Moodle: Cross-site scripting vulnerabilities

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A cross-site scripting vulnerability exists in Moodle, which can be exploited to inject and execute arbitrary HTML and script code in ...

Hedgedoc Cross-Site Script Vulnerability

Hedgedoc is a Javascript-based real-time editing and sharing platform for Markdown documents by the Hedgedoc team. A cross-site scripting vulnerability exists in HedgeDoc. A remote attacker can trick a victim into following a specially crafted link and execute arbitrary HTML and script code in a...

XSS in fieldID - CVE 2021-26079

The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability. Affected...

CVE-2020-29444: Improper Neutralization of Input During Web Page Generation

Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters...

CVE-2020-21987

HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting XSS. XSS vulnerabilities occur when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's...

CVE-2020-21987: Improper Neutralization of Input During Web Page Generation

HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting XSS. XSS vulnerabilities occur when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's...

PT-2021-10703

Name of the Vulnerable Software and Affected Versions: HomeAutomation version 3.3.2 Description: The issue is related to persistent Cross Site Scripting XSS, which occurs when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This...

PT-2021-14139

Name of the Vulnerable Software and Affected Versions: NEC Aterm WG1900HP2 versions 1.3.1 and earlier NEC Aterm WG1900HP versions 2.5.1 and earlier NEC Aterm WG1800HP4 versions 1.3.1 and earlier NEC Aterm WG1800HP3 versions 1.5.1 and earlier NEC Aterm WG1200HS2 versions 2.5.0 and earlier NEC Ater...

PT-2021-17500 · Unknown · Phpgurukul Beauty Parlour Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Beauty Parlour Management System version 1.0 Description: The issue allows remote attackers to execute arbitrary code by injecting arbitrary HTML into the sername parameter in the "add-services.php" component. This enables attacker...

PT-2021-4175

Name of the Vulnerable Software and Affected Versions Etherpad version 1.8.13 Description A Cross-Site Scripting XSS issue in the chat component of Etherpad allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad. This occurs due to a lack of protection for the w...

Knowage HTML Injection Vulnerability

Knowage is a suite of open source tools for modern business analytics. An HTML injection vulnerability exists in Knowage versions prior to 7.4. The vulnerability can be exploited to inject arbitrary HTML into "/restful-services/2.0/analyticalDrivers" via the 'LABEL' and 'NAME' parameters...

CVE-2021-26549

An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site...

PT-2021-17031

Name of the Vulnerable Software and Affected Versions SmartFoxServer version 2.17.0 Description A cross-site scripting XSS issue was discovered. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code ...

Cross site scripting

An XSS issue was discovered in Wing FTP 6.4.4. An arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of sandboxed arbitrary HTML and JavaScript in the user's browser...

CVE-2020-27851

Multiple stored HTML injection vulnerabilities in the "poll" and "quiz" features in an additional paid add-on of Rocketgenius Gravity Forms before 2.4.21 allows remote attackers to inject arbitrary HTML code via poll or quiz answers. This code is interpreted by users in a privileged role...

PT-2021-11415

Name of the Vulnerable Software and Affected Versions: Wing FTP version 6.4.4 Description: A cross-site scripting XSS issue was found, allowing an arbitrary IFRAME element to be included in the help pages via a crafted link. This leads to the execution of arbitrary HTML and JavaScript in the user...

Design/Logic Flaw

OWASP json-sanitizer before 1.2.2 may emit closing SCRIPT tags and CDATA section delimiters for crafted input. This allows an attacker to inject arbitrary HTML or XML into embedding documents...

OpenAsset Digital Asset Management software Cross-Site Scripting Vulnerability

Openasset is a digital asset management software for the website building industry from Openasset UK. A cross-site scripting vulnerability exists in the OpenAsset Digital Asset Management software that originates from allowing remote attackers to inject arbitrary JavaScript or HTML via...

CVE-2020-27783

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...

DEBIAN-CVE-2020-27783

A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code...