16693 matches found
CVE-2013-0202
The CVE-2013-0202 entry applies to ownCloud with XSS in core/ajax/sharing.php. Affected versions include ownCloud Server < 4.0.11 and
CVE-2015-2793
Cross-site scripting XSS vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openididentifier parameter in a verify action to ikiwiki.cgi...
Zomato: HTML injection leads to reflected XSS
The following payload was used to bypass the WAF: html "...
CVE-2011-4454
The CVE-2011-4454 entry corresponds to multiple XSS vulnerabilities in Tiki Wiki CMS Groupware, affected through path-info in 8.0 RC1 and earlier (tiki-remind_password.php, tiki-index.php, tiki-login_scr.php, tiki-index). The root cause is improper handling of path input leading to injection of a...
CVE-2013-0193
Cross-site Scripting XSS in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0194 and CVE-2013-0195...
CVE-2013-0195
Cross-site Scripting XSS in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0194...
CVE-2013-0194
Cross-site Scripting XSS in Piwik before 1.10.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: This is a different vulnerability than CVE-2013-0193 and CVE-2013-0195...
CVE-2013-0194
CVE-2013-0194 is an XSS vulnerability in Matomo (formerly Piwik) before 1.10.1. The flaw allows remote attackers to inject arbitrary JavaScript/HTML via unspecified vectors, potentially impacting user sessions and data integrity. Multiple connected sources (CNVD entries and related CVEs) corrobor...
Cisco Unified Communications Domain Manager CVE-2019-15968 HTML Injection Vulnerability
Description Cisco Unified Communications Domain Manager is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing...
Cross site scripting
Cross-site Scripting XSS in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML via a crafted URL that points to Jenkins...
CVE-2019-19085
CVE-2019-19085 is a persistent XSS in Octopus Server (versions 3.4.0 through 2019.10.5). According to the provided documents, remote authenticated attackers could inject arbitrary web script/HTML. The sources do not specify exploitation status, affected product families beyond Octopus Server, or ...
Apache Atlas CVE-2019-10070 HTML Injection Vulnerability
Description Apache Atlas is prone to an HTML injection vulnerability because it fails to sanitize user-supplied input. Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based...
Zomato: HTML Injection @ /[restaurant]/order endpoint.
The following payloads were used to bypass the WAF and perform XSS: Basic payload but did not work on all browsers: html " Payload worked on all browsers, but needed a right-click to be executed: html "XSS...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 stats/index.php or 2 newsletters/edition.php or the 3 username parameter to users/remindpassword.php, 4 days parameter to...
CVE-2012-5193
Multiple cross-site scripting XSS vulnerabilities in Bitweaver 2.8.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to 1 stats/index.php or 2 newsletters/edition.php or the 3 username parameter to users/remindpassword.php, 4 days parameter to...
WordPress IgniteUp plugin <=3.4 - Multiple vulnerabilities
Multiple vulnerabilities found by Jerome Bruandet in WordPress IgniteUp plugin versions =3.4. Vulnerabilities that could be exploited by unauthenticated users include Arbitrary File Deletion, HTML injection & CSRF in email messages, Stored Cross-Site Scripting XSS, Sensitive Information Disclosur...
WordPress ultimate-faqs plugin HTML content injection vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. ultimate-faqs is a FAQ plugin used in it. An HTML content injection vulnerability exists in the Functions/EWDUFAQImport.php file in...
CVE-2019-10219
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...
CVE-2019-10219
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack...