The vulnerability of the XML DOM implementation lies in the lack of mechanisms for encoding or escaping output data, allowing attackers to compromise the integrity of the data.

The vulnerability of the XML DOM implementation is related to improper filtering of special characters. Exploiting this vulnerability allows an attacker to compromise data integrity remotely...

Money Transfer Management System 跨站脚本漏洞

A cross-site scripting vulnerability exists in Money Transfer Management System version 1.0, a money transfer management system. The vulnerability stems from the program's lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to execute...

CVE-2021-23283

Eaton Intelligent Power Protector IPP prior to version 1.69 is vulnerable to stored Cross Site Scripting. The vulnerability exists due to insufficient validation of user input and improper encoding of the output for certain resources within the IPP software...

Cross-site Scripting (XSS) - Stored in alanaktion/phproject

Description Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. Then, the vulnerability can be triggered when the user previews the document´s content. Proof of Concept login and navigate task Dependencies This task depends on: This task is a...

WordPress plugin 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. WordPress Learning Courses plugin in versions prior to 5.0 contains a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output. An...

The vulnerability of the URI module in the Ansible configuration management system arises from a lack of mechanisms for encoding or shielding output data, allowing attackers to access confidential information.

The vulnerability of the Ansible configuration system’s module module relates to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability can allow attackers to access confidential data...

CVE-2022-22529

SAP Enterprise Threat Detection ETD - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly exploit XSS vulnerability. The UIs in ETD are using SAP UI5 standard controls, the UI5 framework provides automated output encoding for its...

Design/Logic Flaw

SAP Enterprise Threat Detection ETD - version 2.0, does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly exploit XSS vulnerability. The UIs in ETD are using SAP UI5 standard controls, the UI5 framework provides automated output encoding for its...

PT-2022-15498

Name of the Vulnerable Software and Affected Versions SAP Enterprise Threat Detection ETD version 2.0 Description The issue arises from insufficient encoding of user-controlled inputs, potentially leading to an unauthorized attacker exploiting an XSS vulnerability. However, the UIs in ETD utilize...

Cross-site Scripting (XSS) - Generic in projectsend/projectsend

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a differen...

Cross-site Scripting (XSS) - Stored in yetiforcecompany/yetiforcecrm

Description I found file upload XSS, Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. Proof of Concept 1. login and navigate to https://gitstable.yetiforce.com/index.php?module=Users&view=PreferenceEdit&record=5 2. Layout photo Add file. 3...

Cross-site Scripting (XSS) - Stored in tsolucio/corebos

Description Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. This vulnerability can be exploited by uploading a crafted payload inside a document. Proof of Concept https://demo.corebos.com/index.php?module=Users&action=index&parenttab=Settin...

WordPress 跨站脚本漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL.The WordPress Testimonial plugin has a cross-site scripting vulnerability in versions prior to 1.6.0,...

Cross-site Scripting (XSS) - Stored in siwapp/siwapp

Description Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. This vulnerability can be exploited by uploading a crafted payload inside a document. Then, the vulnerability can be triggered when the user previews the document´s content. Proof ...

The vulnerability of the ExponentCMS content management system lies in the lack of mechanisms for encoding or shielding output data, allowing attackers to compromise the integrity of the protected information.

The vulnerability of the ExponentCMS content management system is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to influence the integrity of the protected information by modifying the HTTP headers...

PT-2021-6751 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.1 through 14.1.2 GitLab CE/EE version 14.0.7 GitLab CE/EE version 13.12.9 Description: The issue is related to a lack of proper output encoding or escaping in GitLab, a platform for collaborative code development. Und...

Cross-site Scripting (XSS) - Stored in poowf/invoiceneko

✍️ Description Stored Cross-Site Scripting XSS vulnerability due to the lack of content validation and output encoding. This vulnerability can be exploited by uploading a crafted payload inside a document. Then, the vulnerability can be triggered when the user previews the document´s content...

PT-2021-6572 · Mongodb +1 · Mongodb Server +2

Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to 3.6.20 MongoDB Server versions prior to 4.0.21 MongoDB Server versions prior to 4.2.10 Description: The issue is related to a lack of output encoding or escaping in MongoDB, allowing a remote attacker to impac...

CVE-2021-27659

exacqVision Web Service 21.03 does not sufficiently validate, filter, escape, and/or encode user-controllable input before it is placed in output that is used as a web page that is served to other users...

PT-2021-14556 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS for ABAP Web Survey versions 700 through 75F Description: The issue arises from insufficient encoding of input and output parameters, leading to a reflected cross-site scripting vulnerability. This allows a malicious user to...