Open Redirect in fisharebest/webtrees

Description OpenRedirect at login with parameter &url= Proof of Concept // PoC.request POST /demo-stable/index.php?route=%2Fdemo-stable%2Flogin%2Fdemo HTTP/2 Host: dev.webtrees.net Cookie: Secure-WT-ID=ekks8678620p55do7do21jd4p1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.15; rv:93.0...

Cross-site Scripting (XSS) - Stored in fisharebest/webtrees

✍️ Description A malicious actor is able to add a malicious payload as a Family Tree Title, and after click the Family Tree nav button from the My Pages Menu, the XSS payload is executed. 🕵️‍♂️ Proof of Concept 1;Create a new family tree, either when logging in after install for the first time, or...

Webtrees < 1.5.2 XSS Vulnerability - Active Check

Webtrees is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2014-100006

Multiple cross-site scripting XSS vulnerabilities in modulesv3/googlemap/wtv3streetview.php in webtrees before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 map, 2 streetview, or 3 reset parameter...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in modulesv3/googlemap/wtv3streetview.php in webtrees before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 map, 2 streetview, or 3 reset parameter...

CVE-2014-100006

Webtrees

CVE-2014-100006

Multiple cross-site scripting XSS vulnerabilities in modulesv3/googlemap/wtv3streetview.php in webtrees before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 map, 2 streetview, or 3 reset parameter...

PT-2015-3611

Name of the Vulnerable Software and Affected Versions webtrees versions prior to 1.5.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via the map, streetview, or reset parameter ...

CVE-2014-100006: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in modulesv3/googlemap/wtv3streetview.php in webtrees before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 map, 2 streetview, or 3 reset parameter...