CVE-2021-28161

In Eclipse Theia versions up to and including 1.8.0, in the debug console there is no HTML escaping, so arbitrary Javascript code can be injected...

Liberapay: Login CSRF : Login Authentication Flaw on https://liberapay.com/

Description: There is no csrf validation while logging in which leads to csrf. An attacker can craft an HTML page containing information to have the victim sign into an attacker's account, where the victim may add sensitive payment information to the attacker's new account assuming he/she is logg...

Batflat Cross-Site Scripting Vulnerability (CNVD-2021-18015)

Batflat is a simple, lightweight content management system CMS. A cross-site scripting vulnerability exists in Galleries in Batflat 1.3.6. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via field names...

Cross site scripting

Cross-site scripting XSS vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name...

Joomla Matukio Events 7.0.5 Cross Site Scripting Vulnerability

Exploit Title:Joomla Matukio Events 7.0.5 Stored XSS Author: Vincent666 ibn Winnie Software Link: https://matukio.compojoom.com/ Tested on: Windows 10 Web Browser: Mozilla Firefox My Youtube Channel : https://www.youtube.com/channel/UCZOWpC2dW9sipPq5z63C2rQ Google Dorks: inurl:option=commatukio...

CVE-2020-4725

IBM Monitoring IBM Cloud APM 8.1.4 could allow an authenticated user to modify HTML content by sending a specially crafted HTTP request to the APM UI, which could mislead another user. IBM X-Force ID: 187974...

DuckDuckGo: Reflected/Stored XSS on duckduckgo.com

Hi DuckDuckGo, While browsing normally since I use DuckDuckGo on a daily basis, I discovered an interesting stored XSS on the duckduckgo main search engine. A payload that somebody had left on urbandictionary.com had triggered a HTML injection, and a stored XSS as a result. Steps to Reproduce 1...

PT-2021-14428 · Synapse +1 · Synapse +1

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.27.0 Description: The notification emails sent for notifications for missed messages or for an expiring account are subject to HTML injection. In the case of the notification for missed messages, this could allow a...

Persistent XSS through Team Calendar in Confluence Server - CVE-2020-29444

Affected versions of Team Calendar in Confluence Server allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting vulnerability in admin global setting parameters. h3. Affected versions: 7.11.0 h3. Fixed version: 7.11.0 This vulnerability is attributed to Stefano...

CS Money: Html injection on subscription email

Vulnerability description not provided...

Nextcloud: HTML Injection on "polls" app - comments section (possibly XSS)

Hi everyone, On latest version of Polls app 1.7.5, I noticed a lack of user input filtering for the "Description" part of the survey. An HTML injection is therefore possible. I tried to inject JavaScript code to get an XSS but I didn't succeed. Certainly someone better than me will be able to do...

Design/Logic Flaw

In nopCommerce 4.30, a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter...

Jenzabar 9.2.2 - 'query' Reflected XSS.

Exploit Title: Jenzabar 9.2.2 - 'query' Reflected XSS. Date: 2021–02–06 Exploit Author: y0ungdst Vendor Homepage: https://jenzabar.com Version: Jenzabar — v9.2.0-v9.2.1-v9.2.2 and maybe other versions Tested on: Windows 10 CVE : CVE-2021–26723 -Description: A Reflected Cross-site scripting XSS...

ZOHO ManageEngine Remote Access Plus Injection Vulnerability

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An injection vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.259, which allows injection of HTML via the Admin - User Administration userMgmt.do?actionToCall=ShowUser field.No detailed Details of...

CVE-2019-16268

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

CVE-2019-16268

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

Design/Logic Flaw

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

CVE-2019-16268

Zoho ManageEngine Remote Access Plus 10.0.259 is affected by an HTML injection vulnerability in the Admin - User Administration screen (userMgmt.do?actionToCall=ShowUser). The issue concerns the Description field and is documented across multiple sources (NVD, Red Hat advisory, CNVD). No exploit ...

CVE-2019-16268

Zoho ManageEngine Remote Access Plus 10.0.259 allows HTML injection via the Description field on the Admin - User Administration userMgmt.do?actionToCall=ShowUser screen...

ZOHO ManageEngine Remote Access Plus 注入漏洞

ZOHO ManageEngine Remote Access Plus is a remote access solution from ZOHO. An injection vulnerability exists in Zoho ManageEngine Remote Access Plus version 10.0.259, which allows injection of HTML via the Admin - User Administration userMgmt.do?actionToCall=ShowUser field.No detailed Details of...