CVE-2018-19904

Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field...

Cross site scripting

Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field...

CVE-2018-19903

Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field...

CVE-2018-19904

Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field...

CVE-2018-19903

This CVE concerns XSLT CMS, a PHP/XML/XSLT-based content management system. The vulnerability is a Persistent XSS flaw exploited through the title field in the create/?action=items.edit&type=Page endpoint, enabling injection of script/HTML. Root cause, per the description, is improper handling/es...

CVE-2018-19904

CVE-2018-19904 corresponds to a Persistent XSS in XSLT CMS, exploitable via the create/?action=items.edit&type=Page endpoint in the body field. The vulnerability is documented across multiple sources (NVD entry and related advisories) and is described as XSS affecting the body field, with PoC ind...

CVE-2018-19903

Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page title field...

CVE-2018-19904

Persistent XSS exists in XSLT CMS via the create/?action=items.edit&type=Page "body" field...

PT-2018-15154 · Xslt · Xslt Cms

Name of the Vulnerable Software and Affected Versions: XSLT CMS affected versions not specified Description: A persistent XSS issue exists in XSLT CMS, allowing exploitation via the "body" field in the create/?action=items.edit&type=Page endpoint. Recommendations: At the moment, there is no...

[SECURITY] Fedora 29 Update: python-lxml-4.2.5-1.fc29

lxml is a Pythonic, mature binding for the libxml2 and libxslt libraries. It provides safe and convenient access to these libraries using the ElementTre e It extends the ElementTree API significantly to offer support for XPath, Relax NG, XML Schema, XSLT, C14N and much more.To contact the project...

Remote Code Execution in esigate-core

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

Design/Logic Flaw

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

CVE-2018-1000854

esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable vi...

CVE-2018-1000854

CVE-2018-1000854 concerns esigate.org esigate, affected up to version 5.2. The vulnerability arises from CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in the ESI directive that uses user-specified XSLT, enabling remote code execution. T...

Adobe Acrobat Pro DC XSLT Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Acrobat Pro DC XSLT Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Adobe Acrobat Pro DC XSLT Parsing Integer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

[SECURITY] Fedora 29 Update: xml-security-c-2.0.2-1.fc29

The xml-security-c library is a C++ implementation of the XML Digital Signature specification. The library makes use of the Apache XML project's Xerces-C XML Parser and Xalan-C XSLT processor. The latter is used for processing XPath and XSLT transforms...

Apache Camel's XSLT component allows remote attackers to execute arbitrary Java methods

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message...

Apache Camel's XSLT component allows remote attackers to read arbitrary files

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External...