CVE-2020-20269: Undefined Security Weakness

A specially crafted Markdown document could cause the execution of malicious JavaScript code in Caret Editor before 4.0.0-rc22...

CVE-2020-21147

RockOA V1.9.8 is affected by a cross-site scripting XSS vulnerability which allows remote attackers to send malicious code to the administrator and execute JavaScript code, because webmain/flow/input/modeemailmAction.php does not perform strict filtering...

PT-2021-11415

Name of the Vulnerable Software and Affected Versions: Wing FTP version 6.4.4 Description: A cross-site scripting XSS issue was found, allowing an arbitrary IFRAME element to be included in the help pages via a crafted link. This leads to the execution of arbitrary HTML and JavaScript in the user...

PT-2021-11003

Name of the Vulnerable Software and Affected Versions: MISP version 2.4.128 Description: A cross-site scripting XSS issue exists due to a lack of validation in the path parameter, allowing an attacker to execute malicious JavaScript code. This occurs in the SetHomePage function within the...

CVE-2020-23849

Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript...

Cross site scripting

Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript...

Krpano Panorama Viewer Cross-site Scripting Vulnerability

krpano Panorama Viewer is a software for viewing panorama files from the German company krpano. The software supports high-resolution images, interactive virtual roaming, custom-designed user interface, and other features. A cross-site scripting vulnerability exists in Krpano Panorama Viewer in...

DEBIAN-CVE-2020-8264

In actionpack gem = 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed in another page a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This...

U.S. Dept Of Defense: Stored XSS through name / last name on https://██████████/

Description: There is stored XSS Vulnerability on https://█████/██████ by rendering unsafe input being registered on the account name and last name. ███ Step-by-step Reproduction Instructions 1. Navigate to javascript...

Korzio Djv Command Injection Vulnerability

Korzio Djv is Korzio individual developers of a Javascript-based software used to dynamically verify the Json data format . A command injection vulnerability exists in versions prior to djv 2.1.4, which stems from the lack of proper validation of client-side data by the web application. An attack...

PT-2021-12713

Name of the Vulnerable Software and Affected Versions: MendixSSO versions 2.1.1 and earlier Description: The issue is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding in the openid handler, leading to a Cross-Site Scripting vulnerability via the...

PT-2021-11237

Name of the Vulnerable Software and Affected Versions: mdBook versions prior to 0.4.5 Description: The search feature of mdBook is affected by a cross-site scripting vulnerability, which could allow an attacker to execute arbitrary JavaScript code on a user's browser. This can be achieved by...

LimeSurvey cross-site scripting vulnerability (CNVD-2021-00893)

limesurvey is an open source online questionnaire program with many functions such as questionnaire design, modification, release, recovery and statistics. A cross-site scripting vulnerability exists in the "Quota" component of the "Survey" page in LimeSurvey 3.21.1. An attacker can exploit this...

CVE-2020-25799

LimeSurvey 3.21.1 is affected by cross-site scripting XSS in the Quota component of the Survey page. When the survey quota being viewed, e.g. by an administrative user, the JavaScript code will be executed in the browser...

Dell EMC Unisphere for PowerMax Cross-Site Scripting Vulnerability

Dell EMC Unisphere for PowerMax is a set of graphical management tools for PowerMax storage arrays from Dell DELL. A cross-site scripting vulnerability exists in Dell EMC Unisphere for PowerMax, which can be exploited by an attacker to trigger cross-site scripting in order to run JavaScript code ...

LimeSurvey cross-site scripting vulnerabilities

limesurvey is an open source online questionnaire program with many functions such as questionnaire design, modification, release, recovery and statistics. A cross-site scripting vulnerability exists in the "Quota" component of the "Survey" page in LimeSurvey 3.21.1. An attacker can exploit this...

CVE-2020-26296

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could execut...

CVE-2020-26287

HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an attacker can inject arbitrary "script" tags in HedgeDoc notes using mermaid diagrams. Our content security policy prevents loading scripts from most locations, but "www.google-analytics.com"...

PT-2020-16405

Name of the Vulnerable Software and Affected Versions HedgeDoc versions prior to 1.7.1 Description The issue allows an attacker to inject arbitrary script tags in HedgeDoc notes using mermaid diagrams. Although the content security policy prevents loading scripts from most locations,...

PT-2020-17379

Name of the Vulnerable Software and Affected Versions Pi-hole versions prior to 5.2.2 Description The DNS query log in Pi-hole is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the...