CVE-2018-19048

Simditor up to version 2.3.21 is affected by a DOM XSS (attackable via an onload attribute in a malformed SVG element). The underlying issue is improper handling/sanitization of SVG onload events, enabling injection of arbitrary JavaScript in the user’s browser. Mitigation: upgrade to version 2.3...

PT-2019-9725

Name of the Vulnerable Software and Affected Versions Simditor versions prior to 2.3.22 Description The issue allows for DOM XSS via an onload attribute within a malformed SVG element. It is caused by the package not sanitizing user input that is rendered with innerHTML, allowing attackers to...

CVE-2018-19048: Improper Neutralization of Input During Web Page Generation

Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element...

The vulnerability of the dijit.Editor text editor module library simplifies the development of JavaScript- or AJAX-based applications and websites using the Dojo Toolkit. This vulnerability allows attackers to perform cross-site scripting attacks.

The vulnerability of dijit.Editor, a text editor that is part of the modular library for simplifying the development of JavaScript- or AJAX-based applications and Dojo Toolkit websites, is related to the unsafe use of the onload attribute for SVG elements. Exploiting this vulnerability could allo...

CVE-2018-19919

Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php datatitle parameter, as demonstrated by a crafted onload attribute of an SVG element...

PT-2018-15164

Name of the Vulnerable Software and Affected Versions Pixelimity version 1.0 Description The issue is related to Persistent XSS, which can be exploited via the datatitle parameter in the "admin/portfolio.php" endpoint. This is demonstrated by a crafted onload attribute of an SVG element...

blackberryhill.farmvisit.com XSS vulnerability

Open Bug Bounty ID: OBB-653565 Description| Value ---|--- Affected Website:| blackberryhill.farmvisit.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

aracmuaye.gamerch.com XSS vulnerability

Open Bug Bounty ID: OBB-651139 Description| Value ---|--- Affected Website:| aracmuaye.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

poketoru.gamerch.com XSS vulnerability

Open Bug Bounty ID: OBB-644202 Description| Value ---|--- Affected Website:| poketoru.gamerch.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

kleinecampingplaetze.de XSS vulnerability

Open Bug Bounty ID: OBB-640887 Description| Value ---|--- Affected Website:| kleinecampingplaetze.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

esite100.com XSS vulnerability

Open Bug Bounty ID: OBB-631555 Description| Value ---|--- Affected Website:| esite100.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

jobfinder.pt XSS vulnerability

Open Bug Bounty ID: OBB-631365 Description| Value ---|--- Affected Website:| jobfinder.pt Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Dolibarr 7.0.0 - SQL Injection Vulnerability

Exploit for php platform in category web applications CVE-2018-10094 Dolibarr SQL Injection vulnerability Description Dolibarr is an "Open Source ERP & CRM for Business" used by many companies worldwide. It is available through GitHub or as distribution packages e.g .deb package. Threat The...

Node.js third-party modules: Privilage escalation with malicious .npmrc

Hello. I'm forwarding to you my conversation with npm staff regarding security issue. It allows to escalate to root privilages of victim using either: a basic social engineering - convincing victim to run npm in attacker-controlled folder eg. repository, including such innocent ones like "npm hel...

mc.iherb.com XSS vulnerability

Open Bug Bounty ID: OBB-574863 Description| Value ---|--- Affected Website:| mc.iherb.com Open Bug Bounty Program:| Not created yet Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Disclosur...

el-independiente.com.mx XSS vulnerability

Open Bug Bounty ID: OBB-560892 Description| Value ---|--- Affected Website:| el-independiente.com.mx Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-6506

Cross-Site Scripting XSS exists in the Add Forum feature in the Administrative Panel in miniBB 3.2.2 via crafted use of an onload attribute of an SVG element in the supertitle field...

CVE-2018-6506: Improper Neutralization of Input During Web Page Generation

Cross-Site Scripting XSS exists in the Add Forum feature in the Administrative Panel in miniBB 3.2.2 via crafted use of an onload attribute of an SVG element in the supertitle field...

PT-2018-17597

Name of the Vulnerable Software and Affected Versions miniBB version 3.2.2 Description A Cross-Site Scripting XSS issue exists in the Add Forum feature of the Administrative Panel. This is due to the improper handling of the onload attribute of an SVG element in the supertitle field, allowing for...

miniBB Cross-Site Scripting Vulnerability

miniBB full name Minimalistic Bulletin Board is a free, open source Internet forum software. The software supports a variety of forum styles , multiple interface languages , multiple time zones , plug-ins and extensions , etc. Administrative Panel is one of the administrative panel . A cross-site...