PYSEC-2023-17

IPython Interactive Python is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Versions prior to 8.1.0 are subject to a command injection vulnerability with very specific prerequisites. This vulnerability requir...

GHSA-FVRH-WRPF-6Q7H Formwork Cross-site Scripting (XSS) from Page title field

Description A stored cross-site scripting XSS vulnerability in Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title field. Only users with access to Administration Panel with page editing permission can inject raw HTML in th...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter...

Formwork 跨站脚本漏洞

Formwork is Formwork open source a flat file-based content management system CMS. Used to build and manage simple websites . A security vulnerability exists in Formwork v1.12.1. An attacker exploits this vulnerability to execute arbitrary Web script or HTML by injecting a specially crafted payloa...

CVE-2023-24230

A stored cross-site scripting XSS vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter...

CVE-2023-24230

A stored cross-site scripting XSS vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter...

PT-2023-19487

Name of the Vulnerable Software and Affected Versions Formwork version 1.12.1 Description A stored cross-site scripting XSS vulnerability in the component /formwork/panel/dashboard of Formwork allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page...

CVE-2023-24230: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Page title parameter...

XSS in user supplied title

Issue The useHead function does not sanitize tags inserted in each property, including the title property. Context The useHead repository is a wrapper around vueuse/head which wraps unjs/unhead which wraps harlan-zw/zhead. The possibility of XSS is not described as being a vulnerability in the ro...

CVE-2017-20176

A vulnerability classified as problematic was found in ciubotaru share-on-diaspora 0.7.9. This vulnerability affects unknown code of the file newwindow.php. The manipulation of the argument title/url leads to cross site scripting. The attack can be initiated remotely. The name of the patch is...

PT-2023-10627 · Ciubotaru · Share-On-Diaspora

Name of the Vulnerable Software and Affected Versions: ciubotaru share-on-diaspora version 0.7.9 Description: A vulnerability was found in the file new window.php, where the manipulation of the title or url argument leads to cross-site scripting. The attack can be initiated remotely...

CVE-2017-20176: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in ciubotaru share-on-diaspora 0.7.9. This vulnerability affects unknown code of the file newwindow.php. The manipulation of the argument title/url leads to cross site scripting. The attack can be initiated remotely. The name of the patch is...

VulnCheck KEV: CVE-2021-24205

In the Elementor Website Builder WordPress plugin before 3.1.4, the icon box widget includes/widgets/icon-box.php accepts a ‘titlesize’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modifi...

CVE-2022-48013

Opencats v0.9.7 was discovered to contain a stored cross-site scripting XSS vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields...

CVE-2022-48013: Improper Neutralization of Input During Web Page Generation

Opencats v0.9.7 was discovered to contain a stored cross-site scripting XSS vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields...

CVE-2022-48013

Opencats v0.9.7 was discovered to contain a stored cross-site scripting XSS vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields...

CVE-2022-48013

Opencats v0.9.7 was discovered to contain a stored cross-site scripting XSS vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields...

PT-2023-15550

Name of the Vulnerable Software and Affected Versions Opencats version 0.9.7 Description The issue is related to a stored cross-site scripting XSS vulnerability in the /opencats/index.php?m=calendar component. This allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

Cross-Site Scripting (XSS)

pimcore/pimcore is vulnerable to Cross-Site-Scripting XSS. The vulnerability exists in the generateLayoutTreeFromArray function in Service.php because the title field is not validated which allows an attacker to inject and execute arbitrary scripts...

GHSA-6VF6-G3PR-J83H pimcore is vulnerable to cross-site scripting via "title field " in data objects

Impact The vulnerability is capable of resulting in stolen user cookies. Proof of Concept Login with dev account https://11.x-dev.pimcore.fun/admin/?dc=1670962076&perspective= Go to setting -- data objects -- classes -- events Click media under genaral settings Add payload in title field. Go to...