PT-2023-17034

Name of the Vulnerable Software and Affected Versions code-projects Responsive Hotel Site version 1.0 Description A critical vulnerability has been found in the Newsletter Log Handler component of the code-projects Responsive Hotel Site. The issue is related to the manipulation of the title...

PT-2023-20911 · Qibosoft · Qibocms

Name of the Vulnerable Software and Affected Versions: Qibosoft QiboCMS version 7 Description: The issue is related to a remote code execution RCE vulnerability. It is exploited via the Get Title function at the label set rs.php file. Recommendations: For Qibosoft QiboCMS version 7, consider...

WP Tiles <= 1.1.2 - Subscriber+ Draft/Private Post Title Disclosure

The plugin does not ensure that posts to be displayed are not draft/private, allowing any authenticated users, such as subscriber to retrieve the titles of draft and privates posts for example. AN attacker could also retrieve the title of any other type of post. Run the below command in the...

WP Tiles <= 1.1.2 - Subscriber+ Draft/Private Post Title Disclosure

The plugin does not ensure that posts to be displayed are not draft/private, allowing any authenticated users, such as subscriber to retrieve the titles of draft and privates posts for example. AN attacker could also retrieve the title of any other type of post. PoC Run the below command in the...

PT-2023-16917 · Hsycms · Hsycms

Name of the Vulnerable Software and Affected Versions: Hsycms version 3.1 Description: A problematic issue has been found in the file controllercate.php of the component Add Category Module. The manipulation of the title argument leads to cross site scripting. The attack may be launched remotely...

CVE-2023-1349: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in Hsycms 3.1. Affected by this issue is some unknown functionality of the file controller\cate.php of the component Add Category Module. The manipulation of the argument title leads to cross site scripting. The attack may be...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the "Display title" Input. PoC alertdocument.location Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an otherwise trusted website...

CVE-2023-26950

onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting XSS vulnerability via the Title parameter under the Adding Categories module...

PT-2023-20868 · Unknown · Onekeyadmin

Name of the Vulnerable Software and Affected Versions: onekeyadmin version 1.3.9 Description: The issue is related to a stored cross-site scripting XSS vulnerability. This vulnerability can be exploited via the Title parameter under the Adding Categories module. Recommendations: For onekeyadmin...

Debian: Security Advisory (DLA-294-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-26950

CVE-2023-26950 affects onekeyadmin v1.3.9 with a stored XSS in the Title parameter of the Adding Categories module. The issue is documented with CVSSv3.1: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (base score 5.4; MEDIUM). Root cause details are not expanded beyond the stored XSS description in the sou...

CVE-2023-26950: Improper Neutralization of Input During Web Page Generation

onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting XSS vulnerability via the Title parameter under the Adding Categories module...

PT-2023-13747 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.3 through 15.7.8 GitLab CE/EE version 15.8 through 15.8.4 GitLab CE/EE version 15.9 through 15.9.2 Description: A cross-site scripting issue was found in the title field of work items, allowing attackers to perform...

CVE-2022-4007: Improper Neutralization of Input During Web Page Generation

A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behal...

CVE-2022-4007

A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9 prior to 15.9.2 A cross-site scripting vulnerability was found in the title field of work items that allowed attackers to perform arbitrary actions on behal...

GitLab 跨站脚本漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. A security vulnerability exists in GitLab that stems from a cross-site scripti...

CVE-2020-36664

A vulnerability has been found in Artesãos SEOTools up to 0.17.1 and classified as problematic. This vulnerability affects the function setTitle of the file SEOMeta.php. The manipulation of the argument title leads to open redirect. Upgrading to version 0.17.2 is able to address this issue. The...

K51110104: XSS vulnerabilities CVE-2010-5312 and CVE-2012-6662

Security Advisory Description CVE-2010-5312 Cross-site scripting XSS vulnerability in jquery.ui.dialog.js in the Dialog widget in jQuery UI before 1.10.0 allows remote attackers to inject arbitrary web script or HTML via the title option. CVE-2012-6662 Cross-site scripting XSS vulnerability in th...

Sponsors Carousel <= 4.02 - Admin+ Stored XSS

The plugin does not sanitise and escape some parameters such as its image title, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2021-32860: Improper Neutralization of Input During Web Page Generation

iziModal is a modal plugin with jQuery. Versions prior to 1.6.1 are vulnerable to cross-site scripting XSS when handling untrusted modal titles. An attacker who is able to influence the field title when creating a iziModal instance is able to supply arbitrary html or javascript code that will be...