Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to inject arbitrary web script or HTML into various locations...

HTML Injection in Froxlor

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags. Note: Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protectio...

GHSA-J739-GW6Q-F4C7 HTML Injection in Froxlor

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags. Note: Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protectio...

CVE-2020-29653

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags...

CVE-2020-29653

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags...

CVE-2020-29653

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags...

CVE-2020-29653

CVE-2020-29653 affects Froxlor up to version 0.10.22. The issue arises from lack of validation for the customermail GET parameter, whose value is reflected on the login page, allowing injection of arbitrary HTML tags (HTML injection / cross-site scripting). The available connected documents confi...

CVE-2022-27156

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection...

CVE-2022-27156

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection...

Design/Logic Flaw

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection...

CVE-2022-27156

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection...

CVE-2022-27156

CVE-2022-27156 affects Daylight Studio Fuel CMS 1.5.1 and is described as vulnerable to HTML Injection. Public references in sources like NVD/Red Hat/CVE.org reiterate the affected product and vulnerability type; some connected entries (CNNVD) note the CMS is CodeIgniter-based. The initial data p...

CVE-2022-27156

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection...

Automattic: XSS and HTML Injection on the pressable.com search box

Summary: Hi, I have found that search box on pressable.com is vulnerable for XSS attack and HTML Injection . Steps To Reproduce: 1. Visit https://pressable.com/knowledgebase/ 2. Put the payload on the search box. XSS Payload: " HTML Injection Payload: Visit Our New WebSite e x a m p l e . c o m...

Daylight Studio Fuel CMS跨站脚本漏洞

Daylight Studio Fuel CMS is a CodeIgniter-based content management system. A security vulnerability exists in Daylight Studio Fuel CMS 1.5.1 that allows HTML injection attacks...

Acronis: HTML Injection in E-mail

Hello Gents, + While testing "account.acronis.com", I found that "first name" could be injected with HTML tags while sending an email invitation. But this attack requires user interaction to confirm the email first, then he/she will receive a welcome email "Welcome to your Acronis Cyber Protect...

CVE-2022-24229

The CVE-2022-24229 entry describes an XSS vulnerability in ONLYOFFICE Document Server Example prior to version 7.0.0. The affected component/path is the example editor endpoint (/example/editor), allowing remote attackers to inject arbitrary HTML or JavaScript. The issue is tied to an external we...

Cross site scripting

Social Codia SMS v1 was discovered to contain a stored cross-site scripting XSS vulnerability via addpost.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field...

CVE-2022-27348

CVE-2022-27348 affects Social Codia SMS v1 (inventory management system). The connected documents confirm a stored cross-site scripting (XSS) vulnerability in add_post.php, where an attacker can inject a crafted payload into the Post Title text field to execute arbitrary web scripts/HTML. Root ca...