Cross-site Scripting (XSS)

Magmi is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary webscript through the profile parameter of web/magmi.php or through querystring to web/magmiimportrun.php...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script through the $searchcourse parameter in mod/feedback/mapcourse.php...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script by passing an AJAX script to the application encoded in UTF7...

Cross-site Scripting (XSS)

Yii2 is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script by passing a JSON string to the application on Internet Explorer versions 6 and 7...

Cross-site Scripting (XSS)

Concrete5 is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script because the library does not sanitize it's parameters before rendering them for display. The following fields are affected: bannedword in...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script through the course summary field on the course request pending approval page...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. A malicious student user can inject and execute arbitrary web script by submitting a quiz statistics report response...

Cross-site Scripting (XSS)

Typo3 CMS is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary web script when installing the TER extension by passing a json request to the application...

Cross site scripting

Multiple Reflective cross-site scripting XSS vulnerabilities in search and display of event data in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML, as demonstrated by the fName parameter...

CVE-2017-11691

Cross-site scripting XSS vulnerability in authprofile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers...

CVE-2017-11682

Stored Cross-site scripting vulnerability in Hashtopussy 0.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 version, 2 url, or 3 rootdir parameter in hashcat.php...

Cross site scripting

Cross-site scripting XSS vulnerability in authprofile.php in Cacti 1.1.13 allows remote attackers to inject arbitrary web script or HTML via specially crafted HTTP Referer headers...

Cross site scripting

Stored Cross-site scripting vulnerability in Hashtopussy 0.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 version, 2 url, or 3 rootdir parameter in hashcat.php...

CVE-2017-11682

Stored Cross-site scripting vulnerability in Hashtopussy 0.4.0 allows remote attackers to inject arbitrary web script or HTML via the 1 version, 2 url, or 3 rootdir parameter in hashcat.php...

CVE-2017-11685

Multiple Reflective cross-site scripting XSS vulnerabilities in search and display of event data in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML, as demonstrated by the fName parameter...

CVE-2017-11687

Multiple Persistent cross-site scripting XSS vulnerabilities in Event log parsing and Display functions in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML via syslog...

CVE-2017-11677

Hashtopus 1.5g is affected by a Cross-Site Scripting (XSS) vulnerability that can be triggered by a crafted query string sent to admin.php, enabling the injection of arbitrary web script or HTML. The root cause is an input handling flaw in the web interface that processes the query string without...

CVE-2017-11685

Multiple Reflective cross-site scripting XSS vulnerabilities in search and display of event data in Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allow remote attackers to inject arbitrary web script or HTML, as demonstrated by the fName parameter...

CVE-2017-11685

Affected product: Zoho ManageEngine Event Log Analyzer (versions 11.4 and 11.5). Vulnerability type / vector: Cross-site scripting (XSS) in the search and display of event data, exploitable via the fName parameter. Root cause (as stated): Multiple reflective XSS vulnerabilities enable remote atta...

CVE-2017-11682

Hashtopussy 0.4.0 contains a Stored Cross‑Site Scripting (XSS) vulnerability accessible through hashcat.php via the (1) version, (2) url, or (3) rootdir parameters. Affected software: Hashtopussy (0.4.0). Root cause: improper handling of input in hashcat.php allowing arbitrary web script or HTML ...