Dell EMC RSA Authentication Manager CVE-2019-18574 HTML Injection Vulnerability

Description Dell EMC RSA Authentication Manager is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based...

Siemens Polarion Multiple Cross Site Scripting and HTML Injection Vulnerabilities

Description Siemens Polarion is prone to multiple cross-site scripting vulnerabilities and an HTML-injection vulnerability. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

Stored xss vulnerability in Seven Bears repository system (CNVD-2019-46637)

Seven bears library system is a similar to Baidu library online document preview, selling system. A stored xss vulnerability exists in the Seven Bears library system, which can be exploited by an attacker to inject arbitrary Web script or HTML...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in POSH aka Posh portal or Portaneo 3.0 through 3.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 error parameter to /includes/plugins/mobile/scripts/login.php or 2 id parameter to portal/openrssarticle.php...

CVE-2013-0202

The CVE-2013-0202 entry applies to ownCloud with XSS in core/ajax/sharing.php. Affected versions include ownCloud Server < 4.0.11 and

CVE-2015-2793

Cross-site scripting XSS vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openididentifier parameter in a verify action to ikiwiki.cgi...

Zomato: HTML injection leads to reflected XSS

The following payload was used to bypass the WAF: html "...

CVE-2011-4454

The CVE-2011-4454 entry corresponds to multiple XSS vulnerabilities in Tiki Wiki CMS Groupware, affected through path-info in 8.0 RC1 and earlier (tiki-remind_password.php, tiki-index.php, tiki-login_scr.php, tiki-index). The root cause is improper handling of path input leading to injection of a...

CVE-2013-0193

Cross-site Scripting XSS in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195...

CVE-2013-0195

Cross-site Scripting XSS in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194...

CVE-2013-0194

Cross-site Scripting XSS in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195...

CVE-2013-0194

CVE-2013-0194 is an XSS vulnerability in Matomo (formerly Piwik) before 1.10.1. The flaw allows remote attackers to inject arbitrary JavaScript/HTML via unspecified vectors, potentially impacting user sessions and data integrity. Multiple connected sources (CNVD entries and related CVEs) corrobor...

Cisco Unified Communications Domain Manager CVE-2019-15968 HTML Injection Vulnerability

Description Cisco Unified Communications Domain Manager is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing...

Cross site scripting

Cross-site Scripting XSS in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins...

CVE-2019-19085

CVE-2019-19085 is a persistent XSS in Octopus Server (versions 3.4.0 through 2019.10.5). According to the provided documents, remote authenticated attackers could inject arbitrary web script/HTML. The sources do not specify exploitation status, affected product families beyond Octopus Server, or ...

Apache Atlas CVE-2019-10070 HTML Injection Vulnerability

Description Apache Atlas is prone to an HTML injection vulnerability because it fails to sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...

Zomato: HTML Injection @ /[restaurant]/order endpoint.

The following payloads were used to bypass the WAF and perform XSS: Basic payload but did not work on all browsers: html " Payload worked on all browsers, but needed a right-click to be executed: html "XSS...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 stats/index.php or 2 newsletters/edition.php or the 3 username parameter to users/remindpassword.php, 4 days parameter to...

CVE-2012-5193

Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 stats/index.php or 2 newsletters/edition.php or the 3 username parameter to users/remindpassword.php, 4 days parameter to...

WordPress IgniteUp plugin <=3.4 - Multiple vulnerabilities

Multiple vulnerabilities found by Jerome Bruandet in WordPress IgniteUp plugin versions =3.4. Vulnerabilities that could be exploited by unauthenticated users include Arbitrary File Deletion, HTML injection & CSRF in email messages, Stored Cross-Site Scripting XSS, Sensitive Information Disclosur...