Design/Logic Flaw

Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 allow traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changin...

GHSA-PHJ8-2P6X-HQ5R Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags

Cross Site Scripting XSS vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html...

Joplin Cross Site Scripting Vulnerability via NOSCRIPT tags

Cross Site Scripting XSS vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html...

CVE-2021-33295

Cross Site Scripting XSS vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html...

CVE-2021-33295

Cross Site Scripting XSS vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html...

Cross site scripting

Cross Site Scripting XSS vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html...

CVE-2021-33295

Cross Site Scripting XSS vulnerability in Joplin Desktop App before 1.8.5 allows attackers to execute aribrary code due to improper sanitizing of html...

GHSA-H7H6-FWPV-GGVX Moodle contains Stored XSS via ID number user profile field

The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2, 3.9.5, 3.8.8, 3.5.17...

Moodle stored Cross-site Scripting (XSS)

The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2...

CVE-2021-20279

A flaw was found in moodle. The ID number user profile field requires additional sanitizing to prevent a stored XSS risk. Mitigation Disable the ID number field by unchecking it in Site admin Users User policies Show user identity, until the patch has been applied...

Cross-site Scripting in moodle

A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk...

Cross site scripting

A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk...

CVE-2022-30596

A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk...

CVE-2022-30596

CVE-2022-30596 is a Moodle stored XSS flaw. Connected sources confirm the issue arises when IDs are displayed during bulk allocation of markers to assignments, due to insufficient sanitization. The vulnerability is described as a stored XSS risk in Moodle; exploitation details and concrete remedi...

CVE-2022-30596

A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk...

CVE-2022-1435

The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

MGASA-2022-0179 Updated python-nbxmpp packages fix security vulnerability

Missing input sanitising in python-nbxmpp, a Jabber/XMPP Python library, could result in denial of service in clients based on it such as Gajim...

TYPO3 API function vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the t3libdiv::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing...

GHSA-M7RG-85G8-28M9 TYPO3 API function vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the t3libdiv::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing...

U.S. Dept Of Defense: Reflected XSS via `████████` parameter

Hello everyone, I came across a page that allows users to subscribe to certain forum posts at https://███ I noticed that the ████ parameter is reflected in the Page without filtering dangerous characters such as except the = character which is filtered by default, but this can be circumvented by...