344 matches found
UBIT Student Information Management System 跨站脚本漏洞
UBIT Student Information Management System is a student management system from UBIT. A security vulnerability exists in UBIT Student Information Management System prior to version 20211126, which is an XSS vulnerability that stems from improperly neutralizing HTML-related tags in web pages...
CVE-2023-0333 TemplatesNext ToolKit < 3.2.9 - Contributor+ Stored XSS
The TemplatesNext ToolKit WordPress plugin before 3.2.9 does not validate some of its shortcode attributes before using them to generate an HTML tag, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
GHSA-6JJ8-MQX2-7FG5 FeehiCMS Cross Site Scripting vulnerability
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
CVE-2020-36607
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
Cross site scripting
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
FeehiCMS 跨站脚本漏洞
FeehiCMS is a Php based CMS builder by Liufee Personal Developer. A security vulnerability exists in FeehiCMS version 2.0.8. An attacker can exploit this vulnerability to execute arbitrary code via the lang attribute of the html tag...
CVE-2020-20589
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
CVE-2020-36607
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
CVE-2020-20589: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag...
Hardcoded credentials
Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action - Create a new Contextualize Action - Inject your HTML tag in the name field...
CVE-2022-46903
Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Stored XSS...
CVE-2021-41943
Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action - Create a new Contextualize Action - Inject your HTML tag in the name field...
CVE-2021-41943: Improper Neutralization of Input During Web Page Generation
Logrhythm Web Console 7.4.9 allows for HTML tag injection through Contextualize Action - Create a new Contextualize Action - Inject your HTML tag in the name field...
CVE-2022-46906
Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Reflected XSS...
Senayan Library Management System 9.0.0 Cross Site Scripting
Title: Senayan Library Management System v9.0.0 a.k.a SLIMS 9 Multiple XSS-Reflected vulnerabilities Author: nu11secur1ty Date: 12.09.2022 Vendor: https://slims.web.id/web/ Software: https://github.com/slims/slims9bulian/releases/download/v9.0.0/slims9bulian-9.0.0.zip Reference:...
ClicShopping 3.402 Cross Site Scripting
Title: ClicShoppingV3-Version3.402 XSS-Reflected Author: nu11secur1ty Date: 11.20.2022 Vendor: https://www.clicshopping.org/forum/ Software: https://github.com/ClicShopping/ClicShoppingV3/releases/tag/version3402 Reference:...
Cross site scripting
glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting XSS vulnerability. The value of the title request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. This input was echoed unmodified in the application's response...
CVE-2022-31187
GLPI (Gestionnaire Libre de Parc Informatique) is affected by CVE-2022-31187 due to insufficient neutralization of HTML tags in the global search context. The public advisory states that affected GLPI versions require upgrading to 10.0.3 to resolve the issue, or, if upgrading is not possible, dis...
Cross-site Scripting (XSS)
getkirby/cms is vulnerable to Cross-site Scripting XSS. The use of the v-html tag in MultiselectInput.vue allows an attacker to inject and execute malicious javascript through the dynamic options in the multi-select field...
