PT-2023-20445 · Part-Db · Part-Db

Name of the Vulnerable Software and Affected Versions: Part-DB versions prior to 1.0.2 Description: Part-DB is an open source inventory management system for electronic components. A issue was found where user input was not properly escaped, allowing malicious users to inject arbitrary HTML into...

part-db 跨站脚本漏洞

part-db is a web-based database for managing electronic components. A security vulnerability exists in part-db versions prior to 1.0.2, which stems from not properly escaping user input and can be exploited by an attacker to inject arbitrary HTML into a page...

Cross site scripting

A Reflected Cross-site scripting XSS vulnerability in interface/forms/eyemag/php/eyemagfunctions.php in OpenEMR 7.0.0 allows remote authenticated users to inject arbitrary web script or HTML via the REQUESTURI...

Stored XSS in Customer Support

Description Attacker can send xss payload in Customer Support Proof of Concept Request Payload: POST /xhr/?module=customer-support&page=addCaseReply HTTP/1.1 Host: demo.bumsys.org Cookie: 80e72166c3164cd4e1f55b5348364ee4f8bc0d12=655mqrm2v9uhktlqpke0h026d4; eid=1; currencySymbol=%E0%A7%B3;...

HTML Injection

phpmyfaq is vulnerable to HTML Injection. The vulnerability exists due to improper input sanitization in the tags component, which allows an attacker to inject and execute malicious HTML content, possibly resulting in code execution...

Improper Neutralization of Input in paperWidth param During Web Page Generation

Module : print and invoice-print Parameter : paperWidth Attacker would be able to close the tag and can inject html tags POC : http://demo.bumsys.org/print?&paperWidth=;%3C/style%3E%3Cbody+onpageshow=alertdocument.domain%3E POC :...

K8280: Cross-site scripting vulnerabilities in BIG-IP Configuration utility CVE-2008-0265

Security Advisory Description Note : Versions that are not listed in this article have not been evaluated for vulnerability to this security advisory. For information about the F5 security policy regarding evaluating older and unsupported versions of F5 products, refer to K4602: Overview of the F...

K48572812: XSS vulnerability in F5 WebSafe Dashboard CVE-2016-5235

Security Advisory Description A Cross Site Scripting XSS vulnerability in F5 WebSafe Dashboard allows an unauthenticated user to inject HTML via a crafted alert. CVE-2016-5235 Impact The F5 WebSafe Dashboard may allow modification by unauthorized users. Security Advisory Status F5 Product...

Stored HTML injection and Potential Cross Site Scripting in pixelfed ≤ 0.11.4

Description pixelfed ≤ 0.11.4 is affected by HTML injection and Potential Cross Site Scripting vulnerability. Steps to Reproduce: 1.Choose any server from https://pixelfed.org/servers and go to registration page. 2.Enter your username, email, password and enter following payload on "Name" paramet...

XSS

Description HTML injection in user profile Vulnerability is in: http://34.245.133.152:9080/users/settings/profile - About Me Proof of Concept Request: PUT /answer/api/v1/user/info HTTP/1.1 Host: localhost:9080 Content-Length: 213 sec-ch-ua: "Not ABrand";v="24", "Chromium";v="110" Content-Type:...

Mozilla: HTML Injection / Reflected Cross-Site Scripting with CSP on https://accounts.firefox.com/settings

A vulnerability was found on accounts.firefox.com, where the flowId parameter was reflected into the server response without being escaped for HTML, causing a Cross-Site Scripting attack. The Content-Security-Policy on Firefox's website prevented arbitrary JavaScript code execution, but an attack...

CVE-2023-24081

Multiple stored cross-site scripting XSS vulnerabilities in Redrock Software TutorTrac before v4.2.170210 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the reason and location fields of the visits listing page...

Stored HTML Injection inside the >>> Request payment >>> Request Customer Data Checkout >>> Request shipping address

Team, I hope you are all doing well. . I wanted to bring to your attention a potential vulnerability on the website https://mainnet.demo.btcpayserver.org/stores/6YSiuoN6q1yF2ucWZvWojBuVJAJzXxFFUn9cw8iNPPMC/payment-requests/edit/ec575d56-6b8e-41bd-8b9a-bdcda9c5daad. . During my research, I...

Microsoft Windows Contact File Remote Code Execution Vulnerability

Microsoft Windows Contact file / Remote Code Execution Resurrected 2022 / CVE-2022-44666 + John Page aka hyp3rlinx + twitter.com/hyp3rlinx + ISR: ApparitionSec Back in 2018 I discovered three related Windows remote code execution vulnerabilities affecting both VCF and Contact files. They were...

Stored HTML Injection

phpmyfaq is vulnerable to Stored HTML Injection. The vulnerability exists due to improper handling of inputs through the FAQ-Proposal Form, which allows an attacker to inject and execute malicious HTML content in the web page when an admin views the proposal, possibly leading to code execution...

Stored HTML Injection

phpmyfaq is vulnerable to Stored HTML Injection. The vulnerability exists due to improper handling of inputs through the Question Form, which allows an attacker to inject and execute malicious HTML content in the web page when an admin approves the question, possibly leading to code execution...

HTML injection leads to Open Redirect

Description Hello, I have located an html injection in the symbol field: Steps : 1 - log in as administrator 2 - Go to Options 3 - Go to Currencies 4 - Insert the html code in the symbol field and by inserting the following payload i was able to redirect the user to a malicious site. CLICK ME Pro...

SUSE CVE-2004-1318

Cross-site scripting XSS vulnerability in namazu.cgi for Namazu 2.0.13 and earlier allows remote attackers to inject arbitrary HTML and web script via a query that starts with a tab "%09" character, which prevents the rest of the query from being properly sanitized...

SUSE CVE-2006-6942

Multiple cross-site scripting XSS vulnerabilities in PhpMyAdmin before 2.9.1.1 allow remote attackers to inject arbitrary HTML or web script via 1 a comment for a table name, as exploited through a dboperations.php, 2 the db parameter to b dbcreate.php, 3 the newname parameter to dboperations.php...

SUSE CVE-2015-6784

The page serializer in Google Chrome before 47.0.2526.73 mishandles Mark of the Web MOTW comments for URLs containing a "--" sequence, which might allow remote attackers to inject HTML via a crafted URL, as demonstrated by an initial http://example.com?-- substring...