49 matches found
HTMLawed
HTMLawed 是…… ……一个单文件、45 kb 的 PHP 脚本，从网页管理员的视角来看，它使输入文本更安全、符合 HTML 标准，并且总体上适合用作 HTML、XHTML 或 XML 文档的正文。作为 HTMLTidy 的简单替代品，htmLawed 过滤器、处理器、净化器、消毒器、美化器等具有高度可定制性。 它确保 HTML 标签平衡且正确嵌套，中和可能被用于跨站脚本（XSS）攻击的代码，限制允许的 HTML 元素、属性或 URL 协议，整理代码等。 因此，在净化场景中，它可以用作 HTMLtidy 的替代方案。 该仓库是…… ……一个衍生版本，紧密跟踪原始项目 链接...
CVE-2022-35914_poc
CVE-2022-35914poc Modified for GLPI Offsec Lab: calluserfunc, arraymap, passthru References Modified to work for Proving Grounds Practice Lab: GLPI https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr https://github.com/cosad3s/CVE-2022-35914-poc/blob/main/CVE-2022-35914.p...
CVE-2022-35914-RCE
CVE-2022-35914 by cyb3rk0ala PoC for CVE-2022-35914 , a command-injection vulnerability involving the htmLawed test component in vulnerable GLPI installations. The tool provides command execution through the vulnerable endpoint and includes optional callback functionality for authorized lab...
GLPI <=10.0.2 - Remote Command Execution
GLPI through 10.0.2 is susceptible to remote command execution injection in /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module. id: CVE-2022-35914 info: name: GLPI =10.0.2 - Remote Command Execution author: For3stCo1d,allendemoura severity: critical description: | GLPI through 10.0...
Exploit for Injection in Glpi-Project Glpi
Да. Ниже именно сырой Markdown-текст — копируй содержимое блока...
Exploit for Injection in Glpi-Project Glpi
CVE-2022-35914 by cyb3rk0ala PoC for CVE-2022-35914, a co...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the cleanupXss function when sanitizing HTML content with conflicting htmLawed configuration options. An attacker can execute arbitrary JavaScript in the context of the affected application by injecting...
Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config
Summary Graby's cleanupXss function configures htmLawed with conflicting settings: safe=1 which removes combined with 'elements' = '+iframe-meta' which re-enables . htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is render...
GHSA-3H6J-9X8M-RG3G Graby has stored XSS via iframe srcdoc Attribute in htmLawed Sanitization Config
Summary Graby's cleanupXss function configures htmLawed with conflicting settings: safe=1 which removes combined with 'elements' = '+iframe-meta' which re-enables . htmLawed does not sanitize the srcdoc attribute, allowing injection of arbitrary JavaScript that executes when the content is render...
CVE-2022-35914
/vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2 allows PHP code injection...
EUVD-2009-0408
Malware in sbrugna...
EUVD-2010-4333
Malware in sbrugna...
EUVD-2010-4611
Malware in sbrugna...
The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory allows a hacker to inject arbitrary PHP code.
The vulnerability of the htmlawed module in the GLPI system for job requests, incidents, and computer equipment inventory management is related to incorrect code generation. Exploiting this vulnerability allows a malicious actor to inject arbitrary PHP code remotely...
ROS-20250303-02
Vulnerability in the htmlawed module of the GLPI computer hardware request, incident and inventory system is related to incorrect input validation in /vendor/htmlawed/htmlawed/htmlawed/htmLawedTest.php. Exploitation of the of the vulnerability could allow an attacker acting remotely to inject...
Teclib GLPI Remote Code Execution Vulnerability
Teclib GLPI contains a remote code execution vulnerability in the third-party library, htmlawed...
HTMLawed < 1.2.9 Command Injection (CVE-2022-35914)
Binary data htmlawedcmdinjection.nbin...
HTMLawed < 1.2.9 Code Injection
In versions lower than 1.2.9 htmLawedTest.php in the HTMLawed module allows PHP code injection. No source data...
GLPI 10.0.2 Command Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GLPI htmLawed php command injection', 'Description' = %q This exploit takes advantage of a unauthenticated php command injection available from...
