Design/Logic Flaw

gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require'childprocess'.execFile substring in the onerror attribute of an IMG element...

CVE-2019-9785

gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require'childprocess'.execFile substring in the onerror attribute of an IMG element...

CVE-2019-9785: Improper Neutralization of Special Elements used in an OS Command

gitnote 3.1.0 allows remote attackers to execute arbitrary code via a crafted Markdown file, as demonstrated by a javascript:window.parent.top.require'childprocess'.execFile substring in the onerror attribute of an IMG element...

PT-2019-19871

Name of the Vulnerable Software and Affected Versions gitnote version 3.1.0 Description The issue allows remote attackers to execute arbitrary code via a crafted Markdown file. This can be achieved by including a specific substring in the onerror attribute of an IMG element, such as...

Cross site scripting

admin/?/plugin/filemanager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element...

CVE-2018-20778

admin/?/plugin/filemanager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element...

CVE-2018-20778: Improper Neutralization of Input During Web Page Generation

admin/?/plugin/filemanager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element...

Design/Logic Flaw

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with and characters, which is mishandled during construction of an A element...

CVE-2018-19057

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with and characters, which is mishandled during construction of an A element...

CVE-2018-19057

CVE-2018-19057 affects SimpleMDE 1.11.2. The vulnerability is a cross-site scripting (XSS) issue triggered by an onerror attribute on a crafted IMG element, or by certain input containing [ and ( characters, which is mishandled during the construction of an A element. The issue is described acros...

PT-2018-14772

Name of the Vulnerable Software and Affected Versions SimpleMDE version 1.11.2 Description The issue concerns a mishandling of certain input characters, specifically and , during the construction of an A element, and an onerror attribute of a crafted IMG element. This can lead to XSS...

CVE-2018-19057: Improper Neutralization of Input During Web Page Generation

SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with and characters, which is mishandled during construction of an A element...

GHSA-5C66-X4WM-RJFX Cross-site scripting (XSS) vulnerability in the user-profile biography section in DotNetNuke (DNN)

Cross-site scripting XSS vulnerability in the user-profile biography section in DotNetNuke DNN before 8.0.1 allows remote authenticated users to inject arbitrary web script or HTML via a crafted onclick attribute in an IMG element...

CVE-2018-16330

Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element...

Cross site scripting

Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element...

CVE-2018-16330

Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element...

CVE-2018-16330

Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element...

PT-2018-13493

Name of the Vulnerable Software and Affected Versions Pandao Editor.md version 1.5.0 Description The issue allows for XSS attacks through crafted attributes of an invalid IMG element. Recommendations For version 1.5.0, update to a newer version that contains a fix for this issue...

CVE-2018-16330: Improper Neutralization of Input During Web Page Generation

Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element...

CVE-2018-14399

libs\classes\attachment.class.php in PHPCMS 9.6.0 allows remote attackers to upload and execute arbitrary PHP code via a .txt?.php.jpg URI in the SRC attribute of an IMG element within infocontent JSON data to the index.php?m=member&c=index&a=register URI...