Cross-Site Scripting (XSS)

org.wso2.am:am-parent is vulnerable to Cross-Site Scripting XSS attacks. The library does not properly escape the user input before it output to the front end, allowing an attacker to inject and execute malicious web scripts or HTML via a crafted payload through the tenantDomain parameter of...

PT-2023-24378 · Janino +2 · Janino +2

Name of the Vulnerable Software and Affected Versions: Janino versions 3.1.9 and earlier Description: The issue allows for denial of service DOS attacks when using the evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes th...

CVE-2023-33546

Janino 3.1.9 and earlier are subject to denial of service DOS attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow. NOTE: this is disputed by...

Design/Logic Flaw

EZ Sync service fails to adequately handle user input, allowing an attacker to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.REG2, 4.1.0 and below as well as ADM 4.2.1.RGE2 and below...

GHSA-G47H-FGCW-G4PH Algernon engine and themes vulnerable to Cross-site Scripting

All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting XSS via the themes.NoPagefilename, theme function due to improper user input sanitization. Exploiting this vulnerability is possibl...

Algernon engine and themes vulnerable to Cross-site Scripting

All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting XSS via the themes.NoPagefilename, theme function due to improper user input sanitization. Exploiting this vulnerability is possibl...

Cross-Site Scripting (XSS)

thorsten/phpmyfaq is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of user-input sanitization in the cleanUpContent function, which allows an attacker to inject and execute arbitrary JavaScript into the browser...

CVE-2023-26131

All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting XSS via the themes.NoPagefilename, theme function due to improper user input sanitization. Exploiting this vulnerability is possibl...

CVE-2023-26131

All versions of the package github.com/xyproto/algernon/engine; all versions of the package github.com/xyproto/algernon/themes are vulnerable to Cross-site Scripting XSS via the themes.NoPagefilename, theme function due to improper user input sanitization. Exploiting this vulnerability is possibl...

CVE-2023-2436 Blog-in-Blog <= 2.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode

The Blog-in-Blog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bloginblog' shortcode in versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with...

CVE-2023-2111

CVE-2023-2111 affects the WordPress plugin HollerBox (Fast & Effective Popups & Lead-Generation) up to version 2.1.3. The root cause is that user input is concatenated into an SQL query in the plugin’s report API endpoint without proper escaping, enabling potential information disclosure in multi...

Crlf injection

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. Note: This issue is present due...

CVE-2023-26130

Versions of the package yhirose/cpp-httplib before 0.12.4 are vulnerable to CRLF Injection when untrusted user input is used to set the content-type header in the HTTP .Patch, .Post, .Put and .Delete requests. This can lead to logical errors and other misbehaviors. Note: This issue is present due...

CVE-2023-23956

A user can supply malicious HTML and JavaScript code that will be executed in the client browser...

Reflected XSS Vulnerability at `_detail/?lang` parameter

Description Reflected XSS vulnerability allows attackers to exploit the trust placed by a web application in user-supplied input, such as query parameters or form fields. In this case, the vulnerability was found in the following URL: https://www.dokuwiki.org/detail/?lang=1"alertdocument.domain...

Cross-Site Scripting (XSS)

nilsteampassnet/teampass is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to a lack of user input sanitization, which allows an attacker to inject arbitrary JavaScript code into a victim's browser...

The vulnerability of the radvd (Router Advertisement Daemon) component of the RouterOS operating system in MikroTik routers allows a hacker to execute arbitrary code.

The vulnerability of the radvd Router Advertisement Daemon component of the RouterOS operating system in MikroTik routers stems from the operation of writing data beyond the buffer in memory when processing data entered by the user. Exploiting this vulnerability allows a remote attacker to execut...

CVE-2022-42225

Jumpserver 2.10.0 = version = 2.26.0 contains multiple stored XSS vulnerabilities because of improper filtering of user input, which can execute any javascript under admin's permission...

Cross site scripting

Jumpserver 2.10.0 = version = 2.26.0 contains multiple stored XSS vulnerabilities because of improper filtering of user input, which can execute any javascript under admin's permission...

GHSA-P9XG-9378-CQP7 Cross-site scripting in Liferay Portal

Cross-site scripting XSS vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's 1 First Name, 2 Middle Name, 3 Last Name, ...