Cross-site Scripting (XSS)

typo3/cms is vulnerable to Cross-site Scripting XSS. The content rendering process does not sanitize user input, allowing a malicious user to inject and execute arbitrary script...

Cross-site Scripting (XSS) - Reflected in erudika/scoold

✍️ Description It occurs when a malicious script is injected directly into a vulnerable web application. Reflected XSS involves the reflecting of a malicious script off of a web application, onto a user's browser. 🕵️‍♂️ Proof of Concept...

Cross Site Scripting (XSS)

intelliants/subrion is vulnerable to cross-site scripting. An attacker is able to inject and execute a malicious script by adding a blog and then editing an image file...

Cross-site Scripting(XSS)

videojs is vulnerable to cross-site scripting. An attacker is able to inject and execute malicious script via rc attribute of track tag...

GitLab: Stored-XSS in merge requests

Summary As an attacker I could do XSS on Web.com because it is vulnerable Stored XSS, also known as persistent XSS, is more damaging than non-persistent XSS. It occurs when a malicious script is injected directly into a vulnerable web application. Steps to reproduce 1. Go to https://gitlab.com/ 2...

REvil Ransomware gang behind the Kaseya VSA Supply-Chain attack

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. The REvil ransomware group was successful in carrying out a supply chain attack by exploiting the zero-day vulnerability CVE-2021-30116 in the Kaseya VSA server and delivering a malicious script to all the computer devices...

Cross-site Scripting (XSS)

lavalite/cms is vulnerable to cross-site scripting. An attacker is able to inject and execute malicious script via "New" parameter of "Roles & Permissions" feature in /admin/roles/role component...

Cross-site Scripting (XSS) - Stored in bigprof-software/online-invoicing-system

✍️ Description There is a Stored XSS in the online invoicing system view price history which is lead by adding invoice items. 💥 TESTED VERSION https://github.com/bigprof-software/online-invoicing-system/releases/tag/v5.0 🕵️‍♂️ Proof of Concept POC Video:...

CVE-2021-21084

AEM's Cloud Service offering, as well as versions 6.5.7.0 and below, 6.4.8.3 and below and 6.3.3.8 and below are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be...

U.S. Dept Of Defense: RXSS ON https://██████████

Description: Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differe...

Cross-site Scripting (XSS)

react-bootstrap-table is vulnerable to cross-site scripting. Lack of sanitization of output from the function dangerouslySetInnerHTML allows an attacker to inject and execute malicious script in a user's browser via the dataFormat parameter when an invalid React element is returned...

Cross-site Scripting (XSS)

mongo-express is vulnerable to cross-site scripting. An attacker is able to inject and execute malicious script via a string property of documents when only preview is loaded...

U.S. Dept Of Defense: XSS Reflected - ██████████

Hi Team, I found a XSS Reflected. https://██████████/███onload=%22prompt1 Thanks DRauschkolb Impact XSS vulnerabilities can be used to trick a web user into executing a malicious script, potentially revealing a user's web session information or modify web content & even steal cookies. System Host...

Cross-site Scripting (XSS)

Overview apexcharts is a modern JavaScript charting library to build interactive charts and visualizations with simple API. Affected versions of this package are vulnerable to Cross-site Scripting XSS. This is the same vulnerability as CVE-2021-23327, which was reintroduced as a regression in...

Cross-site Scripting (XSS)

tinymce is vulnerable to cross-site scripting XSS. The vulnerability exists as the URLs were not correctly filtered in some cases, allowing an attacker to inject malicious script...

Cross-site Scripting (XSS)

productscmfcore, productspluggableauthservice and plone are vulnerable to cross-site scripting. An attacker is able to inject malicious script through unsanitized user-provided arguments...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting. An attacker is able to inject malicious script in Mustache helper tags included in the Mustache templates via recursive rendering from contexts...

MTN Group: Cross-Site Request Forgery (CSRF) to xss

hello dear support i have found csrf to xss on https://dailydeals.mtn.co.za/index.cfm?GO=DEALS URL:https://dailydeals.mtn.co.za/index.cfm?GO=DEALS URL encoded POST input CFID was set to fbe8c86c-c0b2-4421-8ca2-dcfc14763d6e" HTTP request ============ POST /index.cfm?GO=DEALS HTTP/1.1 Host:...

HackerOne: Stored XSS in IE11 on hackerone.com via custom fields

Hi There, i found stored xss via Custom Fields F1275694 ---------------------------------- F1275691 POC: F1275692 Impact The attacker can use this issue to execute malicious script code in the victim user browser also redirect the victim user to malicious sites...

Cross-site Scripting (XSS)

gwtupload is vulnerable to cross-site scripting. An attacker is able to inject and execute malicious script in a user's browser via the name parameter of file upload functionality...