PT-2025-29869 · Unknown · Scratch Channel

Name of the Vulnerable Software and Affected Versions: The Scratch Channel affected versions not specified Description: The Scratch Channel is a news website currently under development. The file /api/admin.js contains code that could lead to cross-site scripting. Recommendations: At the moment,...

CVE-2024-26124 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.19 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page...

Cross-Site Scripting (XSS)

pimcore/pimcore is vulnerable to Cross-Site Scripting XSS. The vulnerability exists due to the getTabPanel function in admin.js caused by the From and To fields when searching in the Application Logger module which allows an attacker to inject and execute arbitrary JavaScript...

Design/Logic Flaw

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954...

CVE-2020-9381

controllers/admin.js in Total.js CMS 13 allows remote attackers to execute arbitrary code via a POST to the /admin/api/widgets/ URI. This can be exploited in conjunction with CVE-2019-15954...

CVE-2020-9381

Summary of findings (Total.js CMS): CVE-2020-9381 and related CVEs affect Total.js CMS (notably version 13) with remote code execution via a POST to /admin/api/widgets/ on controllers/admin.js. The root cause is a widget handling path that can evaluate malicious JavaScript payloads, enabling an a...

Denial Of Service (DoS)

strapi is vulnerable to denial of service DoS. The vulnerability exists as the value of plugin, as used in Admin.js, can lead to an argument injection...

Cross-Site Scripting (XSS)

drupal/core is vulnerable to cross-site scripting XSS attacks. The attacks exist because the library uses the .text function to escape HTML values in views-admin.js...