72 matches found
CVE-2021-32644
CVE-2021-32644 This vulnerability is an XSS vulnerability that affected versions prior to Ampache 4.4.3. https://nvd.nist.gov/vuln/detail/CVE-2021-32644 Installation and Execution Steps 1. Install Ampache When installing, please configure port forwarding in the docker-compose.yml file. The...
CVE-2024-4439
CVE-2024-4439 CVE-2024-4439 docker and poc Lab Setup After starting the Docker container, some additional configuration is needed. Visit 127.0.0.1:8080, complete the configuration, In the backend – Appearance – Themes, select a theme, customize it, and configure. Go to Design – Templates – Single...
CVE-2026-52774-YESWIKI-XSS
CVE-2026-52774-YESWIKI-XSS CVE-2026-52774 is a reflected XSS vulnerability in YesWiki's Bazar widget handler. The query parameter in the NoSuchPage/widget endpoint is inadequately sanitized using striptags, which does not escape double quotes. This allows an attacker to break out of HTML attribut...
Exploit for CVE-2026-78071
Stored XSS via Location Title in DPCalendar Free DPCalendar...
Exploit for CVE-2024-4041
CVE-2024-4041 Yoast SEO /?page=%22%20onmouseover%3D%...
EUVD-2005-2139
Malware in sbrugna...
CVE-2025-56515
File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...
CVE-2005-2138
Cross-site scripting XSS vulnerability in index.php in Comdev eCommerce 3.0 and 3.1 allows remote attackers to inject arbitrary web script or HTML via Javascript in the onMouseOver event of an "A" tag in a review message...
CVE-2025-30342: Improper Neutralization of Input During Web Page Generation
An XSS issue was discovered in OpenSlides before 4.2.5. When submitting descriptions such as Moderator Notes or Agenda Topics, an editor is shown that allows one to format the submitted text. This allows insertion of various HTML elements. When trying to insert a SCRIPT element, it is properly...
Cross-Site Scripting (XSS)
silverstripe/admin is vulnerable to Cross-Site Scripting XSS . The vulnerability is due to inadequate input validation, allowing an attacker to embed malicious JavaScript through onmouseover or onmouseout attributes in the WYSIWYG editor...
PT-2024-40151
Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The issue allows a bad actor with access to the CMS to embed malicious javascript using onmouseover or onmouseout attributes in the WYSIWYG editor. Recommendations: At the moment, there...
CVE-2023-31506: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element...
Grav Cross-Site Scripting Vulnerability
Grav is an extensible CMS Content Management System for personal blogs, small content publishing platforms, and one-page product displays. A cross-site scripting vulnerability exists in Grav 1.7.44 and earlier versions that could allow an authenticated, remote attacker to execute arbitrary web...
PT-2024-12285 · Grav · Grav
Name of the Vulnerable Software and Affected Versions: Grav versions 1.7.44 and before Description: A cross-site scripting XSS vulnerability allows remote authenticated attackers to execute arbitrary web scripts or HTML via the onmouseover attribute of an ISINDEX element. Recommendations: For Gra...
PT-2023-33004 · Tinymce +1 · Tinymce +1
Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 20.2.0 OpenMage magento-lts versions prior to 20.2.0 Description: The TinyMCE WYSIWYG editor fails to filter scripts when rendering HTML in specially crafted HTML tags, allowing for potential exploitation. This issue...
CVE-2023-23637
CVE-2023-23637 affects IMPatienT before 1.5.2. It allows stored XSS via onmouseover in certain text fields within PATCH /modify_onto to the ontology builder, potentially leading to disclosure of Protected Health Information. CVSS v3.1 base score 7.6 (HIGH), vectors: AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:...
CVE-2023-23637
IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modifyonto request to the ontology builder. This may allow attackers to steal Protected Health Information...
CVE-2023-23637: Improper Neutralization of Input During Web Page Generation
IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modifyonto request to the ontology builder. This may allow attackers to steal Protected Health Information...
Happyforms < 1.22.0 - Contributor+ Stored XSS
The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. Exploit Additional CSS classes for "Forms" Gutenberg...
