Vanilla: Unsanitized input in email field

Users are able to inject javascript payloads in the email field which leads to stored XSS Steps to produce : 1. Go to profile and add "alert1"@example.com as your email . 2. We can see the popup at https://discuss.paytm.com/profile/preferences/profilename Impact Users can store malicious payloads...

YIBAN Easy class education platform cross-site scripting vulnerability

YIBAN Easy class education platform is a one-stop management solution for school resources from YIBAN. A cross-site scripting vulnerability exists in YIBAN Easy class education platform version 2.0. The vulnerability can be exploited by remote attackers to steal user cookies by sending the 'k'...

Unspecified Cross-Site Scripting Vulnerability in SAP Customer Relationship Management Mail Form Editor

SAP Customer Relationship Management is a customer relationship management solution from SAP, Germany. It supports all customer-centric business areas, from marketing to sales and service, as well as customer interaction channels such as interaction centers, the Internet and mobile customers. An...

TYPO3 CAB FAL Search Extension Cross-Site Scripting Attack Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. An unspecified cross-site scripting attack vulnerability exists in TYPO3's CAB FAL search extension, which stems from insufficient validation of user input. The vulnerability can...

Unspecified Cross-Site Scripting Vulnerability in SAP SAPUI5

SAP SAPUI5 is a UI technology that provides everything you need to build enterprise-class Web applications. SAP SAPUI5 suffers from an unspecified cross-site scripting vulnerability that stems from the program not properly validating user-supplied input. A remote attacker could use this...

TYPO3 T3Blog Extbase Extension Cross-Site Scripting Vulnerability

Typo3 is one of the leading brands of open source content management systems CMS and content management frameworks CMF based on PHP and MySQL databases and is a powerful open source solution. A cross-site scripting vulnerability exists in TYPO3 T3Blog Extbase Extension that stems from...

Stored Cross-Site Scripting Vulnerability in the Backend of Vanco Web Management System

Guangzhou Vanke Internet Technology Co., Ltd Vanke for short is an innovative enterprise that specializes in providing Internet marketing services for small and medium-sized enterprises SMEs. A stored cross-site scripting vulnerability exists in the backend of the Vantech website management syste...

Multiple HTML Injection Vulnerabilities in Multiple TIBCO Products

TIBCO Jaspersoft Studio is a reporting tool, a product of TIBCO Software, Inc. Multiple HTML injection vulnerabilities exist in various TIBCO products that stem from insufficiently validated user input. An attacker could execute arbitrary HTML and script code within the affected application...

Drupal Automated Logout Module HTML Injection Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. An HTML injection vulnerability exists in Drupal's Automated Logout module that stems from a failure to adequately validate user input. An attacker could exploit this...

Unspecified Cross-Site Scripting Vulnerability in SAP BusinessObjects Analysis for OLAP

The SAP BusinessObjects portfolio offers a wide range of business intelligence software, information management software, enterprise performance management solutions, and regulatory, risk, and compliance solutions. An unspecified cross-site scripting vulnerability exists in SAP BusinessObjects...

Multiple Vulnerabilities in Jenkins Global Build Stats Plugin

Jenkins is an open source automation server.Jenkins provides a number of plug-ins that support building, deploying and automating projects.Global Build Stats is one of the plug-ins that allows to collect and display global build results statistics. The Jenkins Global Build Stats plugin has multip...

Drupal Mosaik Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Mosaik module that stems from a failure to adequately validate user text input. An attacker could use the...

Multiple vulnerabilities in Jenkins Global Build Stats plugin (CNVD-2018-15256)

Jenkins is the open source automation server.Jenkins provides numerous plug-ins that support building, deploying, and automating projects.Global Build is a plug-in that allows two different geographically located Jenkins to automatically trigger each other to work. The Jenkins Global Build Stats...

Stored Cross-Site Scripting Vulnerability in Safetrans SaaS System

The SaaS system is an informatization system developed by Xiaobei Technology for medium and large-scale sports events and outdoor activities, providing one-stop informatization solutions for organizers in the areas of event release, registration and collection, membership marketing, photo sharing...

Stored Cross-Site Scripting Vulnerability in Backdrop CMS Published Article Pages

Backdrop CMS is a foreign open source, free CMS system for small and medium-sized businesses and non-profit organizations. A stored cross-site scripting vulnerability exists in the Backdrop CMS publish article page. An attacker can insert malicious js code into the page to obtain user cookies and...

WordPress: XSS on support.wordcamp.org in ajax-quote.php

Hi, There is an XSS vulnerability in ajax-quote.php on http://support.wordcamp.org. It can be demonstrated with the attached POC - this needs to be run in Firefox to execute, as it's super basic and XSS Auditor will catch it but with multiple parameters, even with one of them filtered, it's likel...

Drupal Skype Status Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability in the Drupal Skype Status module exists because the program fails to adequately validate user input. An attacker could use the...

Drupal Yandex.Metrics module cross-site scripting vulnerability

Drupal is a free, open-source content management system developed in the PHP language and maintained by the Drupal community. A cross-site scripting vulnerability exists in the Drupal Yandex.Metrics module that stems from a failure to adequately validate user input. The vulnerability can be...

DOM-type cross-site scripting vulnerabilities in the front-end of Xingyunhai CMS (XYHcms)

Xing Yunhai CMS XYHcms is a completely open source CMS content management system. Xing Yunhai CMS XYHcms front-end DOM-type cross-site scripting vulnerabilities. Attackers can use the vulnerability to insert js code in the packet to obtain user cookies and other information...

SAP NetWeaver 'SLC Sell Side Registration Page' Cross-Site Scripting Vulnerability

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A cross-site scripting vulnerability exists in SAP NetWeaver 'SLC Sell Side Registration Page', which stems from...