188 matches found
PYSEC-2024-69
An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15. The urlize and urlizetrunc template filters, and the AdminURLFieldWidget widget, are subject to a potential denial-of-service attack via certain inputs with a very large number of Unicode characters...
Django 安全漏洞
Django is a set of open source web application frameworks based on the Python language from the Django Foundation. The framework includes an object-oriented mapper, view system, template system, and more. A security vulnerability exists in Django versions prior to 5.0 through 5.0.8 and 4.2 throug...
PT-2024-19019 · Zenml · Zenml
Name of the Vulnerable Software and Affected Versions: zenml-io/zenml versions 0.55.3 through 0.55.3 Description: A stored Cross-Site Scripting XSS vulnerability was identified in the zenml-io/zenml repository, specifically within the logo url field. By injecting malicious payloads into this fiel...
ZenML Cross-Site Scripting Vulnerability
ZenML is an extensible open source MLOps framework for creating portable, production-ready machine learning pipelines. A cross-site scripting vulnerability exists in ZenML version 0.55.3, which stems from a stored cross-site scripting XSS vulnerability in the logourl field that allows an attacker...
CVE-2024-3883
The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and including, 1.15.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and...
PT-2024-28236 · WordPress · 3D Flipbook
Name of the Vulnerable Software and Affected Versions: 3D FlipBook plugin for WordPress versions up to, and including, 1.15.4 Description: The issue is related to Stored Cross-Site Scripting via the Bookmark URL field due to insufficient input sanitization and output escaping. This allows...
Page Builder Gutenberg Blocks < 3.1.7 - Contributor+ Stored XSS
Description The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks Create/Edit a Post, add an "Icon" block and...
GHSA-57F2-8P89-66X6 Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field
TL;DR This vulnerability affects Kirby sites that use the URL field in any blueprint. A successful attack commonly requires knowledge of the content structure by the attacker as well as social engineering of a user with access to the Panel. The attack cannot be automated. The vulnerability is als...
Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field
TL;DR This vulnerability affects Kirby sites that use the URL field in any blueprint. A successful attack commonly requires knowledge of the content structure by the attacker as well as social engineering of a user with access to the Panel. The attack cannot be automated. The vulnerability is als...
PT-2024-21398 · Kirby Cms · Kirby Cms
Name of the Vulnerable Software and Affected Versions: Kirby CMS version 4.1.0 Description: A reflected self-XSS vulnerability was discovered in Kirby CMS via the URL parameter. This issue can be exploited when a user is tricked into executing malicious JavaScript code within their own context,...
CVE-2023-4820
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin...
SUSE CVE-2023-32721
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
CVE-2023-32721
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
CVE-2023-32721
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
Cross site scripting
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
CVE-2023-32721 Stored XSS in Maps element
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
CVE-2023-32721
A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL...
CVE-2023-38910
CSZ CMS 1.3.0 is vulnerable to cross-site scripting XSS, which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section and choosing our carousel widget created above, in 'Photo URL' and 'YouTube URL' plugin...
