25 matches found
CVE-2026-19217 Royal Elementor Addons < 1.7.1065 - Contributor+ Stored XSS via Icon Box Widget
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2026-19217
The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2026-39839
Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7...
PT-2025-43281
Name of the Vulnerable Software and Affected Versions AmentoTech Doctreat versions through 1.6.7 Description The software contains an Improper Neutralization of Script-Related HTML Tags in a Web Page issue, which allows for Code Injection. This is a Basic Cross-Site Scripting XSS condition...
EUVD-2001-0818
Malware in sbrugna...
EUVD-2021-28939
Malicious code in bioql PyPI...
CVE-2022-46904
Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Self-XSS...
CVE-2024-11824 Stored XSS in langgenius/dify
A stored cross-site scripting XSS vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like and are not disallowed, allowing an attacker to inject malicious HTML into the log via prompts. When an adm...
PT-2024-41124 · Ооо 'Симпл 1' · Simpleone Platform
Уязвимость программного обеспечения SimpleOne Platform, связанная с непринятием мер по нейтрализации scipt-related тэгов html на веб-странице. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, внедрить HTML-тег с указанием ссылки на внешний ресурс...
U.S. Dept Of Defense: Reflected Cross-site Scripting via search query on ██████
The summary is as follows: A reflected cross-site scripting vulnerability was discovered in the search query functionality of the ████████ website. An attacker could execute arbitrary JavaScript code in the victim's browser by injecting malicious payload into the search query parameter...
The vulnerability of the mb_strpos() function in the Bitrix24 business management service allows a attacker to perform XSS attacks.
The vulnerability of the mbstrpos function in the Bitrix24 business management service is related to the lack of measures taken to neutralize the script injection scenario in web pages. Exploiting this vulnerability allows a remote attacker to execute XSS attacks by embedding HTML tags at the...
Hardcoded credentials
Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action - Create a new Contextualize Action - Inject your HTML tag in the name field...
CVE-2022-46903
Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Stored XSS...
CVE-2021-41943
Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action - Create a new Contextualize Action - Inject your HTML tag in the name field...
CVE-2022-46906
Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Reflected XSS...
Devolutions Server 跨站脚本漏洞
Devolutions Server is an application from Devolutions Canada. It provides a full-featured shared account and password management solution. A security vulnerability exists in versions of Devolutions Server prior to 2022.2, which stems from the fact that some HTML tags can be injected into the head...
PT-2022-19511 · Nagios Xi · Nagios Xi
Name of the Vulnerable Software and Affected Versions: Nagios XI versions 5.8.5 and earlier Description: The issue allows an authenticated attacker to inject HTML tags in the schedule report function, leading to the reformatting or editing of emails from an official email address. Recommendations...
GHSA-9VHV-P9R7-RM53 HTML tag injection
Serve Handler, before 5.0.3, has a XSS via HTML tag injection in directory lisiting page...
GitLab Username Format Restriction Bypass Vulnerability
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A vulnerability exists in GitLab versions prior to 13.1 that can be exploited to bypass the usernam...