CVE-2020-19283: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML...

CVE-2020-19266: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the index.php/Dswjcms/Site/articleList component of Dswjcms 1.6.4 allows attackers to execute arbitrary web scripts or HTML...

Design/Logic Flaw

Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload...

CVE-2020-19704: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability via ResourceController.java in spring-boot-admin as of 20190710 allows attackers to execute arbitrary web scripts or HTML...

CVE-2020-19709: Improper Neutralization of Input During Web Page Generation

Insufficient filtering of the tag parameters in feehicms 0.1.3 allows attackers to execute arbitrary web or HTML via a crafted payload...

CVE-2020-20700: Improper Neutralization of Input During Web Page Generation

A stored cross site scripting XSS vulnerability in /app/formadd/of S-CMS PHP v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the Title Entry text box...

CVE-2020-22150: Improper Neutralization of Input During Web Page Generation

A cross site scripting XSS vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML...

CVE-2021-35360: Improper Neutralization of Input During Web Page Generation

A reflected cross site scripting XSS vulnerability in dotAdmin//c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload...

CVE-2020-20584: Improper Neutralization of Input During Web Page Generation

A cross site scripting vulnerability in baigo CMS v4.0-beta-1 allows attackers to execute arbitrary web scripts or HTML via the form parameter post to /public/console/profile/info-submit/...

CMS Made Simple Cross-Site Scripting Vulnerability (CNVD-2021-48501)

CMS Made Simple CMSMS is an open source content management system that provides developers, programmers, and website owners with a web-based version of the development and management interface. A stored cross-site scripting vulnerability exists in CMS Made Simple version 2.2.14, which can be...

Catfish CMS Cross-Site Scripting Vulnerability (CNVD-2021-49051)

Catfish Catfish CMS is open source and free PHP CMS web content management system. A cross-site scripting vulnerability exists in Catfish CMS version 4.9.90. An attacker can exploit this vulnerability to execute arbitrary Web script or HTML via the announcementgonggao parameter...

Moodle cross-site scripting vulnerability (CNVD-2021-43377)

Moodle is a learning platform designed to provide educators, administrators, and learners with a powerful, secure, and integrated system for creating personalized learning environments. A cross-site scripting vulnerability exists in Moodle version 3.10.3. The vulnerability can be exploited by a...

CVE-2021-32671

Flarum is a forum software for building communities. Flarum's translation system allowed for string inputs to be converted into HTML DOM nodes when rendered. This change was made after v0.1.0-beta.16 our last beta before v1.0.0 and was not noticed or documented. This allowed for any user to type...

CVE-2020-21993: Improper Neutralization of Input During Web Page Generation

In WEMS Limited Enterprise Manager 2.58, input passed to the GET parameter 'email' is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site...

CVE-2021-26549

An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site...

Wing FTP Cross-Site Scripting Vulnerability

Wing FTP Server is a cross-platform FTP server software. A cross-site scripting vulnerability exists in Wing FTP version 6.4.4, where an arbitrary IFRAME element can be included in a help page via a specially crafted link, which can be exploited by an attacker to execute sandbox arbitrary HTML an...

Wing FTP 跨站脚本漏洞

Wing FTP Server is a cross-platform FTP server software. A cross-site scripting vulnerability exists in Wing FTP version 6.4.4, where an arbitrary IFRAME element can be included in a help page via a specially crafted link, which can be exploited by an attacker to execute sandbox arbitrary HTML an...

Server-Side Request Forgery in html-pdf-chrome

Recommendation This package is working as intended. A Security section has been added since v0.6.1 to detail proper usage of this library. Npm has revoked their advisory altogether. Original Advisory All versions of html-pdf-chrome are vulnerable to Server-Side Request Forgery SSRF. The package...

Cross-site Scripting (XSS)

trix is vulnerable to cross site scripting XSS attacks. The Trix editor allows the execution of Javsascript when the content that is copy and pasted from the clipboard into the editor contains HTML...

Cross-Site Scripting (XSS)

vuetify is vulnerable to cross-site scripting XSS attacks. The user inputs are directly rendered and executed as HTML without sanitation in 'VInput.ts', allowing an attacker to inject arbitrary Javascript...