PT-2021-9701

Name of the Vulnerable Software and Affected Versions Gotenberg versions through 6.2.1 Description The issue allows for the injection of HTML and/or JavaScript in the HTML to PDF conversion process. This is possible via the "http://localhost:3000/convert/html" endpoint. Recommendations For versio...

CVE-2020-14161: Improper Neutralization of Input During Web Page Generation

It is possible to inject HTML and/or JavaScript in the HTML to PDF conversion in Gotenberg through 6.2.1 via the /convert/html endpoint...

SuiteCRM cross-site scripting vulnerability

SuiteCRM is a customer relationship management system from the SuiteCRM Suitecrm team. A security vulnerability in the web interface of SuiteCRM before 7.11.19 allows remote attackers to upload malicious files by bypassing content type filters and introducing arbitrary JavaScript...

CVE-2021-34562

In PEPPERL+FUCHS WirelessHART-Gateway 3.0.8 it is possible to inject arbitrary JavaScript into the application's response...

CVE-2021-38708

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS...

CVE-2021-38709

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staffmessaging messaging system for XSS...

CVE-2021-38709

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staffmessaging messaging system for XSS...

Cross site scripting

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staffmessaging messaging system for XSS...

CVE-2021-38709

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staffmessaging messaging system for XSS...

CVE-2021-38708

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS...

CVE-2021-38708

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS...

CVE-2021-38709

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staffmessaging messaging system for XSS...

CVE-2021-38709

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staffmessaging messaging system for XSS...

PT-2021-22269

Name of the Vulnerable Software and Affected Versions ocProducts Composr CMS versions prior to 10.0.38 Description The issue allows an attacker to inject JavaScript via Comcode, resulting in a cross-site scripting XSS attack. This can potentially lead to unauthorized access or control of user...

CVE-2021-38708: Improper Neutralization of Input During Web Page Generation

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via Comcode for XSS...

CVE-2021-38709: Improper Neutralization of Input During Web Page Generation

In ocProducts Composr CMS before 10.0.38, an attacker can inject JavaScript via the staffmessaging messaging system for XSS...

Ocproducts Composr CMS cross-site scripting vulnerabilities

Ocproducts Composr CMS is an open source content management system CMS written in PHP by ocProducts Ocproducts UK. A security vulnerability exists in ocProducts Composr CMS versions prior to 10.0.38, which can be exploited by attackers to inject JavaScript via Comcode...

CVE-2021-37695

ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 "Fake Objects" https://ckeditor.com/cke4/addon/fakeobjects package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executin...

PT-2021-21576

Name of the Vulnerable Software and Affected Versions Flygo affected versions not specified Description The bulletin function does not filter special characters while a new announcement is added, allowing remote attackers to inject JavaScript and execute stored XSS attacks using a general user's...

CVE-2021-37211: Improper Neutralization of Input During Web Page Generation

The bulletin function of Flygo does not filter special characters while a new announcement is added. Remoter attackers can use the vulnerability with general user’s credential to inject JavaScript and execute stored XSS attacks...