CVE-2019-14827

A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which...

PT-2021-15829

Name of the Vulnerable Software and Affected Versions Store Locator Plus for WordPress plugin versions prior to 5.5.16 Description The issue allows unauthenticated attackers to inject malicious JavaScript into pages through several endpoints in the plugin. Recommendations For versions prior to...

CVE-2019-14827: Improper Control of Generation of Code

A vulnerability was found in Moodle where javaScript injection was possible in some Mustache templates via recursive rendering from contexts. Mustache helper tags that were included in template contexts were not being escaped before that context was injected into another Mustache helper, which...

CVE-2021-24290: Improper Neutralization of Input During Web Page Generation

There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages...

IBM QRadar SIEM Cross-Site Vulnerability

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. A cross-site...

CVE-2021-32544

Special characters of IGT search function in igt+ are not filtered in specific fields, which allow remote authenticated attackers can inject malicious JavaScript and carry out DOM-based XSS Cross-site scripting attacks...

Sourcecodester Equipment Inventory System Cross-Site Scripting Vulnerability

Sourcecodester Equipment Inventory System is a Sourcecodester open source application. It is used to organize and track its equipment. Sourcecodester Equipment Inventory System 1.0 suffers from a cross-site scripting vulnerability that can be exploited by an attacker to inject arbitrary javascrip...

CVE-2021-32544: Improper Neutralization of Input During Web Page Generation

Special characters of IGT search function in igt+ are not filtered in specific fields, which allow remote authenticated attackers can inject malicious JavaScript and carry out DOM-based XSS Cross-site scripting attacks...

Huawei P30 JavaScript injection vulnerability

Huawei P30 is a smartphone from Huawei China.The Huawei P30 is vulnerable to JavaScript injection, which can be exploited by attackers to launch JavaScript injection by sending malicious application requests...

PT-2021-19769

Name of the Vulnerable Software and Affected Versions: igt+ affected versions not specified Description: The issue concerns a lack of filtering for special characters in the IGT search function, specifically in certain fields of igt+. This allows remote authenticated attackers to inject malicious...

SuiteCRM Cross-Site Scripting Vulnerability (CNVD-2021-33995)

SuiteCRM is a free open source customer relationship management application. A cross-site scripting vulnerability exists in the customer account page of SuiteCRM versions prior to 7.11.19. An attacker can exploit the vulnerability to inject JavaScript via the name field...

CVE-2021-30172

Special characters of picture preview page in the Quan-Fang-Wei-Tong-Xun system are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out Reflected XSS Cross-site scripting attacks, additionally access and manipulate customer’s...

CVE-2021-30170

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

CVE-2021-30170

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

CVE-2020-29444

Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters...

CVE-2020-29444

Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters...

XSS in fieldID - CVE 2021-26079

The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15, and from version 8.6.0 before version 8.13.7, and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability. Affected...

CVE-2021-30170: Improper Neutralization of Input During Web Page Generation

Special characters of ERP POS customer profile page are not filtered in users’ input, which allow remote authenticated attackers can inject malicious JavaScript and carry out stored XSS Stored Cross-site scripting attacks, additionally access and manipulate customer’s information...

Fork CMS Cross-Site Scripting Vulnerability (CNVD-2021-34510)

Fork is an easy to use, open source CMS using Symfony components. A persistent cross-site scripting vulnerability exists in Fork CMS version 5.8.2. The vulnerability can be exploited to inject arbitrary Javascript code via the navigationtitle and title parameters in /private/en/pages/add...

Atlassian Confluence Server cross-site scripting vulnerability

Atlassian Confluence Server is the server version of Atlassian Australia's suite of collaboration software with enterprise knowledge management capabilities and support for building enterprise WiKi. A cross-site scripting vulnerability exists in Confluence Server versions prior to 7.11.0 that...