PT-2020-7323

Name of the Vulnerable Software and Affected Versions: SocialEngine versions prior to 4.2.4 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the title parameter to "music/create", the location parameter to "events/create", or the sear...

PT-2020-7205

Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.4.9 Description The issue allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to "ajax.php" API endpoint. This is a cross-site scripting XSS issue. Recommendation...

PT-2020-7660

Name of the Vulnerable Software and Affected Versions MyBB versions prior to 1.8.4 Description The issue allows remote authenticated users to inject arbitrary web script or HTML. This can be achieved via the title parameter in the edit or add action in the user-users module, the finduser action, ...

PT-2020-7204

Name of the Vulnerable Software and Affected Versions pragmaMx versions 1.x before 1.12.2 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the name parameter to "modules.php" or the img url to...

PT-2020-7370

Name of the Vulnerable Software and Affected Versions: The Bug Genie versions prior to 3.2.6 Description: The issue concerns Multiple XSS and HTML Injection vulnerabilities. Recommendations: For versions prior to 3.2.6, update to version 3.2.6 or later to resolve the issue...

PT-2020-7148

Name of the Vulnerable Software and Affected Versions Ariadne version 2.7.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via the PATH INFO parameter to API endpoints such as "index.php" and "loader.php". Recommendations For Ariadne version 2.7.6, consider...

CVE-2013-1760: Improper Neutralization of Input During Web Page Generation

The Bug Genie before 3.2.6 has Multiple XSS and HTML Injection Vulnerabilities...

Cross site scripting

Cross-site scripting XSS vulnerability in Flowplayer Flash 3.2.7 through 3.2.16, as used in the News system news extension for TYPO3 and Mahara, allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin...

CVE-2014-9470

Fork CMS prior to 3.8.4 is affected by a cross-site scripting (XSS) vulnerability in the loadForm() function (Frontend/Modules/Search/Actions/Index.php) where the q_widget parameter to /en/search can inject arbitrary script/HTML. The issue arises from insufficient input filtering and is exploitab...

PT-2020-7802

Name of the Vulnerable Software and Affected Versions: WordPress Photo Gallery plugin versions prior to 1.2.11 Description: The issue allows remote authenticated users to inject arbitrary web script or HTML via certain parameters in an addImages action to the "wp-admin/admin-ajax.php" API endpoin...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/system.html in Openfiler 2.3 allows remote attackers to inject arbitrary web script or HTML via the device parameter...

CVE-2020-8788

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...

Design/Logic Flaw

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...

CVE-2020-8788

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...

CVE-2020-8788

The CVE-2020-8788 entry affects Synaptive Medical ClearCanvas ImageServer 3.0 Alpha and is caused by an XSS/HTML injection vulnerability in the Default.aspx UserName parameter. The connected documents confirm the affected product and the injection vector, but do not provide additional exploit det...

PT-2020-20278

Name of the Vulnerable Software and Affected Versions Synaptive Medical ClearCanvas ImageServer version 3.0 Alpha Description The issue allows for XSS and HTML injection via the UserName parameter in the "Default.aspx" endpoint. Recommendations For Synaptive Medical ClearCanvas ImageServer versio...

CVE-2020-8788: Improper Neutralization of Input During Web Page Generation

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS and HTML injection via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report...

Cross site scripting

Cross-site Scripting XSS in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-2684: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS in Cisco Linksys E4200 1.0.05 Build 7 devices allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Open-Xchange: XSS - Guard - Insufficient escaping of User-IDs from PGP Keys

Vulnerability PGP user IDs are typically in form of name and OX Guard properly escapes angle brackets when inserting them to HTML. But in the code for displaying a list of keys it inserts IDs into HTML attributes without escaping double quote characters. javascript //...