GHSA-J739-GW6Q-F4C7 HTML Injection in Froxlor

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags. Note: Froxlor version 0.10.22 introduces AntiXSS cross-site scripting protectio...

CVE-2020-29653

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags...

CVE-2020-29653

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags...

CVE-2020-29653

Froxlor through 0.10.22 does not perform validation on user input passed in the customermail GET parameter. The value of this parameter is reflected in the login webpage, allowing the injection of arbitrary HTML tags...

CVE-2020-29653

CVE-2020-29653 affects Froxlor up to version 0.10.22. The issue arises from lack of validation for the customermail GET parameter, whose value is reflected on the login page, allowing injection of arbitrary HTML tags (HTML injection / cross-site scripting). The available connected documents confi...

CVE-2022-27156

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection...

CVE-2022-27156

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection...

Design/Logic Flaw

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection...

CVE-2022-27156

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection...

CVE-2022-27156

CVE-2022-27156 affects Daylight Studio Fuel CMS 1.5.1 and is described as vulnerable to HTML Injection. Public references in sources like NVD/Red Hat/CVE.org reiterate the affected product and vulnerability type; some connected entries (CNNVD) note the CMS is CodeIgniter-based. The initial data p...

CVE-2022-27156

Daylight Studio Fuel CMS 1.5.1 is vulnerable to HTML Injection...

Automattic: XSS and HTML Injection on the pressable.com search box

Summary: Hi, I have found that search box on pressable.com is vulnerable for XSS attack and HTML Injection . Steps To Reproduce: 1. Visit https://pressable.com/knowledgebase/ 2. Put the payload on the search box. XSS Payload: " HTML Injection Payload: Visit Our New WebSite e x a m p l e . c o m...

Daylight Studio Fuel CMS跨站脚本漏洞

Daylight Studio Fuel CMS is a CodeIgniter-based content management system. A security vulnerability exists in Daylight Studio Fuel CMS 1.5.1 that allows HTML injection attacks...

Acronis: HTML Injection in E-mail

Hello Gents, + While testing "account.acronis.com", I found that "first name" could be injected with HTML tags while sending an email invitation. But this attack requires user interaction to confirm the email first, then he/she will receive a welcome email "Welcome to your Acronis Cyber Protect...

CVE-2022-24229

The CVE-2022-24229 entry describes an XSS vulnerability in ONLYOFFICE Document Server Example prior to version 7.0.0. The affected component/path is the example editor endpoint (/example/editor), allowing remote attackers to inject arbitrary HTML or JavaScript. The issue is tied to an external we...

Cross site scripting

Social Codia SMS v1 was discovered to contain a stored cross-site scripting XSS vulnerability via addpost.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field...

CVE-2022-27348

CVE-2022-27348 affects Social Codia SMS v1 (inventory management system). The connected documents confirm a stored cross-site scripting (XSS) vulnerability in add_post.php, where an attacker can inject a crafted payload into the Post Title text field to execute arbitrary web scripts/HTML. Root ca...

GitLab: Content injection in Jira issue title enabling sending arbitrary POST request as victim

Summary The issue described here leads to the same outcome as my previous report, https://hackerone.com/reports/1409788 . So look into that one for further details on the JavaScript gadgets. Also see my report https://hackerone.com/reports/1481207 for a detailed rundown of injections in GitLab...

minewebcms 1.15.2 Cross Site Scripting

Exploit Title: minewebcms 1.15.2 - Cross-site Scripting XSS Google Dork: NA Date: 02/20/2022 Exploit Author: Chetanya Sharma @AggressiveUser Vendor Homepage: https://mineweb.org/ Software Link: https://github.com/mineweb/minewebcms Version: 1.15.2 Tested on: KALI OS CVE : CVE-2022-1163...

minewebcms 1.15.2 - Cross-site Scripting Vulnerability

Exploit Title: minewebcms 1.15.2 - Cross-site Scripting XSS Google Dork: NA Exploit Author: Chetanya Sharma @AggressiveUser Vendor Homepage: https://mineweb.org/ Software Link: https://github.com/mineweb/minewebcms Version: 1.15.2 Tested on: KALI OS CVE : CVE-2022-1163 --------------- Steps to...