CVE-2018-7198

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...

CVE-2018-7198

CVE-2018-7198 affects October CMS up to version 1.0.431, specifically the RainLab Blog Plugin. It enables stored XSS by entering HTML on the Add Posts page, allowing a malicious payload to be stored and subsequently executed. The issue is documented across multiple sources (GHSA/OSV and exploit r...

CVE-2018-7198: Improper Neutralization of Input During Web Page Generation

October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page...

Multiple Cross-Site Scripting Vulnerabilities in MetalGenix GeniXCMS

MetalGenix GeniXCMS is a PHP-based content management system and framework CMSF from MetalGenix Indonesia, which provides modules for user management, content management and menu management. A cross-site scripting vulnerability exists in MetalGenix GeniXCMS version 0.0.3. The vulnerability exists...

CVE-2015-5066

Multiple cross-site scripting XSS vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 content or 2 title field in an add action in the posts page to index.php or the 3 q parameter in the posts page to index.php...

CVE-2015-5066

Multiple cross-site scripting XSS vulnerabilities in the MetalGenix GeniXCMS 0.0.3 allow remote attackers to inject arbitrary web script or HTML via the 1 content or 2 title field in an add action in the posts page to index.php or the 3 q parameter in the posts page to index.php...

Code injection

The Drupal Project module before 5.x-1.0, 4.7.x-2.3, and 4.7.x-1.3 and Project issue tracking module before 5.x-1.0, 4.7.x-2.4, and 4.7.x-1.4 do not properly enforce permissions, which allows remote attackers to 1 obtain sensitive via the Tracker Module and the Recent posts page; 2 obtain project...