42 matches found
MantisBT is Vulnerable to Reflected XSS in Rendering Dynamic Custom Textarea Field
Lack of validation of filtertarget parameter on returndynamicfilters.php normally used as an AJAX in View Issues Page allows an attacker to inject arbitrary HTML if the target is a TEXTAREA custom field. Impact Cross-site scripting XSS Patches - c885af13f0b8596714ffe11df757c09f35fbd8f4 Workaround...
MantisBT is Vulnerable to Stored XSS in Custom Field Textarea Values
Improper escaping of a textarea custom field's contents in the Update Issue page bugupdatepage.php allows an attacker to inject HTML and, if CSP settings permit, execute arbitrary JavaScript when the page is loaded. Impact Session theft leading to admin account takeover, full project data access....
PT-2026-39889
Name of the Vulnerable Software and Affected Versions MantisBT affected versions not specified Description Lack of validation of the filter target parameter in the 'return dynamic filters.php' endpoint allows an attacker to inject arbitrary HTML when the target is a TEXTAREA custom field, leading...
PT-2026-39880
Name of the Vulnerable Software and Affected Versions Mantis Bug Tracker MantisBT versions prior to 2.28.2 Description Flawed logic in the Update Issue page 'bug update page.php' causes improper escaping of textarea custom field contents. This allows an authenticated user with low-privilege bug...
CVE-2020-12635
XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field...
EUVD-2020-4936
Malware in sbrugna...
EUVD-2022-4789
Malicious code in bioql PyPI...
CVE-2020-27852
A stored Cross-Site Scripting XSS vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role Administrator, Editor, etc...
PT-2025-7772 · Flatpress · Flatpress
Name of the Vulnerable Software and Affected Versions: FlatPress version 1.3.1 Description: A stored Cross-Site Scripting issue was identified within the "Add Entry" feature, allowing authenticated attackers to inject malicious JavaScript payloads into blog posts. This is executed when other user...
Gravity Forms stored Cross-Site Scripting (XSS) vulnerability in the survey feature
A stored Cross-Site Scripting XSS vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role Administrator, Editor, etc...
Simple Theme Options < 1.7 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in any of textarea field settings of the plugin such as 'Google Analytics': " T...
CVE-2020-27852
A stored Cross-Site Scripting XSS vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role Administrator, Editor, etc...
Cross site scripting
A stored Cross-Site Scripting XSS vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role Administrator, Editor, etc...
CVE-2020-27852: Improper Neutralization of Input During Web Page Generation
A stored Cross-Site Scripting XSS vulnerability in the survey feature in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpreted by users in a privileged role Administrator, Editor, etc...
PT-2021-11430
Name of the Vulnerable Software and Affected Versions: Rocketgenius Gravity Forms versions prior to 2.4.21 Description: A stored Cross-Site Scripting XSS vulnerability in the survey feature allows remote attackers to inject arbitrary web script or HTML via a textarea field. This code is interpret...
Rocketgenius Gravity Forms Cross-Site Scripting Vulnerability
Rocketgenius Gravity Forms is a software solution from the Rocketgenius team. A cross-site scripting vulnerability in Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary web script or HTML via the textarea field...
CVE-2020-12635
XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field...
Cross site scripting
XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field...
PT-2020-13175 · Magento · Webforms Pro M2
Name of the Vulnerable Software and Affected Versions: WebForms Pro M2 extension for Magento 2 versions prior to 2.9.17 Description: A cross-site scripting XSS issue exists in the WebForms Pro M2 extension for Magento 2. The issue is related to the textarea field. Recommendations: For versions...