CVE-2024-7654

An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other...

CVE-2024-7654 Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service

An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other...

CVE-2024-7654 Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service

An ActiveMQ Discovery service was reachable by default from an OpenEdge Management installation when an OEE/OEM auto-discovery feature was activated. Unauthorized access to the discovery service's UDP port allowed content injection into parts of the OEM web interface making it possible for other...

CVE-2024-7654

The CVE affects Progress OpenEdge Management with OEE/OEM auto-discovery, where the ActiveMQ Discovery service was reachable by default. Unauthorized access to the discovery service’s UDP port allowed content injection into parts of the OEM web interface, enabling potential user deception. Public...

WordPress REST API Content Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress REST API Content Injection', 'Description' = %q This module exploits a content injection vulnerability in WordPress versions 4.7 and...

WordPress RegistrationMagic Plugin <= 6.0.1.0 is vulnerable to Content Injection

Software RegistrationMagic Type Plugin Vulnerable versions = 6.0.1.0 Fixed in 6.0.1.1 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-43317 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 40c223a7e4da Credits SOPROBRO Required privilege...

ROS-20240815-13

A vulnerability in the configuration implementation of the HTML cleanup tool for Rails Rails Html Sanitizer applications is related to content injection if the application developer overrides the allowed tags "math" and "style" or "svg" and "style". Exploitation of the vulnerability could allow a...

CVE-2024-41732

SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application that could allow the attacker to read ...

WordPress WooCommerce Product Table Lite Plugin <= 3.5.1 is vulnerable to Content Injection

Software WooCommerce Product Table Lite Type Plugin Vulnerable versions = 3.5.1 Fixed in 3.8.6 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-43128 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID b5aace52b04c Credits stealthcopter Required...

WordPress wpDiscuz Plugin <= 7.6.21 is vulnerable to Content Injection

Software wpDiscuz Type Plugin Vulnerable versions = 7.6.21 Fixed in 7.6.22 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-6704 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 32773981ccf8 Credits Tieu Pham Trong Nhan aptx4869 Required privilege...

golang: html/template: errors returned from MarshalJSON methods may break template escaping

A flaw was found in Go's html/template standard library package. If errors returned from MarshalJSON methods contain user-controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing subsequent actions to inject unexpected content into...

CVE-2024-41707

An issue was discovered in Archer Platform 6 before 2024.06. Authenticated users can achieve HTML content injection. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data stor...

CVE-2024-41707

An issue was discovered in Archer Platform 6 before 2024.06. Authenticated users can achieve HTML content injection. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data stor...

CVE-2024-41707

An issue was discovered in Archer Platform 6 before 2024.06. Authenticated users can achieve HTML content injection. A remote authenticated malicious Archer user could potentially exploit this to store malicious HTML code in a trusted application data store. When victim users access the data stor...

CVE-2024-41707

Archer Platform (v6) prior to 2024.06 is vulnerable to stored HTML content injection. Authenticated users can store malicious HTML in the trusted application data store, which is then executed by victim users’ browsers in the vulnerable app context. Remediation cited in available sources is to up...

WordPress Cooked Plugin <= 1.7.15.4 is vulnerable to Content Injection

Software Cooked Type Plugin Vulnerable versions = 1.7.15.4 Fixed in 1.8.0 OWASP Top 10 A3: Injection Classification Content Injection CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 96527670dc1c Credits RE-ALTER Required privilege Contributor Published 18 July, 202...

WordPress WPCS Plugin <= 1.2.0.3 is vulnerable to Content Injection

Software WPCS Type Plugin Vulnerable versions = 1.2.0.3 Fixed in 1.2.0.4 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-38700 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 2b3604018b32 Credits stealthcopter Required privilege Unauthenticat...

CVE-2024-35777 WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2...

CVE-2024-35777 WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in Automattic WooCommerce allows Content Spoofing.This issue affects WooCommerce: from n/a through 8.9.2...

WordPress Photo Gallery by Ays Plugin < 5.7.1 is vulnerable to Content Injection

Software Photo Gallery by Ays Type Plugin Vulnerable versions 5.7.1 Fixed in 5.7.1 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-37442 Patch priority Low CVSS severity Low 3.8 Developer Claim ownership PSID 76b249292f10 Credits Ibnu Ubaeydillah Required privilege...