CVE-2023-34464

The CVE-2023-34464 issue affects XWiki Platform (wiki platform) where any user who can edit a document can create a stored XSS by inserting HTML into a document and having another user visit it via the displaycontent or rendercontent template with plain output syntax. Affected versions are 2.2.1 ...

CVE-2023-28800

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...

Design/Logic Flaw

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...

CVE-2023-28800 Output encoding missing in redrurl parameter

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...

CVE-2023-28800

CVE-2023-28800 describes an XSS issue in Zscaler Client Connector caused by improper encoding of the redirect URL parameter when using local accounts for administration. The vulnerability allows an attacker to inject script via the redrurl parameter, potentially exposing admin login information. ...

CVE-2023-28800 Output encoding missing in redrurl parameter

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...

PT-2023-21121 · WordPress · Wpsimpletools Manage Upload Limit

Name of the Vulnerable Software and Affected Versions: WpSimpleTools Manage Upload Limit plugin versions 1.0.4 and earlier Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This vulnerability allows for reflected cross-site scripting attacks without...

Smoothscroller <= 1.0.0 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-2121

A flaw was found in HashiCorp Vault and Vault Enterprise, where they are vulnerable to Cross-site scripting caused by improper validation of user-supplied input by the key-value v2 kv-v2 diff viewer. A remote, authenticated attacker can inject malicious script into a Web page which would be...

CVE-2023-2442

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of...

CVE-2023-33969

CVE-2023-33969 affects Kanboard. It's a stored XSS in the Task External Link functionality (stored script executed when viewing a task). Impact: arbitrary JavaScript execution for users who view the malicious task; default CSP blocks this attack. The issue is addressed in version 1.2.30; upgrade ...

CVE-2023-28705

Openfind Mail2000 has insufficient filtering special characters of email content of its content filtering function. A remote attacker can exploit this vulnerability using phishing emails that contain malicious web pages injected with JavaScript. When users access the system and open the email, it...

CVE-2023-33962 JStachio XSS vulnerability: Unescaped single quotes

JStachio is a type-safe Java Mustache templating engine. Prior to version 1.0.1, JStachio fails to escape single quotes ' in HTML, allowing an attacker to inject malicious code. This vulnerability can be exploited by an attacker to execute arbitrary JavaScript code in the context of other users...

"Beautiful Cookie Consent Banner" WordPress plugin vulnerability: Update now!

WordPress plugins are under fire once more, and youre advised to update your version of Beautiful Cookie Consent Banner as soon as possible. The plugin, which is installed on more than 40,000 sites, has been impacted by a "bizarre campaign" being actively used since at least February 5 of this...

e107 2.3.2 Cross Site Scripting

Exploit Title: e107 v2.3.2 - Reflected XSS Date: 11/05/2022 Exploit Author: Hubert Wojciechowski Contact Author: [email protected] Vendor Homepage: https://e107.org/ Software Link: https://e107.org/download Version: 2.3.2 Testeted on: Windows 10 using XAMPP, Apache/2.4.48 Win64 OpenSSL/1.1.1...

CVE-2023-25598

A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient validation for the home.php page. A successful...

Siemens SICAM P850 and SICAM P855 Improper Neutralization of Input During Web Page Generation (CVE-2022-29882)

A vulnerability has been identified in SICAM P850 All versions V3.00, SICAM P855 All versions V3.00. Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of this situation to store an XSS attack, which could - when a legitimate user accesses th...

PT-2023-11525 · Editor.Md · Editor.Md

Name of the Vulnerable Software and Affected Versions: editor.md version 1.5.0 Description: The issue allows attackers to execute arbitrary code via crafted linked url values, which is a Cross Site Scripting XSS attack. This enables attackers to inject malicious scripts into websites, potentially...

Companymaps 8.0 Cross Site Scripting Vulnerability

Exploit Title: Reflected Cross Site Scripting - Exploit Author: Lucas Noki 0xPrototype - Vendor Homepage: https://github.com/vogtmh - Software Link: https://github.com/vogtmh/cmaps - Version: 8.0 - Tested on: Mac, Windows, Linux - CVE : CVE-2023-29808 Description: The vulnerability found is...

Companymaps 8.0 Cross Site Scripting

Exploit Title: Reflected Cross Site Scripting - Google Dork: - Date: 27.04.2023 - Exploit Author: Lucas Noki 0xPrototype - Vendor Homepage: https://github.com/vogtmh - Software Link: https://github.com/vogtmh/cmaps - Version: 8.0 - Tested on: Mac, Windows, Linux - CVE : CVE-2023-29808 Description...