CVE-2024-0382

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 9.1.0 due to unrestricted use of the 'headertag' attribute. This makes it possible for authenticated attackers with contributor-level and above...

PT-2024-15516 · WordPress · Wp Recipe Maker

Name of the Vulnerable Software and Affected Versions: WP Recipe Maker plugin for WordPress versions up to, and including, 9.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to the unrestricted use of the header tag attribute. This allows...

CVE-2024-0381

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-date, and wprm-recipe-counter shortcodes in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers wi...

Cleaning Business Software 1.0 Cross Site Scripting

Title: Cleaning Business Software-1.0 XSS-Reflected Author: nu11secur1ty Date: 09/06/2023 Vendor: https://www.phpjabbers.com/ Software: https://www.phpjabbers.com/cleaning-business-software/sectionDemo Reference: https://portswigger.net/web-security/cross-site-scripting/reflected Description: The...

CVE-2023-27455

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Maui Marketing Update Image Tag Alt Attribute plugin = 2.4.5 versions...

SUSE CVE-2016-0785

Apache Struts 2.x before 2.3.28 allows remote attackers to execute arbitrary code via a "%" sequence in a tag attribute, aka forced double OGNL evaluation...

SUSE CVE-2016-9424

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m doesn't properly validate the value of tag attribute, which allows remote attackers to cause a denial of service heap buffer overflow crash and possibly execute arbitrary code via a crafted HTML page...

Senayan Library Management System 9.0.0 Cross Site Scripting

Title: Senayan Library Management System v9.0.0 a.k.a SLIMS 9 Multiple XSS-Reflected vulnerabilities Author: nu11secur1ty Date: 12.09.2022 Vendor: https://slims.web.id/web/ Software: https://github.com/slims/slims9bulian/releases/download/v9.0.0/slims9bulian-9.0.0.zip Reference:...

Cross site scripting

glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting XSS vulnerability. The value of the title request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. This input was echoed unmodified in the application's response...

Apache Struts RCE Vulnerability

Apache Struts 2.x before 2.3.20.3, 2.3.24.3, and 2.3.28 allows remote attackers to execute arbitrary code via a % sequence in a tag attribute, aka forced double OGNL evaluation...

PT-2021-24304 · Unknown · Glfusion Cms

Name of the Vulnerable Software and Affected Versions: glFusion CMS version 1.7.9 Description: The issue concerns a reflected Cross Site Scripting XSS vulnerability. Specifically, the value of the title request parameter is copied into an HTML tag attribute encapsulated in double quotation marks...

Apache Struts2 S2-059 Remote Code Execution Vulnerability

Struts2 is Apache Software Foundation is responsible for maintaining a MVC-based design pattern of the Web application framework for open source projects . Apache Struts2 suffers from an S2-059 remote code execution vulnerability. The vulnerability stems from the fact that the framework of Apache...

CVE-2018-20778

admin/?/plugin/filemanager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element...

CVE-2017-6913

Cross-site scripting XSS vulnerability in the Open-Xchange webmail before 7.6.3-rev28 allows remote attackers to inject arbitrary web script or HTML via the event attribute in a time tag...

CVE-2016-4461

Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785...

CVE-2016-4461

Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785...

Design/Logic Flaw

Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%" sequence in a tag attribute, aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785...

DEBIAN-CVE-2016-9424

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m doesn't properly validate the value of tag attribute, which allows remote attackers to cause a denial of service heap buffer overflow crash and possibly execute arbitrary code via a crafted HTML page...

UBUNTU-CVE-2016-9424

An issue was discovered in the Tatsuya Kinoshita w3m fork before 0.5.3-31. w3m doesn't properly validate the value of tag attribute, which allows remote attackers to cause a denial of service heap buffer overflow crash and possibly execute arbitrary code via a crafted HTML page...

PT-2016-7743 · Tatsuya Kinoshita +3 · W3M +3

Name of the Vulnerable Software and Affected Versions: w3m versions prior to 0.5.3-31 Description: An issue was discovered in the Tatsuya Kinoshita w3m fork that allows remote attackers to cause a denial of service heap buffer overflow crash and possibly execute arbitrary code via a crafted HTML...