CVE-2024-6052

Stored XSS in Checkmk before versions 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 EOL allows users to execute arbitrary scripts by injecting HTML elements...

CVE-2024-6052

CVE-2024-6052 describes a stored XSS in Checkmk affecting versions prior to 2.3.0p8, 2.2.0p29, 2.1.0p45, and 2.0.0 (EOL). The vulnerability arises in Checkmk’s web application where HTML elements injected by an attacker can execute arbitrary scripts. The connected documents consistently identify ...

PT-2024-37347 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0p8 Checkmk versions prior to 2.2.0p29 Checkmk versions prior to 2.1.0p45 Checkmk version 2.0.0 Description: The issue allows users to execute arbitrary scripts by injecting HTML elements, which can lead to the...

CVE-2024-39248

SimpCMS v0.1 is affected by an XSS in the Title field at /admin.php. Root cause cited across sources is lack of proper filtering/escaping of user input, enabling arbitrary web script or HTML execution. Impacted functionality is the admin input for the Title, with the potential for full script exe...

CVE-2024-39143

A stored cross-site scripting XSS vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to create malicious property content with HTML inside which acts as a stored XSS payload...

WordPress Photo Gallery by Ays plugin < 5.7.1 - HTML Injection vulnerability

HTML Injection vulnerability discovered by Ibnu Ubaeydillah Patchstack Alliance in WordPress Plugin Photo Gallery by Ays versions 5.7.1...

CVE-2024-5737

Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default text/html is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0...

CVE-2024-5737 HTML Injection in AdmirorFrames Joomla! Extension

Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default text/html is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0...

EUVD-2024-46898

Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default text/html is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0...

CVE-2024-5737 HTML Injection in AdmirorFrames Joomla! Extension

Script afGdStream.php in AdmirorFrames Joomla! extension doesn’t specify a content type and as a result default text/html is used. An attacker may embed HTML tags directly in image data which is rendered by a webpage as HTML. This issue affects AdmirorFrames: before 5.0...

Mars: Reflected HTML Injection via contact (faq) search parameter on ███]=

The reflected HTML injection vulnerability was identified in the search parameter of the contact FAQ page on ███████. The vulnerability allowed for the injection and execution of arbitrary HTML and script code in the context of other users' web browsers. The issue was demonstrated through the...

CVE-2024-25637

CVE-2024-25637 affects October CMS (Laravel-based). The X-October-Request-Handler header can reflect unescaped HTML, enabling a reflected XSS scenario. Affected versions are prior to 3.5.15; patch released in 3.5.15. Practical exploitation is described as requiring proxy interception (not externa...

WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability

HTML Injection vulnerability discovered by Sandeep Vishwakarma from eSec Forte Technologies Pvt Ltd. Patchstack Alliance in WordPress Plugin WP Directory Kit versions = 1.3.6...

CVE-2024-28832

Stored XSS in the Crash Report page in Checkmk before versions 2.3.0p7, 2.2.0p28, 2.1.0p45, and 2.0.0 EOL allows users with permission to change Global Settings to execute arbitrary scripts by injecting HTML elements into the Crash Report URL in the Global Settings...

CVE-2024-28831

Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML elements into some user input fields that are shown in a confirmation pop-up...

CVE-2024-28831 XSS in confirmation pop-up

Stored XSS in some confirmation pop-ups in Checkmk before versions 2.3.0p7 and 2.2.0p28 allows Checkmk users to execute arbitrary scripts by injecting HTML elements into some user input fields that are shown in a confirmation pop-up...

CVE-2024-28831

CVE-2024-28831 describes a stored XSS in Checkmk’s confirmation pop-ups prior to versions 2.3.0p7 and 2.2.0p28. The issue allows a user to inject HTML into inputs shown in confirmation dialogs, enabling execution of arbitrary scripts within affected Checkmk installations. The provided sources ide...

CVE-2022-38055 WordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in gVectors Team wpForo Forum allows Content Spoofing.This issue affects wpForo Forum: from n/a through 2.0.9...

CVE-2022-38055 WordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in gVectors Team wpForo Forum allows Content Spoofing.This issue affects wpForo Forum: from n/a through 2.0.9...

CVE-2024-30848

CVE-2024-30848 affects SilverSky E-mail service, version 5.0.3126. A cross-site scripting (XSS) flaw allows remote attackers to inject arbitrary web script or HTML via the version parameter. Publicly available sources (NVD/Red Hat/CNNVD) corroborate the same description. The documents do not spec...