrary web script or HTML via the name parameter in the edit action of the config-profilefields module...

CVE-2013-1760

The Bug Genie before 3.2.6 has Multiple XSS and HTML Injection Vulnerabilities...

CVE-2013-1760

The CVE-2013-1760 entry refers to The Bug Genie before version 3.2.6, which is reported to have multiple XSS and HTML injection vulnerabilities. The connected documents consistently identify the affected product and version, and classify the issue as XSS/HTML injection without providing specific ...

CVE-2013-1760

The Bug Genie before 3.2.6 has Multiple XSS and HTML Injection Vulnerabilities...

CVE-2013-1760: Improper Neutralization of Input During Web Page Generation

The Bug Genie before 3.2.6 has Multiple XSS and HTML Injection Vulnerabilities...

PT-2020-7660

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.4 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the title parameter in the edit or add action in the user-users module, the finduser action, ...

PT-2020-7370

Name of the Vulnerable Software and Affected Versions: The Bug Genie versions prior to 3.2.6 Description: The issue concerns Multiple XSS and HTML Injection vulnerabilities. Recommendations: For versions prior to 3.2.6, update to version 3.2.6 or later to resolve the issue...

PT-2020-7205

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.4.9 Description The issue allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to "ajax.php" API endpoint. This is a cross-site scripting XSS issue. Recommendation...

PT-2020-7204

Name of the Vulnerable Software and Affected Versions pragmaMx versions 1.x before 1.12.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the name parameter to "modules.php" or the img url to...

PT-2020-7323

Name of the Vulnerable Software and Affected Versions: SocialEngine versions prior to 4.2.4 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the title parameter to "music/create", the location parameter to "events/create", or the sear...

PT-2020-7148

Name of the Vulnerable Software and Affected Versions Ariadne version 2.7.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO parameter to API endpoints such as "index.php" and "loader.php". Recommendations For Ariadne version 2.7.6, consider...

Cross site scripting

Cross-site scripting XSS vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system news extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin...