CVE-2024-33328: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the component main.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the pageId parameter...

CVE-2024-33328

Lumisxp versions v15.0.x through v16.1.x are vulnerable to a cross-site scripting (XSS) vulnerability in the main.jsp component. This flaw exists because the application fails to properly neutralize input during web page generation, allowing an attacker to execute arbitrary web scripts or HTML by...

CVE-2015-3422

CVE-2015-3422 is a real XSS vulnerability in SearchBlox up to 8.2.1 where input passed via the GET parameter menu2 to /searchblox/admin/main.jsp is not properly sanitized. The issue allows injection of arbitrary HTML/JavaScript that can execute in a logged-in administrator’s browser, typically by...

CVE-2015-3422: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in SearchBlox before 8.2.1 allows remote attackers to inject arbitrary web script or HTML via the menu2 parameter to admin/main.jsp...

CVE-2015-0967: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in SearchBlox before 8.2 allow remote attackers to inject arbitrary web script or HTML via 1 the search field in plugin/index.html or 2 the title field in the Create Featured Result form in admin/main.jsp...

CVE-2013-4600: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to system/workplace/views/admin/admin-main.jsp or the 2 requestedResource parameter to system/login/index.html...

TRS 6.5 /wcm/app/main.jsp 登录绕过漏洞

No description provided by source...

CVE-2006-3935: Undefined Security Weakness

system/workplace/views/admin/admin-main.jsp in Alkacon OpenCms before 6.2.2 does not restrict access to administrator functions, which allows remote authenticated users to 1 send broadcast messages to all users /workplace/broadcast, 2 list all users /accounts/users, 3 add webusers...