PT-2021-17145

Name of the Vulnerable Software and Affected Versions: Jitsi Meet plugin for Moodle versions 2.7 through 2.8.3 Description: The issue allows attackers to craft a malicious URL that, when clicked on by users, can inject javascript code to be run by the application. This is achieved through a Cross...

Cross-Site Scripting (XSS)

sickrage is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser due to lack input validation and output sanitization...

Echel0n SiCKRAGE Cross-Site Script Vulnerability

SickRage is an automated video library manager for TV programs. A stored cross-site scripting vulnerability exists in SiCKRAGE version 4.2.0 - 10.0.11.dev1. The vulnerability stems from the server processing user input without properly validating user input. An attacker can exploit the...

PT-2021-12234

Name of the Vulnerable Software and Affected Versions IBM Jazz Team Server affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

IBM Jazz Team Server cross-site scripting vulnerability

IBM Jazz Team Server is an application server from IBM USA. Provides base services that enable a group of tools to work together as a single logical server and includes any number of Jazz Team Server Extensions that provide tool-specific functionality. A cross-site scripting vulnerability exists ...

PT-2021-16855

Name of the Vulnerable Software and Affected Versions SiCKRAGE versions 4.2.0 through 10.0.11.dev1 Description The issue arises from improper validation of user input when processed by the server, leading to Stored Cross-Site-Scripting XSS. This allows an attacker to inject arbitrary JavaScript...

CVE-2021-25925: Improper Neutralization of Input During Web Page Generation

in SiCKRAGE, versions 4.2.0 to 10.0.11.dev1 are vulnerable to Stored Cross-Site-Scripting XSS due to user input not being validated properly when processed by the server. Therefore, an attacker can inject arbitrary JavaScript code inside the application, and possibly steal a user’s sensitive...

PT-2021-14014

Name of the Vulnerable Software and Affected Versions: IBM Jazz Team Server affected versions not specified Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

IBM Jazz Team Server cross-site scripting vulnerability

IBM Jazz Team Server is an application server from IBM USA. Provides base services that enable a group of tools to work together as a single logical server and includes any number of Jazz Team Server Extensions that provide tool-specific functionality. A cross-site scripting vulnerability exists ...

Web-School ERP Cross-Site Scripting Vulnerability

Web-School ERP is a school management software for schools and educational organizations. A cross-site scripting vulnerability exists in the Activity Name and Description fields in Web-School ERP version 5.0. An attacker can exploit this vulnerability to inject and execute JavaScript code, which...

Cross site scripting

The Squirro Insights Engine was affected by a Reflected Cross-Site Scripting XSS vulnerability affecting versions 2.0.0 up to and including 3.2.4. An attacker can use the vulnerability to inject malicious JavaScript code into the application, which will execute within the browser of any user who...

CVE-2021-30113

A blind XSS vulnerability exists in Web-School ERP V 5.0 via Add Events in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event, then the payload will be executed and sends the victim's information to the attack...

Cross site scripting

A stored XSS vulnerability exists in Web-School ERP V 5.0 via Add Events in the event name and description fields. An attack can inject a JavaScript code that will be stored in the page. If any visitor sees the events, then the payload will be executed...

Cross site scripting

A blind XSS vulnerability exists in Web-School ERP V 5.0 via Add Events in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event, then the payload will be executed and sends the victim's information to the attack...

CVE-2021-3012

A cross-site scripting XSS vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror in the URL field of the Parameters tab...

CVE-2021-3012

A cross-site scripting XSS vulnerability in the Document Link of documents in ESRI Enterprise before 10.9 allows remote authenticated users to inject arbitrary JavaScript code via a malicious HTML attribute such as onerror in the URL field of the Parameters tab...

CVE-2021-30113

CVE-2021-30113 affects Web-School ERP v5.0. A blind XSS vulnerability exists in the Add Events fields (event name and description) where injected JavaScript can be stored and executed when visitors view the event, potentially exfiltrating victim information. The provided sources describe the vuln...

PT-2021-18605

Name of the Vulnerable Software and Affected Versions Web-School ERP version 5.0 Description A stored XSS issue exists via the Add Events feature in the event name and description fields, allowing an attack to inject JavaScript code that will be stored and executed when visitors view the events...

PT-2021-17685

Name of the Vulnerable Software and Affected Versions: Squirro Insights Engine versions 2.0.0 through 3.2.4 Description: The issue allows an attacker to inject malicious JavaScript code into the application, which executes within the user's browser. This enables the attacker to perform various...

CVE-2021-30113: Improper Neutralization of Input During Web Page Generation

A blind XSS vulnerability exists in Web-School ERP V 5.0 via Add Events in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event, then the payload will be executed and sends the victim's information to the attack...