PHPJabbers Car Rental 3.0 HTML Injection

Exploit Title: PHPJabbers Car Rental v3.0 - HTML Injection Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/car-rental-script/ Version: v3.0 Tested on: Windows 10, Windows 11, Linux...

Cross site scripting

A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...

CVE-2023-48881

A stored cross-site scripting XSS vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctypeadd&ajax=1&lang=cn...

Cross Site Scripting

github.com/mattermost/mattermost is vulnerable to Cross Site Scripting. The vulnerability is due to Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete. This allows an attacker to inject HTML to a victim's page by create a channel name...

CVE-2023-35075

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...

Hardcoded credentials

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...

CVE-2023-35075 HTML injection via channel autocomplete

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...

CVE-2023-35075 HTML injection via channel autocomplete

Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a victim's page by create a channel name that is valid HTML. No XSS is possible though...

CVE-2023-35075

CVE-2023-35075 : Mattermost webapp vulnerability where channel names set during autocomplete do not use innerText/textContent, enabling HTML injection into a victim’s page when a name contains HTML. The attack does not produce XSS according to the sources. Affected component is the Mattermost web...

PT-2023-25131 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue arises from Mattermost's failure to use innerText or textContent when setting the channel name in the webapp during autocomplete. This allows an attacker to inject HTML into a...

GLSA-202311-17 : phpMyAdmin: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202311-17 phpMyAdmin: Multiple Vulnerabilities - PhpMyAdmin 5.1.1 and before allows an attacker to retrieve potentially sensitive information by creating invalid requests. This affects the lang parameter, the pmaparameter, and the...

Cisco IP Phone Cross-Site Scripting Vulnerability

Cisco IP Phone is a hardware device from the American company Cisco Cisco. IP Phone that provides calling capabilities. Cisco IP Phones suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the web-based management...

CVE-2023-48301 Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clickin...

CVE-2023-48301 Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display name

Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1.3 of Nextcloud Server and Nextcloud Enterprise Server, an attacker could insert links into circles name that would be opened when clickin...

CVE-2023-48226

OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings for registration looks like validation is correct, a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for...

Design/Logic Flaw

OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings for registration looks like validation is correct, a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for...

CVE-2023-48226

OpenReplay OpenReplay 1.14.0 is affected by an HTML-injection vulnerability in the Name field under Account Settings. The root cause is lack of validation, permitting an attacker to craft emails that include injected HTML content for phishing/content spoofing. The description states that FullName...

CVE-2023-48226 OpenReplay HTML Injection vulnerability

OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings for registration looks like validation is correct, a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for...

CVE-2023-48226 OpenReplay HTML Injection vulnerability

OpenReplay is a self-hosted session replay suite. In version 1.14.0, due to lack of validation Name field - Account Settings for registration looks like validation is correct, a bad actor can send emails with HTML injected code to the victims. Bad actors can use this to phishing actions for...

Cross Site Scripting (XSS)

openCRX is vulnerable to Cross Site Scripting XSS. The vulnerability is due to a lack of validation in Create product name field, which allows an attacker to inject HTML into the application...