Cross-site Scripting (XSS) - Reflected in admidio/admidio

Description Cross-Site Scripting XSS attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. Proof of Concept // PoC.js Vuln Link --...

CVE-2021-32737 XSS Injection in Media Collection Title was possible

Sulu is an open-source PHP content management system based on the Symfony framework. In versions of Sulu prior to 1.6.41, it is possible for a logged in admin user to add a script injection cross-site-scripting in the collection title. The problem is patched in version 1.6.41. As a workaround, on...

Security fix for the ALT Linux 9 package glpi version 9.5.4-alt1

9.5.4-alt1 built April 14, 2021 Pavel Zilke in task 269862 March 31, 2021 Pavel Zilke - New version 9.5.4 - This is a security release, upgrading is recommended - Security fixes: + CVE-2021-21326 : Horizontal Privilege Escalation + CVE-2021-21255 : entities switch IDOR + CVE-2021-21258 : XSS...

GHSA-VWFX-HH3W-FJ99 Potential XSS injection in the newsletter conditions field

Impact An employee can inject javascript in the newsletter condition field that will then be executed on the front office Patches The issue has been fixed in 2.6.1...

Potential XSS injection in the newsletter conditions field

Impact An employee can inject javascript in the newsletter condition field that will then be executed on the front office Patches The issue has been fixed in 2.6.1...

CVE-2021-21418 Potential XSS injection in the newsletter conditions field

psemailsubscription is a newsletter subscription module for the PrestaShop platform. An employee can inject javascript in the newsletter condition field that will then be executed on the front office The issue has been fixed in 2.6.1...

WordPress Mapplic 6.1 SSRF / Cross Site Scripting

Title : Mapplic Wordpress Plugins Stored XSS Injection via SSRF Date : 22/03/2021 Author : Eagle Eye Vendor Homepage : https://mapplic.com/ Version Affected : 6.1 and below Tested on : Google Chrome XSS Vuln from add/edit Map and bypass with host raw.githubusercontent.com 1.Login as user 2.Add...

WordPress Mapplic 6.1 SSRF / Cross Site Scripting Vulnerability

Title : Mapplic Wordpress Plugins Stored XSS Injection via SSRF Author : Eagle Eye Vendor Homepage : https://mapplic.com/ Version Affected : 6.1 and below Tested on : Google Chrome XSS Vuln from add/edit Map and bypass with host raw.githubusercontent.com 1.Login as user 2.Add Add/Edit Map - From...

OpenMage: No Limit on Email Subscription

Summary: Hello Madison As I have Found a Business Logic Error which cause unlimited amount of Newsletter Subscription as you can see in the image i have provided Steps To Reproduce: 1. Open Burpsuite and set the proxy and intercept on. 2.Then Go to https://demo.openmage.org/ and enter the Email y...

Debian: Security Advisory (DLA-2467-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Super Store Finder 3.3 Cross Site Scripting

Exploit type : XSS INJECTION Exploit title : Super Store Finder Add location XSS Injection Descriptions : XSS injection from adding store and reflected XSS in SQL error login page PHP Script affected : Super Store Finder | Mega Locator Plugin URI : http://www.superstorefinder.net/ Version : 3.3 a...

CVE-2020-17091

Microsoft Teams Remote Code Execution Vulnerability Recent assessments: jheysel-r7 at December 22, 2020 8:33pm UTC reported: Reasoning for low attacker value: The web app is always up to date. The desktop client updates itself automatically. Teams checks for updates every few hours behind the...

Design/Logic Flaw

This affects the package hellojs before 1.18.6. The code get the param oauthredirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauthredirect, such as javascript:alert1...

Unrestricted file upload

The file upload functionality in qdPM 9.1 doesn't check the file description, which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter, aka XSS. This can occur during creation of a ticket, project, or task...

Open-Xchange: XSS - Search - Unescaped contact job

The function responsible for formatting the contact's job company and position doesn't escape its value, which allows to inject arbitrary HTML content. javascript // master/ui/apps/io.ox/contacts/common-extensions.js // develop/ui/apps/io.ox/contacts/listview.js bright: function baton var text =...

Potential XSS injection In PrestaShop contactform

Impact An attacker is able to inject javascript while using the contact form. Patches The problem is fixed in v4.3.0 References Cross-site Scripting XSS - Stored CWE-79...

GHSA-95HX-62RH-GG96 Potential XSS injection In PrestaShop contactform

Impact An attacker is able to inject javascript while using the contact form. Patches The problem is fixed in v4.3.0 References Cross-site Scripting XSS - Stored CWE-79...

XSS injection in the Grid component of Sylius

Grid component of Sylius omits HTML input sanitisation while rendering object implementing toString method through the string field type...

GitLab: Stored XSS in markdown when redacting references

Summary It's possible to inject arbitrary html into the markdown by abusing the ReferenceRedactorFilter. This is due to the data-original attribute allowing html encoded data to be stored, which is then extracted and used as the link content. If the original data already is html encoded then it...

CVE-2019-19852

An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13, 14, and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9, 14.x through 14.0.2.14, and 15.x through 15.0.15.4...