Cross-site Scripting (XSS)

Overview piranha is an a complete rewrite of Piranha CMS for .NET Core. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /manager/pages endpoint, as a markdown content. PoC 1 Login via the manager endpoint :: /manager/login 2 Navigate to the "Pages" Content 3...

GHSA-MMX8-VRFG-HFMQ Piranha CMS Cross-site Scripting vulnerability

A stored cross-site scripting XSS vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload...

Cross-site Scripting (XSS)

Overview Piranha.Manager is a manager panel for Piranha CMS for AspNetCore. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /manager/pages endpoint, as a markdown content. PoC 1 Login via the manager endpoint :: /manager/login 2 Navigate to the "Pages" Content...

CVE-2024-55341

A stored cross-site scripting (XSS) vulnerability exists in Piranha CMS version 11.1 . The flaw allows remote attackers to execute arbitrary JavaScript in a user's web browser by creating a page via the /manager/pages endpoint and injecting an XSS payload within markdown content . As a temporary ...

CVE-2024-55341

A stored cross-site scripting XSS vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload...

PT-2024-36509 · Unknown · Piranha Cms

Name of the Vulnerable Software and Affected Versions: Piranha CMS version 11.1 Description: A stored cross-site scripting XSS vulnerability allows remote attackers to execute arbitrary JavaScript in the web browser of a user. This is achieved by creating a page via the "/manager/pages" endpoint...

CVE-2024-55341: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload...

CVE-2024-55341

A stored cross-site scripting XSS vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by creating a page via the /manager/pages and then adding a markdown content with the XSS payload...

CVE-2024-56082

ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true...

CVE-2024-56082

ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true...

CVE-2024-56082

ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true...

PT-2024-36709 · Unknown +1 · Markdown-To-Jsx +1

Name of the Vulnerable Software and Affected Versions: Lumos versions prior to 1.0.17 Description: The issue arises from the ChatBar.tsx component in Lumos, which parses raw HTML in Markdown. This occurs because the markdown-to-jsx package is used without setting disableParsingRawHTML to true...

Lumos security vulnerabilities

Lumos is a tool by Andrew Nguonly personal developer. It is used for browsing web pages. A security vulnerability exists in Lumos versions prior to 1.0.17, which stems from the use of the markdown-to-jsx package without disableParsingRawHTML set to true, where ChatBar.tsx parses raw HTML from...

CVE-2024-56082: Improper Neutralization of Input During Web Page Generation

ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true...

CVE-2024-56082

ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true...

CVE-2024-56082

The Lumos web browsing tool, developed by Andrew Nguonly, is vulnerable in versions prior to 1.0.17 due to an improper neutralization of input during web page generation (CWE-79 ). The ChatBar.tsx component parses raw HTML from Markdown because the markdown-to-jsx package is utilized without sett...

CVE-2024-55601

A flaw was found in the Hugo static site generator. Some HTML attributes in Markdown in the internal templates do not escape in internal render hooks. Hugo users who do not trust their Markdown content files and are using one or more of these templates are impacted; default/markup/render-link.htm...

Malware in symphony-markdown

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

SUSE CVE-2024-55601

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are usin...

DEBIAN-CVE-2024-55601

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are usin...