Cross site scripting

Cross-site scripting XSS vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object...

CVE-2023-33938

Cross-site scripting XSS vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object...

CVE-2023-33938

CVE-2023-33938 is a documented XSS vulnerability in the App Builder module of Liferay Portal/DXP (affecting Liferay Portal 7.3.0–7.4.0 and Liferay DXP 7.3 prior to update 14). The flaw occurs on the App Builder custom object details page, where an attacker can inject arbitrary web script or HTML ...

CVE-2023-33938

Cross-site scripting XSS vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an App Builder custom object...

PT-2023-24579

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.3.0 through 7.4.0 Liferay DXP 7.3 before update 14 Description A cross-site scripting XSS issue exists in the App Builder module's custom object details page, allowing remote attackers to inject arbitrary web script o...

CVE-2022-26594

Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...

CVE-2022-26594

Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...

CVE-2022-26594

Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...

Liferay Portal 跨站脚本漏洞

Liferay Portal is a J2EE-based portal solution from Liferay, Inc. The solution uses technologies such as EJB as well as JMS, and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, and more. A security vulnerability exists in Liferay Portal...

Flask-AppBuilder 输入验证错误漏洞

Flask-AppBuilder is a simple and fast application development framework. An input validation error vulnerability exists in versions of Flask-AppBuilder prior to 3.4.5, which stems from an open redirection vulnerability in versions of Flask-AppBuilder prior to 3.4.5 when using database...

WordPress Mobile App Editor – WordPress to Android App Builder plugin <= 1.1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Mobile App Editor – WordPress to Android App Builder plugin versions = 1.1.1. Solution Update the WordPress Mobile App Editor – WordPress to Android App Builder plugin to the latest available version a...

Flask-AppBuilder 输入验证错误漏洞

Flask-AppBuilder is a simple and fast application development framework. Flask-AppBuilder suffers from an input validation error vulnerability that arises from a networked system or product that does not properly filter special characters in parameters during the construction of command parameter...

WordPress mobile-app-builder-by-wappress arbitrary file upload vulnerability

WordPress mobile-app-builder-by-wappress is a mobile app development plugin for WordPress. An arbitrary file upload vulnerability exists in WordPress mobile-app-builder-by-wappress version 1.05, which originates from . The vulnerability stems from code in the...

CVE-2017-1002000

Vulnerability in wordpress plugin mobile-friendly-app-builder-by-easytouch v3.0, The code in file ./mobile-friendly-app-builder-by-easytouch/server/images.php doesn't require authentication or check that the user is allowed to upload content...

CVE-2017-1002001

Vulnerability in wordpress plugin mobile-app-builder-by-wappress v1.05, The plugin includes unlicensed vulnerable CMS software from http://www.invedion.com...

CVE-2017-1002001

The CVE-2017-1002001 issue affects the WordPress plugin “mobile-app-builder-by-wappress” v1.05. CNVD/NVD detail an arbitrary file upload vulnerability stemming from the plugin’s server/images.php path, where authentication/permissions checks are not performed, enabling an attacker to upload arbit...

WordPress Mobile app Builder 1.05 - Unauthenticated File Upload

Plugin is still affected and has been closed...