Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields...

Cross site scripting

Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting XSS vulnerability in the devicename parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the devicename information...

SugarCRM Cross-site Scripting Vulnerability

Sugarcrm SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM Sugarcrm, USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and information sharing and tracking of sales representatives. SugarC...

Portable Ltd Playable: Code Injection Vulnerability

Portable Ltd Playable is a Full HD media player for Pc from Portable Ltd, UK. Portable Ltd Playable suffers from a code injection vulnerability that stems from Portable Ltd Playable v9.18 containing a code injection vulnerability in the filename parameter. An attacker could use this vulnerability...

PT-2021-11611

Name of the Vulnerable Software and Affected Versions: Perfex CRM version 2.4.4 Description: A stored cross-site scripting XSS issue was found in the ./clients/client component of Perfex CRM, specifically via the company name parameter. This allows for malicious script execution when the paramete...

Fork CMS cross-site scripting vulnerabilities

Fork CMS is an open source content management system CMS developed using PHP. The system contains blogs , questions and answers , forms and other modules . A cross-site scripting vulnerability exists in Fork CMS Content Management System version 5.8.0, which can be exploited by an attacker to...

Privilege Defined With Unsafe Actions in Keycloak

A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the...

PT-2021-16893

Name of the Vulnerable Software and Affected Versions Camaleon CMS versions 0.0.1 through 2.6.0 Description The issue allows an unauthenticated attacker or unprivileged application users to store malicious scripts in the comments section of a post. These scripts are executed in a victim's browser...

PT-2021-8345

Name of the Vulnerable Software and Affected Versions Rails versions prior to 3.0.6 Description A cross-site scripting issue was found in the auto link function. This affects the ability to properly handle user input, potentially leading to malicious script execution. Recommendations For versions...

Cross-site Scripting (XSS) - Stored in osticket/osticket

Description As it is written on github profile, osTicket is a widely-used open source support ticket system. During source code research I discovered bad uploaded file type check, which is controlled by user. Unauthenticated user can upload malicious html/js file. FROM OWASP:: Cross-Site Scriptin...

DEBIAN-CVE-2021-42013

It was found that the fix for CVE-2021-41773 in Apache HTTP Server 2.4.50 was insufficient. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default...

CVE-2020-21729: Improper Neutralization of Input During Web Page Generation

JEECMS x1.1 contains a stored cross-site scripting XSS vulnerability in the component of /member-vipcenter.htm, which allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

PT-2021-15569

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue allows an attacker to potentially execute scripts on a client's computer by sending a manipulated URL, exploiting a reflected XSS weakness in the web server. Recommendations: ...

Xiuno BBS Cross-Site Scripting Vulnerability

Xiuno BBS is an open source forum program based on PHP and MySQL. Xiuno BBS suffers from a cross-site scripting vulnerability that originates from the failure of the product/admin/?setting-base.htm page to properly handle data in the sitename field. An attacker can execute client-side code via th...

PT-2021-18098

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS affected versions not specified Description: A stored cross-site scripting XSS issue may allow a remote unauthenticated attacker to pass and store malicious strings in the home application. This could potentially lead t...

CVE-2020-20131

LaraCMS v1.0.1 contains a stored cross-site scripting XSS vulnerability which allows atackers to execute arbitrary web scripts or HTML via a crafted payload in the page management module...

CVE-2020-20131: Improper Neutralization of Input During Web Page Generation

LaraCMS v1.0.1 contains a stored cross-site scripting XSS vulnerability which allows atackers to execute arbitrary web scripts or HTML via a crafted payload in the page management module...

PT-2021-10437

Name of the Vulnerable Software and Affected Versions: LaraCMS version 1.0.1 Description: The issue is a stored cross-site scripting XSS vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the page management module. This enables attackers to...

LaraCms Cross-Site Scripting Vulnerability

LaraCms is a modern content management system in China. version 1.0.1 of LaraCMS contains a cross-site scripting vulnerability that can be exploited by attackers to execute arbitrary web scripts or HTML via specially crafted loads in the content editor...

Gila CMS Cross-Site Scripting Vulnerability (CNVD-2021-84285)

Gila CMS is an open source content management system CMS based on PHP and MySQL. Gila CMS suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary web script or HTML via a crafted payload in a markup field...