16220 matches found
CVE-2018-18675
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board title contents" parameter, aka the adm/boardformupdate.php bomobilesubject parameter...
CVE-2018-18676
GNUBOARD5 5.3.1.9 contains a cross‑site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script/HTML through the mobile board tail contents parameter (adm/board_form_update.php bo_mobile_content_tail). This CVE (CVE-2018-18676) affects GNUBOARD5; exploitation details...
CVE-2018-18676
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board tail contents" parameter, aka the adm/boardformupdate.php bomobilecontenttail parameter...
CVE-2018-18671
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/boardformupdate.php bomobilecontenthead parameter...
CVE-2018-18671
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/boardformupdate.php bomobilecontenthead parameter...
Design/Logic Flaw
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/boardformupdate.php bomobilecontenthead parameter...
CVE-2018-18672
GNUBOARD5 5.3.1.9 contains an XSS vulnerability in the adm/board_form_update.php endpoint via the board head contents (bo_content_head) parameter, allowing remote script execution in a victim’s browser. The issue is confirmed across multiple sources (Red Hat, CNVD, NVD, osv) and is tied to GNUBOA...
CVE-2018-18670
CVE-2018-18670 affects GNUBOARD5 version 5.3.1.9, where an XSS vulnerability exists allowing remote attackers to inject arbitrary web script or HTML via the "Extra Contents" parameter (also identified as the adm/config_form_update.php cf_1~10 parameter). The issue stems from insufficient validati...
CVE-2018-18671
GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/boardformupdate.php bomobilecontenthead parameter...
XSS Vulnerability in UQCMS Single Merchant System
UQCMS Single Merchant System is an external display and shopping system suitable for running your own products. UQCMS Single Merchant System suffers from an XSS vulnerability, which can be exploited by attackers to inject arbitrary Web script or HTML...
CVE-2019-12834
In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATHINFO to the dashboards/ URI...
CVE-2019-12834
In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATHINFO to the dashboards/ URI...
Cross site scripting
A Cross Site Scripting XSS vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msg...
Cross-Site Scripting (XSS)
GROWI are vulnerable to cross-site scripting attacks. A remote, authenticated attacker could exploit the flawed New Page Handler component to inject and execute arbitrary web script or HTML into victim's browser...
Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2019-22260)
Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...
CVE-2019-12930
A cross-site scripting XSS vulnerability in noMenu and noSubMenu in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows remote attackers to inject arbitrary web script or HTML via the method parameter...
CVE-2019-5970
The CVE-2019-5970 entry applies to WordPress Plugin Attendance Manager (versions ≤ 0.5.6). The vulnerability is a Self-reported Stored Cross-Site Scripting (CWE-79) in which an attacker can inject arbitrary script/HTML via unspecified vectors, potentially executing code in the administrator’s bro...
Weblate: HTML injection and information disclosure in support panel
Hello Weblate Team! I found HTML injection and information disclosure in support panel Description There is a form to weblate.org and hosted.weblate.org to send to support I poisoned the request, where I inserted such payload in all fields: " After that, when my payload got into the support panel...