Design/Logic Flaw

Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENTQUOTES flag these calls occur when the htmlescape function in lib/html.php is not used...

CVE-2018-10061

Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENTQUOTES flag these calls occur when the htmlescape function in lib/html.php is not used...

CVE-2018-10061

Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENTQUOTES flag these calls occur when the htmlescape function in lib/html.php is not used...

CVE-2018-10061

Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENTQUOTES flag these calls occur when the htmlescape function in lib/html.php is not used...

CVE-2018-10061: Improper Neutralization of Input During Web Page Generation

Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENTQUOTES flag these calls occur when the htmlescape function in lib/html.php is not used...

PT-2018-9650

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.1.37 Description: The issue arises from certain htmlspecialchars calls being made without the ENT QUOTES flag. This occurs when the html escape function in lib/html.php is not used, leading to XSS. Recommendations: F...

iwinhome.co.kr XSS vulnerability

Open Bug Bounty ID: OBB-574273 Description| Value ---|--- Affected Website:| iwinhome.co.kr Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N...

CVE-2017-12978

lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user...

CVE-2017-12978: Improper Neutralization of Input During Web Page Generation

lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user...

PT-2017-12816

Name of the Vulnerable Software and Affected Versions Cacti versions prior to 1.1.18 Description The issue allows for XSS via the title field of an external link added by an authenticated user in the lib/html.php file. Recommendations For versions prior to 1.1.18, update to version 1.1.18 or late...

PT-2012-1991

Name of the Vulnerable Software and Affected Versions Joomla! versions prior to 1.5.12 Description The issue allows remote attackers to inject arbitrary web script or HTML via the HTTP REFERER header to various components and templates, including 1 "components/com...

CVE-2011-4909: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Joomla! before 1.5.12 allow remote attackers to inject arbitrary web script or HTML via the HTTPREFERER header to 1 components/comcontent/views/article/tmpl/form.php, 2 components/comuser/controller.php, 3 plugins/system/legacy/html.php, or 4...

CVE-2010-2545

Cacti before 0.8.7g contains multiple XSS vulnerabilities (including CVE-2010-2545) in various templates and admin paths. The GLSA notes remote script injection and the need to upgrade to the 0.8.8+ series as remediation; affected vectors include template name and numerous PHP/graph-related compo...

CVE-2008-4557: Improper Control of Generation of Code

plugins/wacko/highlight/html.php in Strawberry in CuteNews.ru 1.1.1 aka Strawberry allows remote attackers to execute arbitrary PHP code via the text parameter, which is inserted into an executable regular expression...

CuteNews 1.1.1 - html.php Remote Code Execution

CuteNews 1.1.1 - html.php Remote Code Execution ---- CuteNews Remote Code Execution ... ITDefence.ru Antichat.ru Strawberry CuteNews Remote Code Execution Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / /...

CuteNews 1.1.1 - 'html.php' Remote Code Execution

---- CuteNews Remote Code Execution ... ITDefence.ru Antichat.ru Strawberry CuteNews Remote Code Execution Eugene Minaev [email protected] / \ \ \ / .\ / /// // / \ / \ // / / / /// /\ / / / / // / / / / / /\ / / / / / / / / / / / //\ \ / / / / // / // / /\ / // 2007 //// // //\ \ \...

CVE-2006-5047: Undefined Security Weakness

Unspecified vulnerability in rsgallery2.html.php in RS Gallery2 component comrsgallery2 before 1.11.3 for Joomla! allows attackers to execute arbitrary code...

CVE-2005-2997: Undefined Security Weakness

Multiple directory traversal vulnerabilities in PHP Advanced Transfer Manager 1.30 allow remote attackers to read arbitrary files via ".." sequences in 1 the currentdir parameter to txt.php, or the currentdir parameter to 2 htm.php or 3 html.php...