Cross-site Scripting (XSS)

Overview intelliants/subrion is an open source php content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the installation process when user-supplied input is injected into the dbuser, dbpwd, or dbname parameters. An attacker can execute...

GHSA-9JJM-MC56-3QXV Subrion CMS vulnerable to cross-site scripting

Multiple reflected Cross-site Scripting XSS vulnerabilities in the installation module of Subrion CMS v4.2.1 allow attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the dbuser, dbpwd, and dbname parameters...

Subrion CMS vulnerable to cross-site scripting

Multiple reflected Cross-site Scripting XSS vulnerabilities in the installation module of Subrion CMS v4.2.1 allow attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the dbuser, dbpwd, and dbname parameters...

CVE-2025-70958

Multiple reflected cross-site scripting XSS vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the dbuser, dbpwd, and dbname parameters...

CVE-2025-70958

Multiple reflected cross-site scripting XSS vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the dbuser, dbpwd, and dbname parameters...

CVE-2025-70958: Improper Neutralization of Input During Web Page Generation

Multiple reflected cross-site scripting XSS vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the dbuser, dbpwd, and dbname parameters...

CVE-2025-70958

Subrion CMS v4.2.1 contains multiple reflected cross-site scripting (XSS) vulnerabilities within its installation module. The root cause is the lack of proper input validation for the dbuser, dbpwd, and dbname parameters, which allows an attacker to inject and execute arbitrary JavaScript in a us...

CVE-2025-70958

Multiple reflected cross-site scripting XSS vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript in the context of the user's browser via injecting a crafted payload into the dbuser, dbpwd, and dbname parameters...

EUVD-2016-10278

Malware in sbrugna...

EUVD-2012-1288

Malware in sbrugna...

CVE-2018-20937

cPanel before 68.0.27 does not validate database and dbuser names during renames SEC-321...

GHSA-646R-8FCC-P82R Subrion CMS vulnerable to Cross-site Scripting

Multiple Cross-Site Scripting XSS vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail...

CVE-2023-43875

Multiple Cross-Site Scripting XSS vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail...

CVE-2023-43875: Improper Neutralization of Input During Web Page Generation

Multiple Cross-Site Scripting XSS vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail...

PT-2022-17530

Name of the Vulnerable Software and Affected Versions IGEL Universal Management Suite version 6.07.100 Description An issue was discovered in the IGEL Universal Management Suite UMS that allows an unprivileged local attacker to read encrypted database user and password values for the UMS superuse...

Design/Logic Flaw

GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation...

CVE-2018-14476

CVE-2018-14476 affects GeniXCMS 1.1.5 and is a cross-site scripting vulnerability exploitable via the installation step 1 parameters. The root cause is reflected in the documentation as XSS through the dbuser or dbhost fields submitted during step 1 of installation, allowing arbitrary web script ...

CVE-2018-14476

GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation...

CVE-2018-14476

GeniXCMS 1.1.5 has XSS via the dbuser or dbhost parameter during step 1 of installation...

PT-2019-9025

Name of the Vulnerable Software and Affected Versions GeniXCMS version 1.1.5 Description The issue is related to a security problem where an attacker can execute malicious scripts. This is possible due to inadequate input validation in the dbuser or dbhost parameters during the installation...