CVE-2021-37915: Undefined Security Weakness

An issue was discovered on the Grandstream HT801 Analog Telephone Adaptor before 1.0.29.8. From the limited configuration shell, it is possible to set the malicious gdbdebugserver variable. As a result, after a reboot, the device downloads and executes malicious scripts from an attacker-defined...

Tiki Wiki Cross-Site Scripting Vulnerabilities

Tiki Wiki is a Php-based wiki system for the Tiki community. A security vulnerability exists in TikiWiki v21.4 that allows an attacker to execute arbitrary web script or HTML via a crafted payload under the Create Category module...

Tiki Wiki Cross-Site Scripting Vulnerabilities

Tiki Wiki is a Php-based wiki system for the Tiki community. A security vulnerability exists in TikiWiki v21.4, which allows an attacker to execute arbitrary web script or HTML by adding a payload under the Events module...

Cisco Firepower Management Center cross-site scripting vulnerability

Cisco Firepower Management Center FMC is the next generation firewall management center software from Cisco. A security vulnerability exists in Cisco Firepower Management Center Software that stems from insufficient validation of user-supplied input in the web-based management interface. An...

PT-2021-12472

Name of the Vulnerable Software and Affected Versions: Movable Type Premium versions 1.37 and earlier Movable Type Premium Advanced versions 1.37 and earlier Description: A cross-site scripting issue allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. Thi...

PT-2021-20939

Name of the Vulnerable Software and Affected Versions: TIBCO Nimbus versions 10.4.0 and below Description: The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting XSS vulnerabilities. These vulnerabilities allow a low privileged...

CVE-2020-20908: Improper Neutralization of Input During Web Page Generation

Akaunting v1.3.17 was discovered to contain a stored cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Company Name input field...

Rocket.Chat: XSS in various MessageTypes

The Rocket.Chat vulnerability allowed arbitrary script execution in the receiving frontend client through the rendering of messages of various MessageTypes. The vulnerability affected versions 3.18.2 and 4.0.3. The issue was caused by the lack of sanitization of message parameters rendered from...

CVE-2020-36499

TAO Open Source Assessment Platform v3.3.0 RC02 was discovered to contain a cross-site scripting XSS vulnerability in the content parameter of the Rubric Block Add module. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the rubric name value...

CVE-2020-23041

Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting XSS vulnerability in the path parameter of the list and download exception-handling. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted GET request...

Cross site scripting

Dropouts Technologies LLP Air Share v1.2 was discovered to contain a cross-site scripting XSS vulnerability in the devicename parameter. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the devicename information...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Support module of SugarCRM v6.5.18 allows attackers to execute arbitrary web scripts or HTML via crafted payloads entered into the primary address state or alternate address state input fields...

PT-2021-11611

Name of the Vulnerable Software and Affected Versions: Perfex CRM version 2.4.4 Description: A stored cross-site scripting XSS issue was found in the ./clients/client component of Perfex CRM, specifically via the company name parameter. This allows for malicious script execution when the paramete...

SugarCRM Cross-site Scripting Vulnerability

Sugarcrm SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM Sugarcrm, USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and information sharing and tracking of sales representatives. SugarC...

Fork CMS cross-site scripting vulnerabilities

Fork CMS is an open source content management system CMS developed using PHP. The system contains blogs , questions and answers , forms and other modules . A cross-site scripting vulnerability exists in Fork CMS Content Management System version 5.8.0, which can be exploited by an attacker to...

Portable Ltd Playable: Code Injection Vulnerability

Portable Ltd Playable is a Full HD media player for Pc from Portable Ltd, UK. Portable Ltd Playable suffers from a code injection vulnerability that stems from Portable Ltd Playable v9.18 containing a code injection vulnerability in the filename parameter. An attacker could use this vulnerability...

Privilege Defined With Unsafe Actions in Keycloak

A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the...

PT-2021-16893

Name of the Vulnerable Software and Affected Versions Camaleon CMS versions 0.0.1 through 2.6.0 Description The issue allows an unauthenticated attacker or unprivileged application users to store malicious scripts in the comments section of a post. These scripts are executed in a victim's browser...

PT-2021-8345

Name of the Vulnerable Software and Affected Versions Rails versions prior to 3.0.6 Description A cross-site scripting issue was found in the auto link function. This affects the ability to properly handle user input, potentially leading to malicious script execution. Recommendations For versions...

Cross-site Scripting (XSS) - Stored in osticket/osticket

Description As it is written on github profile, osTicket is a widely-used open source support ticket system. During source code research I discovered bad uploaded file type check, which is controlled by user. Unauthenticated user can upload malicious html/js file. FROM OWASP:: Cross-Site Scriptin...