pgAdmin 4 Output Encoding

The vulnerability of the pgAdmin 4 database management tool is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2025-5770: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in the authentication endpoints of multiple WSO2 products due to a lack of output encoding. A malicious actor can inject arbitrary JavaScript payloads into the authentication endpoint, which are reflected back in the response, enabling...

PT-2023-4099

Name of the Vulnerable Software and Affected Versions SAP Solution Manager Diagnostics agent version 7.20 Description The issue is related to a lack of output encoding or escaping mechanism in the SAP Solution Manager Diagnostics agent platform. This can be exploited by a remote attacker to condu...

PT-2021-3936

Name of the Vulnerable Software and Affected Versions ExponentCMS versions 2.6 and below Description A HTTP Host header attack exists in ExponentCMS, allowing a modified HTTP header to change links on the webpage to an arbitrary value. This can lead to a possible attack vector for Man-in-the-Midd...

CVE-2021-24126: Improper Neutralization of Input During Web Page Generation

Unvalidated input and lack of output encoding in the Envira Gallery Lite WordPress plugin, versions before 1.8.3.3, did not properly sanitise the images metadata namely title before outputting them in the generated gallery, which could lead to privilege escalation...

PT-2021-15671

Name of the Vulnerable Software and Affected Versions: Envira Gallery Lite WordPress plugin versions prior to 1.8.3.3 Description: The issue is related to unvalidated input and lack of output encoding, which could lead to privilege escalation. Specifically, the images metadata, namely the title,...

PT-2021-15680

Name of the Vulnerable Software and Affected Versions: WP Customer Reviews versions prior to 3.4.3 Description: The issue is caused by unvalidated input and lack of output encoding, leading to multiple Stored Cross-Site Scripting vulnerabilities. This allows remote attackers to inject arbitrary...

PT-2021-15679

Name of the Vulnerable Software and Affected Versions: Constant Contact Forms WordPress plugin versions prior to 1.8.8 Description: The issue is caused by unvalidated input and a lack of output encoding in the Constant Contact Forms WordPress plugin, leading to multiple Stored Cross-Site Scriptin...

CVE-2018-12607

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding...

CVE-2018-12607: Improper Neutralization of Input During Web Page Generation

An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6, 10.8.x before 10.8.5, and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding...