4838 matches found
Remote file inclusion
Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, an attacker could capture user's session cookies or execute malicious Javascript when a victim edits a markdown file. Version 1.7.1 fixes this issue...
Path traversal
Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing /list/ and discloses lists of files located on the server including sensitive data. Version 1.7.1 fixes this issue...
CVE-2022-36080
Affected software : Wikmd (file-based wiki using Markdown). Vulnerability : Cross-site scripting in versions prior to 1.7.1, enabling an attacker to capture a user’s session cookies or run malicious JavaScript when a victim edits a Markdown file. Root cause/vector : XSS that occurs during the edi...
CVE-2022-36081 Wikmd vulnerable to Local File Enumeration when accessing /list
Wikmd is a file based wiki that uses markdown. Prior to version 1.7.1, Wikmd is vulnerable to path traversal when accessing /list/ and discloses lists of files located on the server including sensitive data. Version 1.7.1 fixes this issue...
wikmd 跨站脚本漏洞
wikmd is a file-based wiki for individual developers of linbreux. A cross-site scripting vulnerability exists in versions of wikmd prior to 1.7.1, which originates from an attacker being able to capture a user's session cookie or execute malicious Javascript while the victim is editing a markdown...
PT-2022-23169 · Wikmd · Wikmd
Name of the Vulnerable Software and Affected Versions: Wikmd versions prior to 1.7.1 Description: The issue allows an attacker to capture a user's session cookies or execute malicious Javascript when a victim edits a markdown file. Recommendations: For versions prior to 1.7.1, update to version...
Pagekit CMS cross-site scripting in Markdown text box where articles are edited
A cross-site scripting XSS vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit...
GHSA-Q6H8-QJJC-J8CG Pagekit CMS cross-site scripting in Markdown text box where articles are edited
A cross-site scripting XSS vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit...
CVE-2022-36573
A cross-site scripting XSS vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit...
CVE-2022-36573
A cross-site scripting XSS vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit...
Cross site scripting
A cross-site scripting XSS vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit...
Mermaid 代码注入漏洞
Mermaid is a software application. Create charts and visualizations using text and code. A code injection vulnerability exists in Mermaid versions prior to 1.3.0, prior to 2.0.0-rc1, which can be exploited by an attacker to modify any mermaid block of code with arbitrary code, which will be...
Snipe-IT 跨站脚本漏洞
Snipe-IT is an open source IT asset/license management system. A cross-site scripting vulnerability exists in Snipe-IT versions prior to v6.0.11, which originates from a user with Super Administrator privileges being able to implement cross-site scripting via a Markdown Input field...
CVE-2022-36573
A cross-site scripting XSS vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/post/edit...
Stored Cross-Site Scripting (XSS)
Description Input fields allowing Markdown Input are vulnerable to XSS. This requires Superadmin permissions though. Proof of Concept Steps to reproduce: 1. Log in to the admin account 2. Go to Admin - General Settings 3. Enter the Payload in the Login Note and Dashboard Message fields. 4. Go to...
Pagekit 跨站脚本漏洞
Pagekit is a modular, lightweight CMS Content Management System. A security vulnerability exists in Pagekit CMS v1.0.18. An attacker can exploit this vulnerability to execute arbitrary web script or HTML by injecting a specially crafted payload into the Markdown text box under /blog/post/edit...
PT-2022-23480 · Unknown · Pagekit Cms
Name of the Vulnerable Software and Affected Versions: Pagekit CMS version 1.0.18 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under the "/blog/post/edit" API endpoint. The Markdow...
CVE-2021-39393
mm-wiki v0.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the markdown editor...