CVE-2024-22639

iGalerie v3.0.22 was discovered to contain a reflected cross-site scripting XSS vulnerability via the Titre Title field in the editing interface...

CVE-2024-22639

iGalerie v3.0.22 has a reflected XSS vulnerability via the Titre (Title) field in the editing interface. Root cause: input in the Title field is reflected back, enabling script injection. Impact is limited to confidentiality/integirty (LOW) with user interaction required; CVSS shows MEDIUM overal...

PT-2024-19515 · Galerie · Galerie

Name of the Vulnerable Software and Affected Versions: iGalerie version 3.0.22 Description: The issue is related to a reflected cross-site scripting XSS vulnerability. This vulnerability occurs via the Titre Title field in the editing interface. Cross-site scripting XSS is a type of security...

PT-2024-13629 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe Framework versions prior to 4.13.39 and 5.1.11 Description: The issue allows a user to access a record's title even if they should not be able to see the record, by adding it to a GridField using the...

CVE-2023-48714: Exposure of Sensitive Information to an Unauthorized Actor

Silverstripe Framework is the framework that forms the base of the Silverstripe content management system. Prior to versions 4.13.39 and 5.1.11, if a user should not be able to see a record, but that record can be added to a GridField using the GridFieldAddExistingAutocompleter component, the...

VulnCheck KEV: CVE-2021-34641

The SEOPress WordPress plugin is vulnerable to Stored Cross-Site-Scripting via the processPut function found in the /src/Actions/Api/TitleDescriptionMeta.php file which allows authenticated attackers to inject arbitrary web scripts, in versions 5.0.0 - 5.0.3...

PT-2024-15777 · Unknown · Liuwy-Dlsdys Zhglxt

Name of the Vulnerable Software and Affected Versions: liuwy-dlsdys zhglxt version 4.7.7 Description: A problematic issue has been found in the HTTP POST Request Handler component, affecting the processing of the file /oa/notify/edit. The manipulation of the notifyTitle argument leads to cross-si...

liuwy-dlsdys zhglxt Cross-Site Scripting Vulnerability

zhglxt is a web application by the Chinese liuwy-dlsdys individual developer. A cross-site scripting vulnerability exists in liuwy-dlsdys zhglxt version 4.7.7, which stems from the parameter notifyTitle in the file /oa/notify/edit that causes cross-site scripting...

CVE-2023-43824

A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTitleTextLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code...

CVE-2023-43823

A stack based buffer overflow exists in Delta Electronics Delta Industrial Automation DOPSoft when parsing the wTTitleLen field of a DPS file. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve remote code execution...

CVE-2023-51807

Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition component...

CVE-2023-51807

Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition component...

Cross site scripting

Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition component...

CVE-2024-0599

A vulnerability was found in Jspxcms 10.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file src\main\java\com\jspxcms\core\web\back\InfoController.java of the component Document Management Page. The manipulation of the argument title...

CVE-2022-2413

The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfilteredhtml capability is...

CVE-2022-2413

The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfilteredhtml capability is...

CVE-2023-51807

Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition component...

CVE-2023-51807: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the title addition component...

CVE-2024-0599: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Jspxcms 10.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file src\main\java\com\jspxcms\core\web\back\InfoController.java of the component Document Management Page. The manipulation of the argument title...

CVE-2022-2413: Improper Neutralization of Input During Web Page Generation

The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logged in user with roles as low as Author to inject a javascript payload into the slide title even when the unfilteredhtml capability is...