8405 matches found
EpicEditor XSS Vulnerability
EpicEditor through 0.2.3 has Cross-Site Scripting because of an insecure default marked.js configuration. An example attack vector is a crafted IMG element in an HTML document...
GeniXCMS Cross-site Scripting (XSS)
GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page, as demonstrated by a crafted oncut attribute in a B element...
dijit editor cross-site scripting vulnerability
dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element...
GHSA-88FH-8979-Q2RR Angular Redactor XSS Vulnerability
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...
Angular Redactor XSS Vulnerability
Imperavi Redactor 3 in Angular Redactor 1.1.6, when HTML content mode is used, allows stored XSS, as demonstrated by an onerror attribute of an IMG element, a related issue to CVE-2018-7035...
GHSA-9CCM-G362-2R35 XWork in Apache Struts Reveals Sensitive Information
XWork 2.2.1 in Apache Struts 2.2.1, and OpenSymphony XWork in OpenSymphony WebWork, allows remote attackers to obtain potentially sensitive information about internal Java class paths via vectors involving an s:submit element and a nonexistent method, a different vulnerability than CVE-2011-1772....
Subrion CMS XSS
panel/uploads/elfl1XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element...
GHSA-G78H-PF65-46RV Enhanced Image plugin for CKEditor is vulnerable to Cross-site scripting (XSS)
The Enhanced Image aka image2 plugin for CKEditor in versions 4.5.10 through 4.9.1; fixed in 4.9.2, and as used in Drupal 8 before 8.4.7 and 8.5.x before 8.5.2 and other products, is vulnerable to cross-site scripting because it allows remote attackers to inject arbitrary web script through a...
GHSA-CP39-43XR-2WRP Moodle XSS Vulnerability
Multiple cross-site scripting XSS vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 alt or 2 title attribute in an IMG element...
Moodle XSS Vulnerability
Multiple cross-site scripting XSS vulnerabilities in lib/javascript-static.js in Moodle through 2.5.9, 2.6.x before 2.6.9, 2.7.x before 2.7.6, and 2.8.x before 2.8.4 allow remote authenticated users to inject arbitrary web script or HTML via a 1 alt or 2 title attribute in an IMG element...
XML Signature/Encryption Not Validated in Apache CXF
Apache CXF 2.4.x before 2.4.8, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, when a Supporting Token specifies a child WS-SecurityPolicy 1.1 or 1.2 policy, does not properly ensure that an XML element is signed or encrypted, which has unspecified impact and attack vectors...
CVE-2022-24039: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
A vulnerability has been identified in Desigo PXC4 All versions V02.20.142.10-10884, Desigo PXC5 All versions V02.20.142.10-10884. The “addCell” JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such...
Cross-site Scripting in jquery.json-viewer
The jquery.json-viewer library before version 1.5.0 for Node.js does not properly escape characters such as in a JSON object, as demonstrated by a SCRIPT element...
GHSA-QP2Q-6H9J-JG2R Cross-site Scripting in jquery.json-viewer
The jquery.json-viewer library before version 1.5.0 for Node.js does not properly escape characters such as in a JSON object, as demonstrated by a SCRIPT element...
CVE-2022-30241
The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as in a JSON object, as demonstrated by a SCRIPT element...
CVE-2022-30241: Improper Neutralization of Input During Web Page Generation
The jquery.json-viewer library through 1.4.0 for Node.js does not properly escape characters such as in a JSON object, as demonstrated by a SCRIPT element...
Node.js Cross-Site Scripting Vulnerabilities
Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in jquery.json-viewer version 1.4.0 and earlier versions of Node.js, which stems from the inability to correctly escape characters e.g., in a JSON object, as shown in the SCRIPT element...
Exploit for Special Element Injection in Catchethq Catchet
CVE-2021-391...
