CVE-2020-23766

An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any file in the server should they gain Administrator privileges...

CVE-2020-23766

An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any file in the server should they gain Administrator privileges...

CVE-2020-23766

CVE-2020-23766 affects htmly v2.7.5. A path/traversal-like vulnerability lets a remote attacker with Administrator privileges delete arbitrary files on the server by supplying an absolute path. The impact is deletion with potential partial integrity and availability effects, per provided referenc...

PT-2021-10945

Name of the Vulnerable Software and Affected Versions: htmly version 2.7.5 Description: An arbitrary file deletion issue was found, allowing remote attackers with Administrator privileges to delete any file on the server using an absolute path. Recommendations: For version 2.7.5, at the moment,...

CVE-2020-23766: Improper Limitation of a Pathname to a Restricted Directory

An arbitrary file deletion vulnerability was discovered on htmly v2.7.5 which allows remote attackers to use any absolute path to delete any file in the server should they gain Administrator privileges...

HTMLy 路径遍历漏洞

HTMLy is a PHP-based open source blogging platform. A path traversal vulnerability exists in htmly version v2.7.5, which originates from allowing a remote attacker with administrator privileges to exploit the vulnerability to delete any file on the server using any absolute path...

htmly 2.8.0 Cross Site Scripting Exploit

Exploit Title: htmly 2.8.0 allows stored XSS Authors: @nu11secur1ty & G.Dzhankushev Date: 04.15.2021 Vendor: htmly Link: https://github.com/danpros/htmly CVE: CVE-2021-30637 Software Link: https://github.com/danpros/htmly Video: https://www.youtube.com/watch?v=xKRQZYqVlS4 Steps to Reproduce:...

htmly 2.8.0 Cross Site Scripting

Exploit Title: htmly 2.8.0 allows stored XSS Authors: @nu11secur1ty & G.Dzhankushev Date: 04.15.2021 Vendor: htmly Link: https://github.com/danpros/htmly CVE: CVE-2021-30637 + Exploit Source: https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-26929 Exploit Program Code !/usr/bin/python3...

htmly 2.8.0 - 'description' Stored Cross-Site Scripting (XSS)

Exploit Title: htmly 2.8.0 - 'description' Stored Cross-Site Scripting XSS Authors: @nu11secur1ty & G.Dzhankushev Date: 04.15.2021 Vendor Homepage: https://www.htmly.com/ Software Link: https://github.com/danpros/htmly CVE: CVE-2021-30637 !/usr/bin/python3 from selenium import webdriver from...

CVE-2021-30637

htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php...

CVE-2021-30637

htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php...

CVE-2021-30637

htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php...

Cross site scripting

htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php...

CVE-2021-30637

htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php...

CVE-2021-30637

CVE-2021-30637 affects htmly 2.8.0, allowing stored XSS via the blog title, Tagline, or Description submitted to config.html.php. The root cause is unescaped user input stored and later reflected, enabling script execution in affected pages. Public writeups and exploits exist (e.g., PacketStorm/E...

CVE-2021-30637

htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php...

PT-2021-18780

Name of the Vulnerable Software and Affected Versions htmly version 2.8.0 Description The issue allows stored XSS via the blog title, Tagline, or Description to config.html.php. This can be exploited to inject malicious scripts into the application. Recommendations For htmly version 2.8.0, as a...

HTMLy 跨站脚本漏洞

HTMLy is a PHP-based open source blogging platform. A cross-site scripting vulnerability exists in htmly 2.8.0, which originates from config.html.php...

CVE-2021-30637: Improper Neutralization of Input During Web Page Generation

htmly 2.8.0 allows stored XSS via the blog title, Tagline, or Description to config.html.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in HTMLy 2.7.4 allow remote attackers to inject arbitrary web script or HTML via the 1 destination parameter to delete feature; the 2 destination parameter to edit feature; 3 content parameter in the profile feature...