Cross site scripting

Cross-site scripting XSS vulnerability in IBM Rational Quality Manager RQM 4.x before 4.0.7 iFix3 and 5.x before 5.0.2 allows remote authenticated users to inject arbitrary web script or HTML via a crafted URL...

Ckeditor 4.4.7 Shell Upload / Cross Site Scripting

----------------------------------------- 0-DAY Aint DIE | No Priv8 | KedAns-Dz ----------------------------------------- ---------------------------- K |................| . h |.......................| A a |.......................| N l |.....................| S E |.......................| e D...

Cross site scripting

Cross-site scripting XSS vulnerability in ZeusCart 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action to index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in OpenKM before 6.4.19 build 23338 allows remote authenticated users to inject arbitrary web script or HTML via the Subject field in a Task to frontend/index.jsp...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in ZeusCart 4 allow remote attackers to inject arbitrary web script or HTML via the 1 schltr parameter in a brands action or 2 brand parameter in a viewbrands action to index.php. NOTE: The search parameter vector is already covered by CVE-2010-53...

CVE-2010-5322

Cross-site scripting XSS vulnerability in ZeusCart 4.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter in a search action to index.php...

CVE-2015-2217

Multiple cross-site scripting XSS vulnerabilities in Ultimate PHP Board aka myUPB before 2.2.8 allow remote attackers to inject arbitrary web script or HTML via the 1 q parameter to search.php or 2 avatar parameter to profile.php...

GeniXCMS 0.0.1 - Multiple Vulnerabilities

GeniXCMS 0.0.1 - Multiple Vulnerabilities GeniXCMS v0.0.1 Remote Unauthenticated SQL Injection Exploit Vendor: MetalGenix Product web page: http://www.genixcms.org Affected version: 0.0.1 Summary: GenixCMS is a PHP Based Content Management System and Framework CMSF. It's a simple and lightweight...

CVE-2015-2244

CVE-2015-2244 involves multiple XSS vulnerabilities in Webshop hun 1.062S where remote attackers can inject arbitrary script or HTML via the index.php parameters (param, center, lap, termid, nyelv_id). Affected software: Webshop hun 1.062S. The root cause is insufficient input sanitization on tho...

CVE-2015-0893

Cross-site scripting XSS vulnerability in Maroyaka CGI Maroyaka Relay Novel allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-0892

Cross-site scripting XSS vulnerability in Maroyaka CGI Maroyaka Image Album allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Loxone Smart Home HTML Injection Vulnerability

Loxone Smart Home is a WEB-based application. Loxone Smart Home suffers from an HTML injection vulnerability that could be exploited by an attacker to execute arbitrary HTML script and code in the context of the affected application...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in editprefs.php in Beehive Forum 1.4.4 allow remote attackers to inject arbitrary web script or HTML via the 1 homepageurl, 2 picurl, or 3 avatarurl parameter, which are not properly handled in an error message...

HackerOne: Improperly validated fields allows injection of arbitrary HTML via spoofed React objects

Note: I haven't yet investigated the implications of this fully, so this may be more severe than I'm currently aware of. Right now the only exploits I'm aware of allow a team member to attack other team members. I've found a couple fields that I'd expect to be limited to string values, but which...

Multiple Cross-Site Scripting Vulnerabilities in PNMsoft Sequence Kinetics

PNMsoft Sequence Kinetics is a next-generation business process management suite released by Israel-based PNMsoft that enables rapid establishment of high-availability workflow applications and close human collaboration on change while maintaining lifecycle governance. Multiple cross-site scripti...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in SAP HANA 73 1.00.73.00.389160 and HANA Developer Edition 80 1.00.80.00.391861 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to 1 ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or 2...

CVE-2015-2103

CVE-2015-2103 describes a Cross‑site Scripting (XSS) flaw in Cosmoshop’s admin-login panel (admin/index.cgi). The vulnerability allows remote attackers to inject arbitrary web script or HTML through the username field (u_name parameter). According to the NVD entry, the impact is partial integrity...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in zencart-ja aka Zen Cart Japanese edition 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/initincludes/initsanitize.php and...

CVE-2015-0882

CVE-2015-0882 affects Zen Cart Japanese edition (zencart-ja) in versions 1.3 jp up to 1.3.0.2 jp8 and 1.5 ja up to 1.5.1 ja. The flaw is a cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary script or HTML via a crafted parameter related to admin/includes/ini...

CVE-2015-2086

Cross-site scripting XSS vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title...