Moodle has reflected Cross-site Scripting risk in policy tool

A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting XSS risk...

CVE-2025-3643 Moodle: reflected xss risk in policy tool

A flaw was found in Moodle. The return URL in the policy tool required additional sanitizing to prevent a reflected Cross-site scripting XSS risk...

Moodle 4.3.x < 4.3.4 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.3.x prior to 4.3.4. It is, therefore, affected by multiple vulnerabilities. - Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect...

CVE-2024-25155

In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag...

CVE-2024-3110

A stored Cross-Site Scripting XSS vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0. The vulnerability arises from the application's failure to properly sanitize and validate user-supplied URLs before embedding them...

CVE-2024-50349 Git does not sanitize URLs when asking for credentials interactively

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When Git asks for credentials via a terminal prompt i.e. without using any credential helper, it prints out the host name for whic...

CVE-2024-50349

CVE-2024-50349 affects Git. When prompting for credentials in terminal (no credential helper), Git decodes URL-encoded parts and prints the host; attackers can craft URLs with ANSI escape sequences to mislead users. The issue was patched via commits 7725b81 and c903985 and is addressed in multipl...

Unauthorized File Access

@oakserver/oak is vulnerable to Unauthorized File Access. The vulnerability is due to inadequate sanitization of URL-encoded characters in the Context.send API, allows attackers to encode / as %2F, bypassing the restriction on hidden files and potentially exposing sensitive data...

Cross Site Scripting (XSS)

@udecode/plate-media is vulnerable to Cross Site Scripting XSS. The vulnerability is due to lack of proper URL sanitization in MediaEmbedElement and custom urlParsers and direct consumption of the url property, which allows an attacker to embed malicious URLs using javascript:, data:, or vbscript...

Improper URL Sanitization

silverstripe/framework is vulnerable to Improper URL Sanitization. The vulnerability is due to a lack of server-side URL sanitization in the "Add from URL" function, allowing potentially dangerous URLs to be processed...

Cisco IP Phones 8800 Series Authorization Bypass (CVE-2019-1763)

A vulnerability in the web-based management interface of Session Initiation Protocol SIP Software for Cisco IP Phone 8800 Series could allow an unauthenticated, remote attacker to bypass authorization, access critical services, and cause a denial of service DoS condition. The vulnerability exists...

CVE-2024-25155

In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag...

Design/Logic Flaw

In FileCatalyst Direct 3.8.8 and earlier through 3.8.6, the web server does not properly sanitize illegal characters in a URL which is then displayed on a subsequent error page. A malicious actor could craft a URL which would then execute arbitrary code within an HTML script tag...

CVE-2024-25155

CVE-2024-25155 affects FileCatalyst Direct web server in versions 3.8.6–3.8.8. The issue arises from improper sanitization of illegal characters in URLs, which are then displayed on a subsequent error page. This can enable an attacker to craft a URL that executes arbitrary code within an HTML scr...

Cross-site Scripting (XSS)

Jenkins iceScrum Plugin is vulnerable to Cross-site Scripting XSS. The vulnerability is due to the lack of sanitization of iceScrum project URLs on build views. An attacker can inject malicious scripts if they are able to configure jobs...

Open Redirect

github.com/caddyserver/caddy is vulnerable to Open Redirect. The vulnerability is caused by the SanitizedPathJoin and directoryListing functions due to improper URL sanitization, allowing an attacker to craft a malicious URL resulting in open redirect...

Exploit for CVE-2022-25765

CVE-2022-25765 Exploit A small POC exploit for CVE-2022-25765,...

The vulnerability in the web interface of the Pulse Connect Secure VPN gateway for corporate networks allows for the execution of XSS attacks.

The vulnerability in the web interface of the Pulse Connect Secure VPN gateway for corporate networks exists due to insufficient cleaning of data provided by users, which are transmitted through the URL address used for Citrix ICA. Exploiting this vulnerability allows a malicious actor to carry o...

Open Redirect

GitLab is vulnerable to Open Redirect vulnerability. The vulnerability is caused due to improper URL sanitization in Gitlab. This could allow an attacker to create a URL that would redirect to a different project...

Cross-Site Scripting (XSS)

Keycloak Services is vulnerable to Cross Site Scripting XSS Attacks. The vulnerability is due to the matchesRedirects method utils/RedirectUtils.java missing some redirection URL sanitization. This could allow an attacker to submit a specially crafted request leading to XSS...