CVE-2021-38602

CVE-2021-38602 Una vulnerabilidad de cross site scripting almacenado está presente en la página de edición de artículos de la versión 5.8.7 de PluXML. La entrada del usuario no se sanitiza correctamente en varios campos. Campos vulnerables: Título opcional: Contenido: Una vez insertado, el XSS...

CVE-2024-39248

Título del Exploit: SimpCMS v0.1 - Cross Site Scripting XSS CVE: CVE-2024-39248 Autor del Exploit: Jason Jacobs 0xjasonjacobs - Twitter Página del proveedor: https://sourceforge.net/projects/simpcms/ Endpoint vulnerable: /SimpCMS/admin.php Una vulnerabilidad de cross-site scripting XSS en SimpCMS...

CVE-2023-43358-CMSmadesimple-Stored-XSS---News

CMSmadesimple Stored XSS v2.2.18 Autor: Sergio Descripción: Vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 que permite a un atacante local ejecutar código arbitrario mediante un script manipulado en el campo Título del menú Contenido - Noticias. Vectores de ataque: Una...

CVE-2022-35501

CVE-2022-35501 Cross-site Scripting XSS almacenado en la funcionalidad de creación de publicaciones de blog en Amasty Blog Pro para Magento 2 Descripción La funcionalidad de creación de publicaciones en el plugin Amasty Blog Pro 2.10.3 y 2.10.4 para Magento 2 permite la inyección de código...

exploit-foxit-4.1.1-title-bof

Dieses Repository hat keine README-Datei...

Bolt-CMS-3.6.2---Cross-Site-Scripting

Bolt CMS 3.6.2 - Vulnerabilità Cross-Site Scripting Bolt CMS 3.6.2 - Vulnerabilità Cross-Site Scripting CVE-2018-19933 https://vulners.com/cve/CVE-2018-19933 Prova di concetto Per sfruttare la vulnerabilità, Bolt CMS 3.6.2 consente XSS tramite l'input di testo facendo clic sul pulsante di...

CVE-2026-52307

CVE-2026-52307: 1CMS v5.6 Authenticated Stored XSS Vulnerability Introduction This repository contains the reproduction of CVE-2026-52307 , an authenticated stored cross-site scripting XSS vulnerability discovered in 1CMS v5.6 formerly ClassCMS. A proof-of-concept PoC is provided to demonstrate t...

CVE-2022-43332

CVE-2022-43332 Cross Site Scripting in WonderCMS Description: A cross-site scripting XSS vulnerability in Wondercms v3.3.4 allows potential attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Site title field of the Configuration Panel - coupled with the fac...

CVE-2024-41503

CVE-2024-41503 CVE: CVE-2024-41503 Software: Jetimob Plataforma Imobiliaria CRM/ERP/CMS Versión: 20240627-0 Vulnerabilidad: Cross-Site Scripting XSS Almacenado Descripción: La función "Busca" búsqueda utilizada en toda la aplicación contiene una opción de filtro que se puede guardar; al guardarla...

CVE-2026-36392

CVE-2026-36392: Stored XSS in RISE CRM Item Title Field Summary A stored cross-site scripting XSS vulnerability exists in the item title field of RISE CRM RISE - Ultimate Project Manager & CRM versions = 3.9.6. An authenticated administrator can inject arbitrary JavaScript into an item's title,...

CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut

CMSmadesimple XSS Almacenado v2.2.18 Autor: Sergio Descripción: Vulnerabilidad de Cross Site Scripting en CMSmadesimple v.2.2.18 que permite a un atacante local ejecutar código arbitrario mediante un script manipulado en el campo Title en My Preferences - Manage Shortcuts Vectores de Ataque:...

CVE-2026-100753 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

CVE-2026-48540

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

EUVD-2026-86383

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

CVE-2026-48540: Improper Neutralization of Input During Web Page Generation

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

PT-2026-98261

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title containing...

plone.app.dexterity has a Denial of Service due to excessive title or description length

Impact When creating content with a very large title or description field, Plone can become unresponsive. Even if the content loads, it can be hard to edit or delete, because the UI is unwieldy. Patches The problem has been patched in plone.app.dexterity. On Plone 6.2, upgrade to...

CVE-2026-88868

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is affected by a stored cross-site scripting vulnerability in the LiveLinks plugin . The root cause is that the title and description fields are stored without sanitization. An attacker holding canStream permission can inject maliciou...

1CMS 5.6 Cross Site Scripting

1CMS version 5.6 suffers from a persistent cross site scripting vulnerability. https://packetstorm.news/download/231034...

CVE-2026-52307

An authenticated stored cross-site scripting XSS vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field...