16149 matches found
VulnCheck KEV: CVE-2019-17233
Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection...
CVE-2022-38210
There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser...
Design/Logic Flaw
There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victim’s browser...
Esri Portal For ArcGIS 跨站脚本漏洞
Esri Portal For ArcGIS is a component from Environmental Systems Research Institute Esri that allows maps, scenes, applications, and other geographic information to be shared with others within an organization. A security vulnerability exists in Esri Portal for ArcGIS version 10.9.1 and earlier,...
Patient ability to rewrite it's own documents leads to HTML injection
Description It looks like through the PUT request, a Patient can rewrite it's own document via the fullDocument JSON parameter. In this way a malicious user patient can't override the document form and rewrite his own, also injecting valid HTML code that the Doctor would be able to see. Proof of...
Stored HTML injection in Patient chat functionality
Description I've found out that it is possible to inject HTML code in Patient Chat functionality, which allows malicious code to be stored there and potentially affect the other chat users Proof of Concept - Login from the patient portal. I've used the demo instance here:...
Stored XSS in notes Title
Description Stored XSS Vulnerability was found while a user creates a new Note & Enter the Name for the Note. The Title of the Note gets directly rendered at "Note Map" Functionality which is leading to HTML injection and Cross site scripting stored & reflected every time the user opens the note...
Hardcoded credentials
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...
CVE-2022-40956
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...
CVE-2022-40956
When injecting an HTML base element, some requests would ignore the CSP's base-uri settings and accept the injected element's base instead. This vulnerability affects Firefox ESR 102.3, Thunderbird 102.3, and Firefox 105...
CVE-2022-40841
A cross-site scripting XSS vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payloads injected into the "htmlNodes" parameter...
U.S. Department of State: xss and html injection on ( https://labs.history.state.gov)
Possible XSS and HTML injection vulnerabilities were found on the website https://labs.history.state.gov through the "id" parameter, as user input was not sanitized and the website was using a vulnerable version of the jQuery library. Attackers could have exploited these vulnerabilities to execut...
CVE-2022-40434
Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page...
CVE-2022-40434
Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page...
Input validation
Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page...
SNMP location XSS vulnerability
Description By including some HTML in the "Location" field of the snmpd configuration of a managed device, an attacker can inject HTML into the LibreNMS "Devices" tab, which then gets rendered when the page is viewed. EDIT: I'm having difficulties developing a proper exploit for this beyond the...
Softr 跨站脚本漏洞
Softr is a no-code website builder from Softr, Inc. A cross-site scripting vulnerability exists in Softr version v2.0, which stems from the Name field of its Account page allowing an attacker to implement HTML injection...
CVE-2022-40434
Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page...
CVE-2022-40434
Softr v2.0 is affected by an HTML injection vulnerability in the Account page Name field. The CVE-2022-40434 entry indicates a high-severity issue (CVSS 3.1: 9.8, CRITICAL) with impact on confidentiality, integrity, and availability. The root cause is HTML injection via the Name field; exploitati...
