CVE-2016-9407

Cross-site scripting XSS vulnerability in MyBB aka MyBulletinBoard before 1.8.7 and MyBB Merge System before 1.8.7 might allow remote attackers to inject arbitrary web script or HTML via vectors involving Mod control panel logs...

CVE-2017-5018

Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, had an insufficiently strict content security policy on the Chrome app launcher page, which allowed a remote attacker to inject scripts or HTML into a privileged page via a crafted HTML page...

Ghost 'Your profile' page HTML injection vulnerability

Ghost is an open source, controlled platform for building and running modern online publishing. Ghost suffers from an HTML injection vulnerability that stems from a failure to adequately validate user input. An attacker could use this vulnerability to execute specially crafted HTML and script cod...

Algolia: [github.algolia.com] DOM Based XSS github-btn.html

Description === Vulnerable parameter: user Vulnerable script: https://github.algolia.com/github-btn.html Vulnerable code: js var params = function for var t, e = , o = window.location.href.slicewindow.location.href.indexOf"?" + 1.split"&", r = 0; r HTMLHTMLHTMLHTMLHTMLHTML&type=follow PoC 2 XSS f...

CVE-2017-5553

Cross-site scripting XSS vulnerability in plugins/markdownplugin/markdown.plugin.php in b2evolution before 6.8.5 allows remote authenticated users to inject arbitrary web script or HTML via a javascript: URL...

Ian Dunn: HTML injection-WordCamp Talks plugin

This report was about the possibility to inject malicious HTML into wp-admin via comments on the talks post type. Examples of malicious input were: The report suggested that those input could be used in phishing attacks, since the images would be displayed in wp-admin, where an administrator migh...

CVE-2014-2045

Multiple cross-site scripting XSS vulnerabilities in the old and new interfaces in Viprinet Multichannel VPN Router 300 allow remote attackers to inject arbitrary web script or HTML via the username when 1 logging in or 2 creating an account in the old interface, 3 username when creating an accou...

HTML Injection Vulnerability in Multiple EMC Products

EMC Documentum WebTop is a suite of products that allow users to access Documentum repositories and content management services in a standard browser application.Documentum Administrator is a set of Web-based development tools for performing Documentum system administration tasks. Documentum...

b2evolution Multiple XSS Vulnerabilities

b2evolution is prone to multiple cross-site scripting vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Design/Logic Flaw

Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

CVE-2016-5208

Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree during synchronous event handling, which allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page...

CVE-2016-5204

Removed by vendor...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bugs 104552 and 104703...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Zimbra Collaboration before 8.7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka bugs 103997, 104413, 104414, 104777, and 104791...

Cross site scripting

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name...

CVE-2016-7150

Cross-site scripting XSS vulnerability in b2evolution 6.7.5 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the site name...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the user forms in GeniXCMS through 0.0.8 allow remote attackers to inject arbitrary web script or HTML via crafted parameters...

VK.com: HTML Injection possible due to bad filter

Hello, I have found an area where it may be possible to run certain HTML/JS scripts. TO REPRODUCE: 1. Go to documents 2. Upload anything and edit it 3. On the edit page in tags, enter code without a closing bracket ex. img src=x 4. Click enter 5. It will be parsed in that area, but after saving i...

CVE-2017-5494

Multiple cross-site scripting XSS vulnerabilities in the file types table in b2evolution through 6.8.3 allow remote authenticated users to inject arbitrary web script or HTML via a .swf file in a 1 comment frame or 2 avatar frame...

Malware exploit: Soraya

Type: XSS Author: Xylitol import requests import time def StrToHexstring: hexstr='' for char in string: intchar = ordchar hexnum = hexintchar.lstrip"0x" hexstr+=hexnum return hexstr ConnectUrl = 'http://localhost/something/bot.php' UserString = 'rome0321' HtmlInject =...