Design/Logic Flaw

openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number in the Saved Search Activity via the Name, Description, or Activity Number field...

WordPress Plugin Tutor LMS Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

openCRX Security Vulnerabilities

openCRX is an open source Crm software. A security vulnerability exists in openCRX version 5.2.0, which stems from an HTML injection vulnerability...

CVE-2024-0243 Server-side Request Forgery In Recursive URL Loader

With the following crawler configuration: python from bs4 import BeautifulSoup as Soup url = "https://example.com" loader = RecursiveUrlLoader url=url, maxdepth=2, extractor=lambda x: Soupx, "html.parser".text docs = loader.load An attacker in control of the contents of https://example.com could...

Liferay Portal 7.4.x < 7.4.3.4 Multiple Vulnerabilities

The version of Liferay Portal installed on the remote host is prior to 7.4.3.4. It is, therefore, affected by multiple vulnerabilities as referenced in the advisory. - The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pac...

CVE-2024-26151

The mjml PyPI package, found at the FelixSchwarz/mjml-python GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of FelixSchwarz/mjml-python who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input...

CVE-2024-26151 Potentially untrusted input is rendered as HTML in final output

The mjml PyPI package, found at the FelixSchwarz/mjml-python GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of FelixSchwarz/mjml-python who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input...

CVE-2024-26151 Potentially untrusted input is rendered as HTML in final output

The mjml PyPI package, found at the FelixSchwarz/mjml-python GitHub repo, is an unofficial Python port of MJML, a markup language created by Mailjet. All users of FelixSchwarz/mjml-python who insert untrusted data into mjml templates unless that data is checked in a very strict manner. User input...

CVE-2024-25873

Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2024-25875

A cross-site scripting XSS vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Undertitle text field...

Design/Logic Flaw

Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

Cross-site Scripting (XSS)

Liferay Portal is vulnerable to stored cross-site scripting. The vulnerability is due to the improper neutralization of input during web page generation which allows remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into the first/middle/last name te...

Cross-site Scripting (XSS)

Liferay Portal is vulnerable to Stored cross-site scripting XSS. The vulnerability is due to inadequate input validation, allowing remote authenticated users to inject arbitrary web script or HTML via a crafted payload into a document's “Title” text field...

Cross-site Scripting (XSS)

The Calendar module in Liferay Portal is vulnerable to Cross-site Scripting. The vulnerability is due to not escaping the user-supplied data in the default notification email template, which allows remote authenticated users to inject arbitrary web script or HTML via the title of a calendar event...

Cross-Site Scripting

Liferay portal is vulnerable to reflected cross-site scripting XSS. The vulnerability is due to insufficient input validation that allows remote attackers to inject arbitrary web script or HTML via a crafted payload into the “Blocked Email Domains” text field in the instance settings for Accounts...

Cross-Site Scripting

liferay portal is vulnerable to cross-site scripting XSS. The vulnerability is due to improper input validation in the portlet.js module of the Frontend JS library. This flaws allowing attackers to inject arbitrary web script or HTML via the anchor hash part of a URL...

Withdrawn Advisory: Kirby CMS HTML injection vulnerability

Withdrawn Advisory This advisory has been withdrawn because the vendor reports that some HTML formatting such as with an H1 element is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur. Original Advisory An HTML injection...

GHSA-QV4X-V2V4-F8P9 Withdrawn Advisory: Kirby CMS HTML injection vulnerability

Withdrawn Advisory This advisory has been withdrawn because the vendor reports that some HTML formatting such as with an H1 element is allowed, but there is backend sanitization such that the reporter's mentioned "injecting malicious scripts" would not occur. Original Advisory An HTML injection...

Cross-Site Scripting

liferay portal is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper validation of the filename of an attachment in the Message Board widget, allowing remote authenticated users to inject arbitrary web script or HTML...

CVE-2024-26482

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because some HTML formatting such as with an H1 element is allowed, but there is backend sanitization such that the reporter's mentioned "injecti...