CVE-2021-46027

mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, a blog tag will be added...

CVE-2021-46026

mysiteforme, as of 19-12-2022, is vulnerable to Cross Site Scripting XSS via the add blog tag function in the blog tag in the background blog management...

CVE-2021-46027

mysiteforme, as of 19-12-2022, has a CSRF vulnerability in the background blog management. The attacker constructs a CSRF load. Once the administrator clicks a malicious link, a blog tag will be added...

CVE-2021-46030

There is a Cross Site Scripting attack XSS vulnerability in JavaQuarkBBS = v2. By entering specific statements into the background tag management module, the attack statement will be stored in the database, and the next victim will be attacked when he accesses the tag module...

CVE-2021-46030

There is a Cross Site Scripting attack XSS vulnerability in JavaQuarkBBS = v2. By entering specific statements into the background tag management module, the attack statement will be stored in the database, and the next victim will be attacked when he accesses the tag module...

CVE-2021-46030

There is a Cross Site Scripting attack XSS vulnerability in JavaQuarkBBS = v2. By entering specific statements into the background tag management module, the attack statement will be stored in the database, and the next victim will be attacked when he accesses the tag module...

Cross site scripting

There is a Cross Site Scripting attack XSS vulnerability in JavaQuarkBBS = v2. By entering specific statements into the background tag management module, the attack statement will be stored in the database, and the next victim will be attacked when he accesses the tag module...

CVE-2021-46030

The CVE-2021-46030 entry concerns a Cross-Site Scripting (XSS) vulnerability in JavaQuarkBBS versions up to v2. The root cause, as described across multiple connected documents, is insufficient data validation/filtering of user-supplied input in the background tag management module, allowing stor...

None in bobthecow/mustache.php

Description In Mustache.php v2.0.0 through v2.14.0, Sections tag can lead to arbitrary php code execution even if strictcallables is true when section value is controllable. Proof of Concept './cache', 'strictcallables'=true ; echo $m-render' repo phpinfo;// No repos : / repo phpinfo;// ',...

OneBlog 跨站脚本漏洞

OneBlog is a simple and beautiful , powerful and adaptive Java blog. The use of springboot development , front-end use Bootstrap. support for mobile adaptive , with a complete front-end and back-end management functions . OneBlog in version 2.2.8 before the existence of XSS vulnerability , the...

PT-2022-12511 · Unknown · Mysiteforme

Name of the Vulnerable Software and Affected Versions: mysiteforme affected versions not specified Description: The issue concerns a Cross Site Scripting XSS vulnerability via the add blog tag function in the background blog management. This allows for potential malicious script execution...

CVE-2021-45394

An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious tag in the converted HTML document...

Deserialization of untrusted data

An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious tag in the converted HTML document...

CVE-2021-45394

CVE-2021-45394 affects Spipu HTML2PDF prior to 5.2.4. Attackers can trigger deserialization of arbitrary data by injecting a malicious tag into the HTML being converted. Impact is described as a deserialization issue; no explicit exploit details provided beyond that. Mitigation: upgrade to versi...

Spipu Html2Pdf 代码问题漏洞

Spipu Html2Pdf is a French Laurent Minguet personal developer of a Php written in Html to Pdf open source converter. Spipu HTML2PDF has a code issue vulnerability in versions prior to 5.2.4, where an attacker can trigger deserialization of arbitrary data by injecting malicious link tags into...

Vulnerabilities fixed in Expat

Developers have fixed vulnerabilities in Expat. The vulnerabilities allow a remote malicious person to perform a Denial-of-Service. To do this, the malicious party must send an XML tag with an overflow of attributes to the vulnerable XML server send or trigger an integer overflow on various...

Teedy cross-site scripting vulnerability (CNVD-2022-08344)

Teedy is a French open source, lightweight document management system for individuals and businesses. Teedy suffers from a cross-site scripting vulnerability that stems from the fact that in Teedy, versions v1.5 through v1.9 are susceptible to attacks that store cross-site scripting XSS in the na...

CVE-2022-22125 Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag

In Halo, versions v1.0.0 to v1.4.17 latest are vulnerable to Stored Cross-Site Scripting XSS in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server...

GHSA-JPXJ-VGQ5-PRJC OS command execution vulnerability in Jenkins Docker Commons Plugin

Jenkins Docker Commons Plugin 1.17 and earlier does not sanitize the name of an image or a tag, resulting in an OS command execution vulnerability exploitable by attackers with Item/Configure permission or able to control the contents of a previously configured job's SCM repository...

WECON LeviStudioU UMP File Parsing Trend Tag WordAddr11 Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of WECON LeviStudioU. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...