CVE-2021-24502: Improper Neutralization of Input During Web Page Generation

The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page, leading to a Stored Cross-Site Scripting issue by high privilege users, even when the unfilteredhtml capability is disallowed...

CVE-2020-18693

Cross Site Scripting XSS in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Title' field of the component '/admin/news'...

CVE-2020-18693

Cross Site Scripting XSS in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Title' field of the component '/admin/news'...

Cross site scripting

Cross Site Scripting XSS in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Title' field of the component '/admin/news'...

CVE-2020-22330

Cross-Site Scripting XSS vulnerability in Subrion 4.2.1 via the title when adding a page...

CVE-2020-22330

Cross-Site Scripting XSS vulnerability in Subrion 4.2.1 via the title when adding a page...

Cross site scripting

Cross-Site Scripting XSS vulnerability in Subrion 4.2.1 via the title when adding a page...

PT-2021-10211 · Unknown · Minewebcms

Name of the Vulnerable Software and Affected Versions: MineWebCMS version 1.7.0 Description: The issue allows remote attackers to execute arbitrary code by injecting malicious code into the Title field of the component "/admin/news". This enables attackers to perform Cross Site Scripting XSS...

CVE-2020-22330: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS vulnerability in Subrion 4.2.1 via the title when adding a page...

MineWebCMS 跨站脚本漏洞

MineWebCMS is a software application. A CMS i.e. Content Management System, in addition to being a fully customizable and intuitive site that will fit perfectly on your Minecraft server. A cross-site scripting vulnerability exists in MineWebCMS that stems from the Title module of the product...

CVE-2020-18693: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS in MineWebCMS v1.7.0 allows remote attackers to execute arbitrary code by injecting malicious code into the 'Title' field of the component '/admin/news'...

GFI Mail Archiver 15.1 - Telerik UI Component Arbitrary File Upload (Unauthenticated)

Exploit Title: GFI Mail Archiver 15.1 - Telerik UI Component Arbitrary File Upload Unauthenticated Date: 21/03/2021 Exploit Author: Amin Bohio Original Research & Code By: Paul Taylor / Foregenix Ltd Original Exploit: https://github.com/bao7uo/RAUcrypto Vendor Homepage: https://www.gfi.com Softwa...

WP Customize Login <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin is vulnerable to Authenticated Stored Cross-Site Scripting XSS in the "Change Logo URL" and Change Logo Title" settings...

WordPress WP Customize Login 1.1 Cross Site Scripting

Exploit Title: WordPress Plugin WP Customize Login 1.1 - 'Change Logo Title' Stored Cross-Site Scripting XSS Date: 2021-08-03 Exploit Author: Aryan Chehreghani Software Link: https://wordpress.org/plugins/customize-login/ Version: 1.1 Tested on: Windows 10 How to Reproduce this Vulnerability: 1...

CVE-2021-33326

Cross-site scripting XSS vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window...

CVE-2021-36703: Improper Neutralization of Input During Web Page Generation

The "blog title" field in the "Settings" menu "config" page of "dashboard" in htmly 2.8.1 has a storage cross site scripting XSS vulnerability. It allows remote attackers to send an authenticated post HTTP request to admin/config and inject arbitrary web script or HTML through a special website...

Hotel Management System 1.0 - Cross-Site Scripting (XSS) Arbitrary File Upload Remote Code Execution (RCE)

Exploit Title: Hotel Management System 1.0 - Cross-Site Scripting XSS Arbitrary File Upload Remote Code Execution RCE Date: 2021-08-01 Exploit Author: Merbin Russel Vendor Homepage: https://phpgurukul.com/ Software Link: https://phpgurukul.com/?smdprocessdownload=1&downloadid=7204 Version: V1.0...

CVE-2021-33326: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Frontend JS module in Liferay Portal 7.3.4 and earlier, and Liferay DXP 7.0 before fix pack 96, 7.1 before fix pack 20 and 7.2 before fix pack 9, allows remote attackers to inject arbitrary web script or HTML via the title of a modal window...

Cybozu Garoon 信息泄露漏洞

Cybozu Garoon is a portal-based OA office system of Cybozu Japan. An information disclosure vulnerability exists in Bulletin in Cybozu Garoon. An attacker can use this vulnerability to obtain the title of an announcement without viewing privileges...

QSAN Storage Manager 跨站脚本漏洞

QSAN Storage Manager is a NAS operating system from Quantium Technology Corporation QSAN. A security vulnerability exists in QSAN Storage Manager that stems from the title page parameter not filtering special characters. A remote attacker can inject JavaScript and launch a reflective XSS attack t...