CVE-2024-28108

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the contentLink parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. Also, requires that adding n...

phpMyFAQ security vulnerabilities

phpMyFAQ is a multilingual, fully database-driven Frequently Asked Questions FAQ system by the individual developer Thorsten Rinne. A security vulnerability exists in phpMyFAQ, which stems from insufficient validation of the contentLink parameter and could allow an unauthenticated user to inject...

PT-2024-2385 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.2.6 Description: The issue is related to insufficient validation on the contentLink parameter, allowing unauthenticated users to inject HTML code into the page, which may affect other users. This requires that...

CVE-2024-28108: Improper Neutralization of Input During Web Page Generation

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Due to insufficient validation on the contentLink parameter, it is possible for unauthenticated users to inject HTML code to the page which might affect other users. Also, requires that adding n...

Cross-site Scripting in Moodle Chat

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

CVE-2024-2727

HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message...

CVE-2024-2727

HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message...

CVE-2024-2727 Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 system

HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message...

CVE-2024-2727

CVE-2024-2727 is described as an HTML injection vulnerability in the CIGESv2 system (Stored XSS). The connected documents confirm the affected product (CIGESv2) and vulnerability class, noting ability to inject arbitrary code and modify website and email confirmation content. No concrete details ...

CVE-2024-2727 Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 system

HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message...

CVE-2024-2727: Improper Neutralization of Input During Web Page Generation

HTML injection vulnerability affecting the CIGESv2 system, which allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message...

CIGESv2 Cross-Site Scripting Vulnerability

CIGESv2 is a queue and reservation management system from CIGESv2, Inc. CIGESv2 suffers from a cross-site scripting vulnerability that stems from the presence of an HTML injection vulnerability. An attacker can exploit the vulnerability to inject arbitrary code and modify website and email...

PT-2024-21784

Name of the Vulnerable Software and Affected Versions CIGESv2 system affected versions not specified Description The issue allows an attacker to inject arbitrary code and modify elements of the website and email confirmation message. This is due to an HTML injection vulnerability affecting the...

CVE-2024-28593: Improper Control of Generation of Code

The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads to a performance degradation. NOTE: the vendor's UsingChat page says "If you know some HTML code, you can use it in your text to do things like insert image...

Cross-site Scripting (XSS)

ZITADEL is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization when rendering login UI templates. This vulnerability allows an attacker to inject HTML into the login page via crafted links...

CVE-2024-27290

Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The vulnerability has been patched in version 1.4.97 of the mast...

CVE-2024-29469

A stored cross-site scripting XSS vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Category List parameter under the Lab module...

CVE-2024-24683 Apache Hop Engine: ID isn't escaped when generating HTML

Improper Input Validation vulnerability in Apache Hop Engine.This issue affects Apache Hop Engine: before 2.8.0. Users are recommended to upgrade to version 2.8.0, which fixes the issue. When Hop Server writes links to the PrepareExecutionPipelineServlet page one of the parameters provided to the...

CVE-2024-21504

Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting XSS when a page uses Url for a property. An attacker can inject HTML code in the context of the user's browser session by crafting a malicious link and convincing the user to click on it...

CVE-2024-28855

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the text/template instead of the html/template package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and...