CVE-2021-36332

CVE-2021-36332 affects Dell EMC CloudLink 7.1 and earlier. The issue is a HTML/JavaScript injection (input validation) vulnerability that could be exploited remotely by a low-privilege attacker to redirect end users to arbitrary or malicious websites. Multiple connected sources corroborate the vu...

Cross-site Scripting (XSS)

plupload is vulnerable to cross-site scripting. An attacker can inject and execute malicious javascript through the file.name field as it does not properly encode the user input file name...

CVE-2021-36332: URL Redirection to Untrusted Site

Dell EMC CloudLink 7.1 and all prior versions contain a HTML and Javascript Injection Vulnerability. A remote low privileged attacker, may potentially exploit this vulnerability, directing end user to arbitrary and potentially malicious websites...

PT-2021-21234

Name of the Vulnerable Software and Affected Versions Dell EMC CloudLink versions 7.1 and all prior versions Description The issue allows a remote low privileged attacker to potentially exploit a HTML and Javascript Injection vulnerability, directing end users to arbitrary and potentially malicio...

Cross-Site Scripting (XSS)

ckeditor4 is vulnerable to cross-site scripting. The vulnerability exists due to a lack of sanitization of HTML in the Advance Content Filter ACF module which allows an attacker to inject maliciously crafted HTML containing Javascript code...

CVE-2021-42838

Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...

Cross site scripting

Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...

CVE-2021-42838

Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...

欣学英资讯 webopac7 跨站脚本漏洞

XinXueYing Info Webopac7 is an online public access catalog of China XinXueYing Info. It is used for users to access library services over the Internet. A cross-site scripting vulnerability exists in XinXueYing Info webopac7, which originates from a book search field parameter that does not...

PHP Laravel 8.70.1 Cross Site Request Forgery / Cross Site Scripting

Exploit Title: PHP Laravel 8.70.1 - Cross Site Scripting XSS to Cross Site Request Forgery CSRF Date: 14/11/2021 Exploit Author: Hosein Vita Vendor Homepage: https://laravel.com/ Software Link: https://laravel.com/docs/4.2 Version: Laravel Framework 8.70.1 Tested on: Windows/Linux Description: We...

PT-2021-22348

Name of the Vulnerable Software and Affected Versions IBM Tivoli Key Lifecycle Manager versions 3.0 through 4.1 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trust...

PT-2021-12115

Name of the Vulnerable Software and Affected Versions: IBM Security SiteProtector System version 3.1.1 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

Cross-site Scripting (XSS)

graphql-playground-react is vulnerable to cross-site scripting. The vulnerability exists due to the lack of sanitization in Properties.html allowing an attacker to inject and execute malicious javascript...

Cross-site Scripting (XSS)

grafana is vulnerable to cross-site scripting attacks. The vulnerability exists due to lack of sanitation of URL allowing a malicious attacker to inject and execute arbitrary javascript...

Publify 跨站脚本漏洞

Publify is a simple but full-featured web publishing software. A security vulnerability exists in Publify versions v8.0 through v9.2.4, which can be exploited by an attacker to insert and execute arbitrary JavaScript code during page/post creation...

Publify 跨站脚本漏洞

Publify is a simple but full-featured web publishing software. A security vulnerability exists in Publify versions v8.0 through v9.2.4, which can be exploited by attackers to inject malicious JavaScript via an uploaded html file...

CVE-2021-35488

Thruk 2.40-2 allows /thruk/cgi-bin/status.cgi?style=combined&title=TITLE Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it...

Cross site scripting

Thruk 2.40-2 allows /thruk/cgi-bin/status.cgi?style=combined&title=TITLE Reflected XSS via the host or title parameter. An attacker could inject arbitrary JavaScript into status.cgi. The payload would be triggered every time an authenticated user browses the page containing it...

CVE-2021-42703

This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action...

Thruk 跨站脚本漏洞

Thruk is an open source multi-backend monitoring web interface from the individual developer Sven Nierlein in Germany. Thruk 2.40-2 suffers from a security vulnerability that allows an attacker to inject arbitrary JavaScript into status.cgi, which triggers a payload every time an authenticated us...