58 matches found
CVE-2022-35914_poc
CVE-2022-35914poc Modified for GLPI Offsec Lab: calluserfunc, arraymap, passthru References Modified to work for Proving Grounds Practice Lab: GLPI https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc/blob/main/CVE-2022-35914.p...
htmLawed - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-315
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The htmLawed filter does not sufficiently filter attributes, leading to a cross-site scripting XSS vulnerability. This vulnerability affects sites on Drupal...
htmLawed - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-314
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting XSS vulnerability. Only site...
PT-2026-137306
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The htmLawed filter does not sufficiently filter attributes, leading to a cross-site scripting XSS vulnerability. This vulnerability affects sites on Drupal...
PT-2026-137307
The htmLawed module enables use of the htmLawed PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The module's filtering of malicious HTML can be bypassed by using a malformed UTF8 character, leading to a cross-site scripting XSS vulnerability. Only site...
CVE-2022-35914-RCE
CVE-2022-35914 by cyb3rk0ala PoC for CVE-2022-35914 , a command-injection vulnerability involving the htmLawed test component in vulnerable GLPI installations. The tool provides command execution through the vulnerable endpoint and includes optional callback functionality for authorized lab...
HTMLawed
HTMLawed is ... ... a single-file, 45 kb PHP script that makes input text more secure, HTML standards-compliant, and suitable in general from the viewpoint of a web-page administrator, for use in the body of HTML, XHTML or XML documents. A simple HTMLTidy alternative, the htmLawed filter,...
GLPI <=10.0.2 - Remote Command Execution
GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module. id: CVE-2022-35914 info: name: GLPI =10.0.2 - Remote Command Execution author: For3stCo1d,allendemoura severity: critical description: | GLPI through 10.0...
Exploit for Injection in Glpi-Project Glpi
Да. Ниже именно сырой Markdown-текст — копируй содержимое блока...
Exploit for Injection in Glpi-Project Glpi
CVE-2022-35914 by cyb3rk0ala PoC for CVE-2022-35914, a co...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the cleanupXss function when sanitizing HTML content with conflicting htmLawed configuration options. An attacker can execute arbitrary JavaScript in the context of the affected application by injecting...
Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config
Summary Graby's cleanupXss function configures htmLawed with conflicting settings: safe=1 which removes combined with 'elements' = '+iframe-meta' which re-enables . htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is render...
GHSA-3H6J-9X8M-RG3G Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config
Summary Graby's cleanupXss function configures htmLawed with conflicting settings: safe=1 which removes combined with 'elements' = '+iframe-meta' which re-enables . htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is render...
CVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection...
EUVD-2009-0408
Malware in sbrugna...
EUVD-2010-4333
Malware in sbrugna...
EUVD-2010-4611
Malware in sbrugna...
htmlawed module GLPI Arbitrary PHP Injection
The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory management is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to inject arbitrary PHP code remotely...
ROS-20250303-02
Vulnerability in the htmlawed module of the GLPI computer hardware request, incident and inventory system is related to incorrect input validation in /vendor/htmlawed/htmlawed/htmlawed/htmLawedTest.php. Exploitation of the of the vulnerability could allow an attacker acting remotely to inject...
