CVE-2014-9470

Fork CMS prior to 3.8.4 is affected by a cross-site scripting (XSS) vulnerability in the loadForm() function (Frontend/Modules/Search/Actions/Index.php) where the q_widget parameter to /en/search can inject arbitrary script/HTML. The issue arises from insufficient input filtering and is exploitab...

PT-2020-7802

Name of the Vulnerable Software and Affected Versions: WordPress Photo Gallery plugin versions prior to 1.2.11 Description: The issue allows remote authenticated users to inject arbitrary web script or HTML via certain parameters in an addImages action to the "wp-admin/admin-ajax.php" API endpoin...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter...

CVE-2020-8788

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...

Design/Logic Flaw

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...

CVE-2020-8788

The CVE-2020-8788 entry affects Synaptive Medical ClearCanvas ImageServer 3.0 Alpha and is caused by an XSS/HTML injection vulnerability in the Default.aspx UserName parameter. The connected documents confirm the affected product and the injection vector, but do not provide additional exploit det...

CVE-2020-8788

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...

PT-2020-20278

Name of the Vulnerable Software and Affected Versions Synaptive Medical ClearCanvas ImageServer version 3.0 Alpha Description The issue allows for XSS and HTML injection via the UserName parameter in the "Default.aspx" endpoint. Recommendations For Synaptive Medical ClearCanvas ImageServer versio...

CVE-2020-8788: Improper Neutralization of Input During Web Page Generation

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...

Cross site scripting

Cross-site Scripting XSS in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-2684: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Open-Xchange: XSS - Guard - Insufficient escaping of User-IDs from PGP Keys

Vulnerability PGP user IDs are typically in form of name and OX Guard properly escapes angle brackets when inserting them to HTML. But in the code for displaying a list of keys it inserts IDs into HTML attributes without escaping double quote characters. javascript //...

PT-2020-7402

Name of the Vulnerable Software and Affected Versions: Telaen versions prior to 1.3.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the f email parameter in "index.php". Recommendations: For versions prior to 1.3.1, update to version 1.3.1 or later to...

Cross site scripting

Cross-site scripting XSS vulnerability in infoware MapSuite MapAPI 1.0.x before 1.0.36 and 1.1.x before 1.1.49 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Nuri: HTML injection in email content

Summary: Hi, I just found an issue when register account in https://app.bitwala.com/onboarding/preliminary. It allow hacker injection malicious text include html code in email content. Steps To Reproduce: Make request register below with payload html in ==firstName== and ==lastName== parameter:...

PT-2020-7698

Name of the Vulnerable Software and Affected Versions Eucalyptus Management Console EMC versions 4.0.0 through 4.0.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML. Recommendations For versions 4.0.0 through 4.0.1, update to version 4.0...

CVE-2014-5039: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Eucalyptus Management Console EMC 4.0.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-4241

Multiple cross-site scripting XSS vulnerabilities in the HMS Testimonials plugin before 2.0.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 name, 2 image, 3 url, or 4 testimonial parameter to the Testimonial form hms-testimonials-addnew page; 5 dateformat...

CVE-2013-2294

Multiple cross-site scripting XSS vulnerabilities in ViewGit before 0.0.7 allow remote repository users to inject arbitrary web script or HTML via a 1 tag name to the Shortlog table in templates/shortlog.php or branch name to the 2 Shortlog table in templates/shortlog.php or 3 Heads table in...

CVE-2013-2294

CVE-2013-2294 concerns ViewGit, with XSS vulnerabilities in the web UI prior to 0.0.7. The issues are triggered when a remote repository user injects malicious data via git branch or tag names, affecting the Shortlog table in templates/shortlog.php and the Heads table in plates/summary.php. The v...