CVE-2023-40812

CVE-2023-40812 affects OpenCRX 5.2.0 and is caused by insufficient input sanitization in the Accounts Group Name Field , enabling HTML injection . Multiple connected sources corroborate the vulnerability and its impact; exploit details are not provided in the documents. The CVSS v3.1 base score i...

CVE-2023-40813

OpenCRX 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation due to insufficient input sanitization in the related component. Several sources (Veracode, GHSA, OSV, CNNVD, NVD) indicate this is an XSS-style issue with a CVSSv3.1 base score of 6.1 (Medium) and user interaction r...

CVE-2023-40810

OpenCRX is affected by CVE-2023-40810: OpenCRX version 5.2.0 is vulnerable to HTML injection (XSS) via the Product Name field. The vulnerability is described across multiple sources as an HTML injection/XSS flaw in the product name input, which can lead to HTML content being injected into the app...

PT-2023-27653 · Opencrx · Opencrx

Name of the Vulnerable Software and Affected Versions: OpenCRX version 5.2.0 Description: The issue allows for HTML injection via the Activity Milestone Name Field, which could potentially lead to malicious code execution. Recommendations: For OpenCRX version 5.2.0, update to a newer version that...

PT-2023-27654 · Opencrx · Opencrx

Name of the Vulnerable Software and Affected Versions: OpenCRX version 5.2.0 Description: The issue allows for HTML injection via the Product Configuration Name Field. Recommendations: For OpenCRX version 5.2.0, update to a version that fixes this issue, if available. As a temporary workaround,...

CVE-2023-40815

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field...

PT-2023-27648 · Opencrx · Opencrx

Name of the Vulnerable Software and Affected Versions: OpenCRX version 5.2.0 Description: The issue allows for HTML injection via the Product Name Field. Recommendations: For OpenCRX version 5.2.0, update to a version that fixes this issue. At the moment, there is no information about a newer...

CVE-2023-40809

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number...

CVE-2023-40814

OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field...

CVE-2023-44355 ColdFusion | Improper Input Validation (CWE-20)

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to impact a minor integrity feature. Exploitation of this...

CVE-2023-47797

Reflected cross-site scripting XSS vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the plbackurltitle parameter...

CVE-2023-47797

Reflected cross-site scripting XSS vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the plbackurltitle parameter...

XWiki < 14.10.12, 15.0-rc-1 < 15.5 Multiple Vulnerabilities

Xwiki is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:xwiki:xwiki"; ifdescription...

CVE-2023-48199

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy = 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker...

CVE-2023-48199

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy = 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker...

Design/Logic Flaw

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy = 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker...

CVE-2023-48199

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy = 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker...

PT-2023-30724 · Grocy · Grocy

Name of the Vulnerable Software and Affected Versions: Grocy versions prior to 4.0.4 Description: The issue allows attackers to inject arbitrary HTML content without script execution, occurring when user-supplied data is not properly sanitized. This enables the injection of HTML tags through...

CVE-2023-48199

HTML Injection vulnerability in the 'manageApiKeys' component in Grocy = 4.0.3 allows attackers to inject arbitrary HTML content without script execution. This occurs when user-supplied data is not appropriately sanitized, enabling the injection of HTML tags through parameter values. The attacker...

golang: html/template: improper sanitization of CSS values

A flaw was found in golang where angle brackets were not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character could result in the CSS context unexpectedly closing, allowing for the injection of unexpected HMTL if...