49 matches found
HTMLawed
HTMLawed는 ... ... 단일 파일로 된 45 kb PHP 스크립트로, 입력 텍스트를 더 안전하게 만들고 HTML 표준을 준수하도록 하며, 웹 페이지 관리자의 관점에서 HTML, XHTML 또는 XML 문서의 본문에 사용하기에 일반적으로 적합하게 만듭니다. 간단한 HTMLTidy 대안인 htmLawed는 필터, 프로세서, 정화기, 살균기, 뷰티파이어 등으로 사용할 수 있으며 매우 높은 사용자 정의가 가능합니다. HTML 태그가 균형을 이루고 제대로 중첩되도록 보장하며, 크로스 사이트 스크립팅XSS 공격에 사용될 수 있는...
GLPI <=10.0.2 - Remote Command Execution
GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module. id: CVE-2022-35914 info: name: GLPI =10.0.2 - Remote Command Execution author: For3stCo1d,allendemoura severity: critical description: | GLPI through 10.0...
CVE-2022-35914_poc
CVE-2022-35914poc GLPI Offsec Lab용 수정: calluserfunc, arraymap, passthru 참고자료 Proving Grounds Practice Lab: GLPI에 맞게 수정됨 https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc/blob/main/CVE-2022-35914.py Mayfly 블로그 게시글:...
CVE-2022-35914-RCE
cyb3rk0ala의 CVE-2022-35914 취약한 GLPI 설치 환경에서 htmLawed 테스트 컴포넌트와 관련된 명령 주입 취약점인 CVE-2022-35914 에 대한 PoC입니다. 이 도구는 취약한 엔드포인트를 통해 명령 실행 기능을 제공하며, 승인된 랩 환경을 위한 선택적 콜백 기능을 포함합니다. 면책 조항: 이 프로젝트는 승인된 보안 테스트, CTF, OffSec/PG 랩, 교육 목적으로만 사용하도록 의도되었습니다. 명시적 승인 없이 시스템에 사용하지 마십시오. 취약점 필드| 세부 정보 ---|--- CVE|...
Exploit for Injection in Glpi-Project Glpi
Да. Ниже именно сырой Markdown-текст — копируй содержимое блока...
Exploit for Injection in Glpi-Project Glpi
CVE-2022-35914 by cyb3rk0ala PoC for CVE-2022-35914, a co...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the cleanupXss function when sanitizing HTML content with conflicting htmLawed configuration options. An attacker can execute arbitrary JavaScript in the context of the affected application by injecting...
GHSA-3H6J-9X8M-RG3G Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config
Summary Graby's cleanupXss function configures htmLawed with conflicting settings: safe=1 which removes combined with 'elements' = '+iframe-meta' which re-enables . htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is render...
Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config
Summary Graby's cleanupXss function configures htmLawed with conflicting settings: safe=1 which removes combined with 'elements' = '+iframe-meta' which re-enables . htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is render...
CVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection...
EUVD-2009-0408
Malware in sbrugna...
EUVD-2010-4611
Malware in sbrugna...
EUVD-2010-4333
Malware in sbrugna...
The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory allows a hacker to inject arbitrary PHP code.
The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory management is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to inject arbitrary PHP code remotely...
ROS-20250303-02
Vulnerability in the htmlawed module of the GLPI computer hardware request, incident and inventory system is related to incorrect input validation in /vendor/htmlawed/htmlawed/htmlawed/htmLawedTest.php. Exploitation of the of the vulnerability could allow an attacker acting remotely to inject...
Teclib GLPI Remote Code Execution Vulnerability
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed...
HTMLawed < 1.2.9 Command Injection (CVE-2022-35914)
Binary data htmlawedcmdinjection.nbin...
HTMLawed < 1.2.9 Code Injection
In versions lower than 1.2.9 htmLawedTest.php in the HTMLawed module allows PHP code injection. No source data...
GLPI 10.0.2 Command Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GLPI htmLawed php command injection', 'Description' = %q This exploit takes advantage of a unauthenticated php command injection available from...
