ElegantThemes (Divi, Extra, divi-builder) - Authenticated Stored Cross-Site Scripting (XSS)

Description A privilege escalation vulnerability was discovered that could allow low level users, such as Authors, to use unfiltered HTML inside of post content when using the Divi Builder. Using such code in posts is typically reserved for admins...

WS-2017-3779

In Sakai, versions 12.0 through 12.7 are vulnerable to stored Cross-Site Scripting XSS, due to user input not sanitized in Commons' post content, before rendered by the browser when viewing the post. An attacker could run arbitrary javascript code on other users' browsers...

CVE-2017-9336

The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post...

PT-2017-18851

Name of the Vulnerable Software and Affected Versions WP Editor.MD plugin version 1.6 Description The issue is related to a stored XSS vulnerability in the content of a post. Recommendations For WP Editor.MD plugin version 1.6, update to a newer version that contains a fix for this issue...

PT-2017-18852

Name of the Vulnerable Software and Affected Versions Markdown on Save Improved plugin version 2.5 for WordPress Description The issue is related to a stored XSS vulnerability in the content of a post. Recommendations For Markdown on Save Improved plugin version 2.5, update to a newer version tha...

CVE-2017-9336: Improper Neutralization of Input During Web Page Generation

The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post...

cnvs Canvas Cross-Site Scripting Vulnerability

cnvs.io Canvas is a blog publishing platform. An XSS cross-site scripting vulnerability exists in the title and content fields of the "Posts Add New" action and during the creation of new tags and users in Canvas, which can be exploited by attackers to steal sensitive information such as cookies...

MyBB Cross-Site Scripting Vulnerability (CNVD-2017-05600)

MyBB is a popular web-based very good free forum software developed with PHP and MySQL. A cross-site scripting vulnerability exists in versions of MyBB prior to 1.8.11, which allows remote attackers to inject arbitrary web script or HTML via the content of a post...

WordPress REST API Plugin Content Injection Vulnerability

WordPress is a free and open source blogging software and content management system that uses PHP and MySQL as its platform. A content injection vulnerability exists in the WordPress REST API plugin. A remote attacker can exploit the vulnerability to elevate privileges or perform content injectio...

MyBB Cross-Site Scripting Vulnerability (CNVD-2015-05800)

MyBB is a popular web-based very good free forum software developed with PHP and MySQL. A cross-site scripting vulnerability exists in versions of MyBB prior to 1.8.5, which allows remote attackers to inject arbitrary web script or HTML via the content of a post...

GetSimple CMS suffers from multiple cross-site scripting vulnerabilities (CNVD-2015-04182)

GetSimple CMS is an XML-based content management system CMS from Cagintranet Networks, USA. The system includes a theme selector and editor, component editor, image and file managers, and more. A cross-site scripting vulnerability exists in Cagintranet Networks GetSimple CMS versions prior to...

CVE-2015-5355

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 post-content or 2 post-title parameter to admin/edit.php...

PT-2015-6862

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions prior to 3.3.6 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerable parameters are...

CVE-2015-5355: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 post-content or 2 post-title parameter to admin/edit.php...

Novell ZENworks Configuration Management Remote Management Component Directory Traversal Vulnerability

Novell ZENworks Configuration Management is a suite of configuration management solutions.Remote Management is a remote management component. A directory traversal vulnerability exists in the UploadServlet in the Remote Management component of Novell ZCM, which can be exploited by a remote attack...

Qi Bo CMS variable coverage leads to sql injection vulnerability analysis report-vulnerability warning-the black bar safety net

Blog post author: Alibaba security research lab—supporting su Release date: 2015-3-10 Blog post content: The recent Alibaba security research laboratory vulnerability monitoring system to monitor attendance Bo cms exist high-risk vulnerabilities that can lead to SQL vulnerability and thus affect...

WordPress 3.5 - Shortcodes / Post Content Multiple Unspecified XSS

...

Thinksaas SQL注入#3

简要描述： Thinksaas SQL注入3 详细说明： 在Thinksaas 的小组功能处，发完贴后，可以补贴。 在编辑补贴时，过滤不完整，导致SQL注入，直接可以注入出数据，显示到帖子内容中。 /app/group/action/after.php文件，在边编辑补贴内容时： //编辑执行 case "edo": if$POST'token' != $SESSION'token' tsNotice'非法操作！'; $afterid = intval$POST'afterid'; $strAfter = $new'group'-find'grouptopicadd',array...

Hewlett-Packard (HP) 2620 Switch Series. Edit Admin Account - Cross-Site Request Forgery

Hewlett-Packard HP 2620 Switch Series. Edit Admin Account - Cross-Site Request Forgery Exploit Title: Hewlett-Packard 2620 Switch Series. Edit Admin Account - CSRF Vulnerability Date: 26.09.2013r. Exploit Author: Hubert GrÄ…dek PL Software Link: download link if available Tested on: HP-E2620...

Hewlett-Packard (HP) 2620 Switch Series. Edit Admin Account - Cross-Site Request Forgery

Exploit Title: Hewlett-Packard 2620 Switch Series. Edit Admin Account - CSRF Vulnerability Date: 26.09.2013r. Exploit Author: Hubert GrÄ…dek PL Software Link: download link if available Tested on: HP-E2620 24-PoEP // RA.15.05.0006,ROMRA.15.10 HTTP Headers: http://IPADDR/html/json.html Host: IPADD...