8982 matches found
CVE-2021-42841
Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the U...
Input validation
Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the U...
CVE-2021-42841
Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the U...
PT-2022-12546
Name of the Vulnerable Software and Affected Versions Vehicle Service Management System version 1.0 Description A Stored Cross Site Scripting XSS issue exists via the My Account Section in the login panel. This allows for malicious script execution. Recommendations For Vehicle Service Management...
CVE-2022-21650
Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...
CVE-2022-21650: Improper Neutralization of Input During Web Page Generation
Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after...
Cross-site Scripting (XSS) - Stored in erudika/scoold
Description The Schold is a Q&A/knowledge base platform written in Java. When writing a Q&A, you can use the markdown editor. So I tried to exploit the syntax to try an XSS attack. It seemed to validate javascript: on the backend. So I couldn't use it. However, according to RFC3986, the scheme ca...
Privoxy cross-site scripting vulnerabilities
Privoxy is a proxy server from the Privoxy team in the USA that does not cache web pages and comes with its own filtering features. It has advanced filtering features to enhance privacy, modify web data and HTTP headers, control access and remove advertisements and other annoying Internet...
DEBIAN-CVE-2021-38503
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...
CVE-2021-38503
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...
CVE-2021-38503
The iframe sandbox rules were not correctly applied to XSLT stylesheets, allowing an iframe to bypass restrictions such as executing scripts or navigating the top-level frame. This vulnerability affects Firefox 94, Thunderbird 91.3, and Firefox ESR 91.3...
CVE-2021-25520
Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet...
CVE-2021-25520
Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet...
CVE-2021-25520: Improper Input Validation
Insecure caller check and input validation vulnerabilities in SearchKeyword deeplink logic prior to Samsung Internet 16.0.2 allows unstrusted applications to execute script codes in Samsung Internet...
PT-2021-16710
Name of the Vulnerable Software and Affected Versions Samsung Internet versions prior to 16.0.2 Description The issue is related to insecure caller check and input validation vulnerabilities in the SearchKeyword deeplink logic. This allows untrusted applications to execute script codes in Samsung...
CVE-2021-43810: Improper Neutralization of Input During Web Page Generation
Admidio is a free open source user management system for websites of organizations and groups. A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter...
PT-2021-23950
Name of the Vulnerable Software and Affected Versions: Admidio versions prior to 4.0.12 Description: A cross-site scripting vulnerability is present in Admidio. The Reflected XSS vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this...
CVE-2021-23260
Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site...
PT-2021-24062
Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 15 versions prior to build 28035 Description: A cross-site scripting XSS issue was possible in notification pop-ups. This allowed for potential malicious script execution. The estimated number of potentially affected...
