289 matches found
CVE-2022-24656
HexoEditor 1.1.8 is affected by Cross Site Scripting XSS. By putting a common XSS payload in a markdown file, if opened with the app, will execute several times...
@dpu/hexo-github-include (>=0.0.1 <=0.0.2), @git-story/hexo-meta-data (>=1.0.0 <=1.1.1) +81 more potentially affected by CVE-2021-25987 via hexo (>=2.4.5 <=5.4.2)
hexo NPM version =2.4.5, =0.0.1, =1.0.0, =1.4.0, =1.0.2, =22.8.141, =2.0.0, =1.0.0, =1.0.11, =1.0.16, =1.0.0, =0.0.1, =0.0.3 and more Source cves: CVE-2021-25987 Source advisory: OSV:GHSA-Q54R-R9PR-W7QV...
GHSA-Q54R-R9PR-W7QV Hexo Vulnerable to XSS
Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code...
Hexo Vulnerable to XSS
Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code...
Cross-site Scripting (XSS)
hexo is vulnerable to cross-site scripting. The attack exists due to insufficient sanitations in the html tag and body values allowing local unauthenticated attackers to inject and execute arbitrary javascript in victim's browser...
Hexo cross-site scripting vulnerability
Hexo is a fast, simple and powerful blogging framework from the personal developer Tommy Chen in China. Hexo suffers from a cross-site scripting vulnerability that stems from Hexo's lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to...
CVE-2021-25987
Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code...
CVE-2021-25987
Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code...
Cross site scripting
Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code...
CVE-2021-25987 Hexo - Stored XSS
Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code...
CVE-2021-25987
CVE-2021-25987 affects Hexo up to 5.4.0, where stored XSS is possible due to lack of sanitization in the post body and tags during page generation. An unprivileged local attacker can inject arbitrary JavaScript that executes in the victim’s browser. The vulnerability is documented across multiple...
CVE-2021-25987 Hexo - Stored XSS
Hexo versions 0.0.1 to 5.4.0 are vulnerable against stored XSS. The post “body” and “tags” don’t sanitize malicious javascript during web page generation. Local unprivileged attacker can inject arbitrary code...
Hexo 跨站脚本漏洞
Hexo is a fast, simple and powerful blogging framework from the personal developer Tommy Chen in China. Hexo suffers from a cross-site scripting vulnerability that stems from Hexo's lack of data validation filtering of user-supplied data and output. An attacker could exploit this vulnerability to...
hexo-wustxiao-blog (=1.1.1) potentially affected by unknown CVE via hexo-admin (=2.3.0)
hexo-admin NPM version =2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on hexo-admin and may be impacted: - hexo-wustxiao-blog =1.1.1 Source cves: unknown CVE Source advisory: OSV:GHSA-PHPH-XPJ4-WVCV...
GHSA-PHPH-XPJ4-WVCV Cross-Site Scripting in hexo-admin
All versions of hexo-admin are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize rendered markdown, allowing attackers to execute arbitrary JavaScript in a victim's browser if they are able to create new posts. Recommendation No fix is currently available. Consider using an...
Cross-Site Scripting in hexo-admin
All versions of hexo-admin are vulnerable to Cross-Site Scripting XSS. The package fails to sanitize rendered markdown, allowing attackers to execute arbitrary JavaScript in a victim's browser if they are able to create new posts. Recommendation No fix is currently available. Consider using an...
hexo-admin plugin for Node.js cross-site scripting vulnerability
hexo-admin plugin for Node.js is a backend administration plugin for use in Node.js. A cross-site scripting vulnerability exists in the Post editor feature in hexo-admin plugin for Node.js version 2.3.0 and earlier, which stems from the lack of proper validation of client-side data in a web...
CVE-2019-17606
The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post...