16147 matches found
html injection vulnerability in the `tuitse_html` function.
Impact When using tuitsehtml without quoting the input, there is a html injection vulnerability. It should use the django version django.utils.html.formathtml, instead of string.format Patches Upgrade to version 1.3.2. Workarounds Sanitizing Taigi input with HTML quotation. References...
GHSA-M4M5-J36M-8X72 html injection vulnerability in the `tuitse_html` function.
Impact When using tuitsehtml without quoting the input, there is a html injection vulnerability. It should use the django version django.utils.html.formathtml, instead of string.format Patches Upgrade to version 1.3.2. Workarounds Sanitizing Taigi input with HTML quotation. References...
PT-2024-19821 · Unknown · Tuitse-Tsusin
Name of the Vulnerable Software and Affected Versions: TuiTse-TsuSin versions prior to 1.3.2 Description: The issue is related to a html injection vulnerability when using tuitse html without quoting the input. This vulnerability can be exploited when the tuitse html function is used without prop...
Html Injection
libSOGo.so is vulnerable to HTML injection. The vulnerability is due to improper HTML sanitization within the SOGo Web Mail component, allowing an attacker to preform a phishing attack...
CVE-2023-48858
A Cross-site scripting XSS vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part...
CVE-2023-48858
A Cross-site scripting XSS vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part...
Cross-site scripting (XSS) in Action messages on Avo
Avo is a framework to create admin panels for Ruby on Rails apps. In Avo 3 pre12 any HTML inside text that is passed to error or succeed in an Avo::BaseAction subclass will be rendered directly without sanitization in the toast/notification that appears in the UI on Action completion. A malicious...
CVE-2024-22411
Consolidated finding: CVE-2024-22411 affects the Avo framework for Ruby on Rails. In Avo 3 pre12, HTML content inside text passed to error or succeed in an Avo::BaseAction is rendered un Sanitized in the UI toast/notification, enabling cross-site scripting (XSS). The issue can impact users of Avo...
CVE-2023-6046
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfilteredhtml capability is disallowed...
CVE-2023-6046
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfilteredhtml capability is disallowed...
Design/Logic Flaw
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfilteredhtml capability is disallowed...
CVE-2023-6046 EventON < 2.2 - Admin+ Stored HTML Injection
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfilteredhtml capability is disallowed...
CVE-2023-6046
The CVE-2023-6046 entry describes a vulnerability in the EventON WordPress plugin prior to version 2.2. The issue is caused by insufficient sanitization and escaping of certain settings, enabling stored HTML injection by high-privilege users (e.g., admins) even when unfiltered_html is disallowed....
CVE-2023-6046 EventON < 2.2 - Admin+ Stored HTML Injection
The EventON WordPress plugin before 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored HTML Injection attacks even when the unfilteredhtml capability is disallowed...
avo vulnerable to stored cross-site scripting (XSS) in key_value field
Summary A stored cross-site scripting XSS vulnerability was found in the keyvalue field of Avo v3.2.3. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. Details The value of the keyvalue is inserted directly into the HTML code. In the current...
GHSA-GHJV-MH6X-7Q6H avo vulnerable to stored cross-site scripting (XSS) in key_value field
Summary A stored cross-site scripting XSS vulnerability was found in the keyvalue field of Avo v3.2.3. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim's browser. Details The value of the keyvalue is inserted directly into the HTML code. In the current...
CVE-2023-48104
Alinto SOGo before 5.9.1 is vulnerable to HTML Injection...
DEBIAN-CVE-2023-48104
Alinto SOGo before 5.9.1 is vulnerable to HTML Injection...