CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — 타일 HTML 필드를 통한 저장형 XSS PoC 이 저장소는 URVE Smart Office 의 iOS 모바일 애플리케이션 에 영향을 미치는 저장형 크로스 사이트 스크립팅XSS 취약점에 대한 개념 증명PoC을 문서화합니다. 입력 검증이 충분히 구현되지 않아 공격자가 제어하는 JavaScript가 타일의 HTML 필드 에 주입될 수 있습니다. 페이로드는 저장되며, 이후 영향을 받는 콘텐츠가 모바일 클라이언트에 전달되어 iOS 기기에서 렌더링될 때 실행됩니다. ⚠️ 법적 고지 상호 동의 없...

CVE-2021-3130

CVE-2021-3130 제안된 설명 Open-AudIT 4.0.2까지의 애플리케이션에서 웹 인터페이스는 HTML '비밀번호 필드' 난독화를 사용하여 SSH 비밀, Windows 암호 및 SNMP 문자열을 사용자로부터 숨깁니다. 개발자 도구 등을 사용하여 난독화를 변경하면 자격 증명이 표시될 수 있습니다. 취약점 유형 불충분하게 보호된 자격 증명 제품 공급업체 Open-AudIT by Opmantek 영향을 받는 제품 코드 베이스 Open-AudIT up to version 3.5.3. 공격 유형 원격 영향 코드 실행 fals...

CVE-2026-10850

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...

CVE-2026-10850 Plane 1.3.1 - Stored XSS in intake issue description_html

Plane CE 1.3.1 allows a low-privileged project member to submit arbitrary HTML/JS in the descriptionhtml field when creating an intake work item through the API v1 intake endpoint...

CVE-2020-37243

Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and...

CVE-2020-37243 WordPress Plugin Supsystic Pricing Table 1.8.7 SQL Injection XSS

Supsystic Pricing Table 1.8.7 contains an SQL injection vulnerability in the 'sidx' GET parameter that allows unauthenticated attackers to execute arbitrary SQL queries through the getListForTbl action. The plugin also contains stored cross-site scripting vulnerabilities in the 'Edit name' and...

Statamic 跨站脚本漏洞

Statamic is a powerful flat-file CMS built using Laravel by Statamic Inc. It allows all content, templates, assets, and settings to be stored in files rather than in a database. Versions of Statamic 5.73.8 and earlier, as well as versions 6.0.0-alpha.1 through 6.3.1, had a cross-site scripting...

CVE-2026-26192

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to version 0.7.0, aanually modifying chat history allows setting the html property within document metadata. This causes the frontend to enter a code path that treats document contents as HTML...

EUVD-2024-41288

Malicious code in bioql PyPI...

CVE-2024-45057

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A Reflected Cross-Site Scripting XSS vulnerability was identified in the dynamic generation of HTML fields prior to the 2.9 branch. The file located at...

CVE-2025-25363: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

An authenticated stored cross-site scripting XSS vulnerability in The Plugin People Enterprise Mail Handler for Jira Data Center JEMH before v4.1.69-dc allows attackers with Administrator privileges to execute arbitrary Javascript in context of a user's browser via injecting a crafted payload int...

CVE-2024-47058 Cross-site Scripting (XSS) - stored (edit form HTML field)

With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session...

CVE-2024-47058 Cross-site Scripting (XSS) - stored (edit form HTML field)

With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session...

CVE-2024-47058 Cross-site Scripting (XSS) - stored (edit form HTML field)

With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session...

CVE-2024-47058: Improper Neutralization of Input During Web Page Generation

With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session...

PT-2024-32377

Name of the Vulnerable Software and Affected Versions Mautic versions prior to 4.4.13 Mautic versions prior to 5.1.1 Description With access to edit a Mautic form, an attacker can add Cross-Site Scripting stored in the html field. This could be used to steal sensitive information from the user's...

CVE-2024-27290 Docassemble HTML and javascript injection

Docassemble is an expert system for guided interviews and document assembly. Prior to 1.4.97, a user could type HTML into a field, including the field for the user's name, and then that HTML could be displayed on the screen as HTML. The vulnerability has been patched in version 1.4.97 of the mast...

CVE-2023-44309

Multiple stored cross-site scripting XSS vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked sourc...

CVE-2023-44309

Multiple stored cross-site scripting XSS vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked sourc...

CVE-2023-44309: Improper Neutralization of Input During Web Page Generation

Multiple stored cross-site scripting XSS vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay DXP 7.4 before update 54 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into any non-HTML field of a linked sourc...