CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

DEBIAN-CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

Cross site scripting

DokuWiki before 2023-04-04a allows XSS via RSS titles...

UBUNTU-CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

CVE-2023-34408

CVE-2023-34408 affects DokuWiki prior to the 2023-04-04a release. The issue is an XSS in RSS titles (root cause: improper handling of RSS titles) that can impact users who view crafted RSS feeds. CVSSv3.1 base score 5.4 (Medium): Network attack vector, low attack complexity, privileges required: ...

PT-2023-24860 · Dokuwiki +1 · Dokuwiki +1

Name of the Vulnerable Software and Affected Versions: DokuWiki versions prior to 2023-04-04a Description: The issue allows for XSS via RSS titles. Recommendations: For versions prior to 2023-04-04a, update to a version released after 2023-04-04a to resolve the issue...

CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

Cross-site Scripting (XSS)

craftcms/cms is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the body.twig and links.twig due to the improper sanitization in the text attribute, which allows an attacker to inject and execute malicious javascript through the RSS feed...

CVE-2023-33195

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

Cross site scripting

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

GHSA-QPGM-GJGF-8C2X Craft CMS XSS in RSS widget feed

Summary A malformed RSS feed can deliver an XSS payload PoC Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss The XSS payload will be triggered by the title in tag Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f...

Craft CMS XSS in RSS widget feed

Summary A malformed RSS feed can deliver an XSS payload PoC Create an RSS widget and add the domain https://blog.whitebear.vn/file/rss-xss2.rss The XSS payload will be triggered by the title in tag Resolved in https://github.com/craftcms/cms/commit/b77cb3023bed4f4a37c11294c4d319ff9f598e1f...

PT-2023-24212 · Craft · Craft

Name of the Vulnerable Software and Affected Versions: Craft versions prior to 4.4.6 Description: A malformed RSS feed can deliver an XSS payload. The issue can be triggered by the title in the tag of an RSS feed. For example, creating an RSS widget and adding a malicious RSS feed can lead to the...

Cross-Site Scripting (XSS)

craftcms/cms is vulnerable to Cross-Site Scripting XSS. The vulnerability exists in the RSS widget because of a malformed title which allows an attacker to inject and execute arbitrary JavaScript...