CVE-2022-29380

Academy-LMS v4.3 was discovered to contain a stored cross-site scripting XSS vulnerability in the SEO panel...

Cross site scripting

Academy-LMS v4.3 was discovered to contain a stored cross-site scripting XSS vulnerability in the SEO panel...

CVE-2022-29380

The connected records confirm CVE-2022-29380 affects Creativeitem Academy-LMS v4.3, with a stored cross-site scripting (XSS) vulnerability in the SEO panel. The root cause is described as a lack of data validation/filtering of user-supplied data and output in the SEO panel, enabling injection of ...

CVE-2022-29380

Academy-LMS v4.3 was discovered to contain a stored cross-site scripting XSS vulnerability in the SEO panel...

GHSA-W55X-Q3GV-PX85 InfluxDB Reflected Cross-site Scripting

InfluxDB 0.9.5 has Reflected XSS in the admin panel via the Write Data module...

InfluxDB Reflected Cross-site Scripting

InfluxDB 0.9.5 has Reflected XSS in the admin panel via the Write Data module...

GHSA-7XX3-QP5W-FW96 Cross-Site Request Forgery in JupyterHub

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an xsrf field, as demonstrated by a /hub/api/user request to add or remove a user account...

Cross-Site Request Forgery in JupyterHub

JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an xsrf field, as demonstrated by a /hub/api/user request to add or remove a user account...

Cross site scripting in Crafter CMS

In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel...

GHSA-38RQ-RH9W-CMW6 Cross site scripting in Crafter CMS

In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel...

GHSA-PWGG-R6FQ-MF94 YOURLS Stored Cross Site Scripting (XSS)

Multiple Stored Cross Site Scripting XSS vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues...

YOURLS Stored Cross Site Scripting (XSS)

Multiple Stored Cross Site Scripting XSS vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and upload it, resulting in multiple stored XSS issues...

GHSA-8F2X-HV9R-MH9R silverstripe-advancedreports vulnerable to XSS

silverstripe-advancedreports aka the Advanced Reports module for SilverStripe 1.0 through 2.0 is vulnerable to Cross-Site Scripting XSS because it is possible to inject and store malicious JavaScript code. The affects admin/advanced-reports/DataObjectReport/EditForm/field/DataObjectReport/item ak...

Magento defense-in-depth security mitigation vulnerability

Magento versions 2.3.4 and earlier, 2.2.11 and earlier see note, 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a defense-in-depth security mitigation vulnerability. Successful exploitation could lead to unauthorized access to admin panel...

GHSA-9HV8-4FRF-CPRF Grafana XSS via a column style

Grafana has a XSS vulnerability via a column style on the "Dashboard Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...

Grafana XSS via a column style

Grafana has a XSS vulnerability via a column style on the "Dashboard Table Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099...

Grafana XSS in header column rename

Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip...

GHSA-CCMG-W4XM-P28V Grafana XSS in header column rename

Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip...

Magento Cross-Site Scripting via admin panel

A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate downloadable link and cause an invocation of error handling that acceses user input without sanitization...

phpBB Cross-Site Request Forgery (CSRF)

In phpBB before 3.1.7-PL1, includes/acp/acpbbcodes.php has improper verification of a CSRF token on the BBCode page in the Administration Control Panel. An actual CSRF attack is possible if an attacker also manages to retrieve the session id of a reauthenticated administrator prior to targeting...