365 matches found
CVE-2021-37393
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...
CVE-2021-37393
In RPCMS v1.8 and below, the "nickname" variable is not properly sanitized before being displayed on page. Attacker can use "update password" function to inject XSS payloads into nickname variable, and achieve stored XSS. Users who view the articles published by the injected user will trigger the...
CVE-2021-37393
CVE-2021-37393 affects RPCMS v1.8 and earlier: the nickname variable is not sanitized before display, enabling stored XSS via the update password function. Users viewing articles by the injected user trigger the XSS. No remediation/fix details are provided in the connected documents.
CVE-2021-37392
Summary: CVE-2021-37392 affects RPCMS v1.8 and earlier. The nickname field is not properly sanitized before display, enabling stored XSS when API functionality is enabled and an attacker updates a user nickname with an XSS payload; victims viewing articles by the injected user may trigger the XSS...
RPCMS 跨站脚本漏洞
RPCMS is a software application. A website CMS system. A cross-site scripting vulnerability exists in RPCMS, which stems from the fact that the "Nickname" variable is not properly sanitized before it is displayed on a page in RPCMS v1.8 and below. The vulnerability can be exploited to inject an X...
RPCMS 跨站脚本漏洞
RPCMS is a software application, a web CMS system. RPCMS suffers from a cross-site scripting vulnerability that stems from a failure to properly clean up the nickname variable before it is displayed on a page in RPCMS v1.8 versions and below. With the API functionality turned on, an attacker can...
Cross site scripting
A Cross-site scripting XSS vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel...
CVE-2020-21316
A Cross-site scripting XSS vulnerability exists in the comment section in ZrLog 2.1.3, which allows remote attackers to inject arbitrary web script and stolen administrator cookies via the nickname parameter and gain access to the admin panel...
ZrLog 跨站脚本漏洞
ZrLog is a blogging system developed using the Java language. A security vulnerability exists in ZrLog 2.1.3, which can be exploited by remote attackers to inject arbitrary web scripts and stolen administrator cookies via the nickname parameter and gain access to the admin panel...
CVE-2020-19617
Cross Site Scripting XSS vulnerability in mblog 3.5 via the nickname field to /settings/profile...
CVE-2020-19617
Cross Site Scripting XSS vulnerability in mblog 3.5 via the nickname field to /settings/profile...
Cross site scripting
Cross Site Scripting XSS vulnerability in mblog 3.5 via the nickname field to /settings/profile...
CVE-2020-19617
Cross Site Scripting XSS vulnerability in mblog 3.5 via the nickname field to /settings/profile...
langhsu mblog 跨站脚本漏洞
Mblog is an open source Java blog system , support for multi-user , support for switching themes. Mblog 3.5 has a cross-site scripting vulnerability that can be exploited to inject arbitrary Web script or HTML via the nickname field in /settings/profile...
Monica Cross-Site Scripting Vulnerability
Monica is an open source personal relationship management system. A stored cross-site scripting vulnerability exists in the Contacts page in Monica 2.19.1. The vulnerability can be exploited to conduct a cross-site scripting attack via the Nickname field...
CVE-2021-27559
The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field...
CVE-2021-27559
The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field...
Design/Logic Flaw
The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field...