PT-2018-13959

Name of the Vulnerable Software and Affected Versions slack-archive-bot versions prior to 2018-09-19 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the text parameter to cursor.execute in the archivebot.py script. Recommendations For versions...

CVE-2018-17232: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in archivebot.py in docmarionum1 Slack ArchiveBot aka slack-archive-bot before 2018-09-19 allows remote attackers to execute arbitrary SQL commands via the text parameter to cursor.execute...

OpenEMR SQL Injection Vulnerability (CNVD-2018-17197)

OpenEMR is an open source medical management system maintained by the OpenEMR community. The system can be used for medical practice management, electronic medical records, prescription writing and medical billing requests. A SQL injection vulnerability exists in the...

CVE-2018-15148

SQL injection vulnerability in interface/patientfile/encounter/searchcode.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'text' parameter...

CVE-2018-15148: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in interface/patientfile/encounter/searchcode.php in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary SQL commands via the 'text' parameter...

PT-2018-12902

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 5.0.1.4 Description The issue allows a remote authenticated attacker to execute arbitrary SQL commands. This is achieved via the text parameter in the interface/patient file/encounter/search code.php file...

PT-2018-17754

Name of the Vulnerable Software and Affected Versions Marked versions 2 through 2.5.11 Description The issue allows remote attackers to read arbitrary files via a crafted HTML document that triggers a redirect to an "x-marked://preview?text=" URL. The value of the text parameter can include...

WordPress post highlights plugin cross-site scripting vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . post highlights plugin is one of the text effects plugin . A cross-site scripting vulnerability exists in...

DEBIAN-CVE-2016-7103

Cross-site scripting XSS vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function...

jquery-ui: cross-site scripting in dialog closeText

It was found that a parameter of the dialog box feature of jQuery UI was vulnerable to cross site scripting. An attacker could use this flaw to execute a malicious script via the dialog box when it was displayed to a user...

PT-2016-3496

Name of the Vulnerable Software and Affected Versions Titan Framework plugin versions prior to 1.6 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabiliti...

CVE-2014-6444: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Titan Framework plugin before 1.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 t parameter to iframe-googlefont-preview.php or the 2 text parameter to iframe-font-preview.php...

PT-2015-4236

Name of the Vulnerable Software and Affected Versions MediaWiki TemplateSandbox extension affected versions not specified Description A cross-site scripting XSS issue exists in the preview feature of the TemplateSandbox extension for MediaWiki. This allows remote attackers to inject arbitrary web...

CVE-2014-9479: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text parameter to Special:TemplateSandbox...

CVE-2014-8683

Cross-site scripting XSS vulnerability in models/issue.go in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown...

CVE-2014-8683: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in models/issue.go in Gogs aka Go Git Service 0.3.1-9 through 0.5.x before 0.5.8 allows remote attackers to inject arbitrary web script or HTML via the text parameter to api/v1/markdown...

PT-2014-5945

Name of the Vulnerable Software and Affected Versions AnyFont plugin versions 2.2.3 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the text parameter in the mce anyfont/dialog.php file...

CVE-2014-4515: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in mceanyfont/dialog.php in the AnyFont plugin 2.2.3 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the text parameter...

CVE-2013-0805: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the search feature in iTop aka IT Operations Portal 2.0, 1.2.1, 1.2, and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter to pages/UI.php or 2 expression parameter to pages/runquery.php. NOTE: some ...

PT-2014-2463

Name of the Vulnerable Software and Affected Versions iTop versions 2.0, 1.2.1, 1.2, and earlier Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the search feature. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specificall...