16151 matches found
CVE-2022-36254
Multiple persistent cross-site scripting XSS vulnerabilities in index.php in tramyardg Hotel Management System 1.0 allow remote attackers to inject arbitrary web script or HTML via multiple parameters such as "fullname"...
html injection on https://demo.microweber.org/demo/search.php?keywords=
Description hello team, I found an HTML injection on https://demo.microweber.org/demo/search.php?keywords= Proof of Concept https://demo.microweber.org/demo/search.php?keywords=ABC%3Cdiv%20style=%22%3E%3Cmarquee%3E%3Ch1%3Eyou%20are%20been%20hacked%20%3C/h1%3E%3C/marquee%3E...
CVE-2022-36057 Discourse-Chat Cross-Site Scripting issue for channel names and descriptions
Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting XSS attack. Version 0.9 contains a patch for this issue...
Reflected XSS via POST
Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...
activemq-artemis: AMQ Broker web console HTML Injection
A security vulnerability was found in ActiveMQ Artemis. This flaw allows an attacker to show malicious content and redirect users to a malicious URL in the web console by using HTML in the name of an address or queue...
CVE-2022-36037
CVE-2022-36037 describes a cross-site scripting (XSS) flaw in Kirby CMS related to the Panel’s multiselect field. The vulnerability arises because Kirby 3.5 used HTML rendering for the raw option value, allowing attackers who can influence the options source (e.g., content of sibling pages or an ...
GHSA-3F89-869F-5W76 Cross-site scripting from dynamic options in the multiselect field
Introduction Cross-site scripting XSS is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Such...
Cross-site scripting from dynamic options in the multiselect field
Introduction Cross-site scripting XSS is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Such...
Cross site scripting
A cross-site scripting XSS vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit...
Cross site scripting
Edoc-doctor-appointment-system v1.0.1 was discovered to contain a stored cross-site scripting XSS vulnerability at /patient/settings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field...
Session fixation
The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's...
CVE-2022-37317
Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability. An authenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious code in the context of the web application. 6.10 P4 6.10.0.4 and 6.11 P2 HF4...
CVE-2022-37317
Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability. An authenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious code in the context of the web application. 6.10 P4 6.10.0.4 and 6.11 P2 HF4...
CVE-2022-37317
Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability. An authenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious code in the context of the web application. 6.10 P4 6.10.0.4 and 6.11 P2 HF4...
Design/Logic Flaw
Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability. An authenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious code in the context of the web application. 6.10 P4 6.10.0.4 and 6.11 P2 HF4...
CVE-2022-37317
Archer Platform 6.x before 6.11 P3 contain an HTML injection vulnerability. An authenticated remote attacker could potentially exploit this vulnerability by tricking a victim application user to execute malicious code in the context of the web application. 6.10 P4 6.10.0.4 and 6.11 P2 HF4...
CVE-2022-37317
Archer Platform 6.x prior to 6.11 P3 contains an HTML injection vulnerability. An authenticated remote attacker could exploit it by convincing a victim application user to execute malicious code in the web application's context. Affected releases mentioned include 6.11 P3 (and earlier 6.11.0.2.4 ...
CVE-2022-36527
CVE-2022-36527 affects Jfinal CMS v5.1.0. Multiple connected sources confirm a cross-site scripting (XSS) vulnerability where an attacker can inject arbitrary web scripts or HTML via a crafted payload into the post title text field under the publish blog module. The underlying issue is the handli...
GHSA-XC4W-28G8-VQM5 Path Traversal in Gravitee API Management
HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request...
Path Traversal in Gravitee API Management
HTML injection combined with path traversal in the Email service in Gravitee API Management before 1.25.3 allows anonymous users to read arbitrary files via a /management/users/register request...