Webmin cross-site scripting vulnerabilities

Webmin is a set of Web-based system administration tools for Unix-like operating systems from the Webmin community.A cross-site scripting vulnerability exists in Webmin version 1.973, which stems from the lack of filtering and escaping of user-submitted parameters for the upload and download...

CVE-2022-1290

Stored XSS in "Name", "Group Name" & "Title" in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

PT-2022-16548

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Document Server Example versions prior to 7.0.0 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary HTML or JavaScript through the "/example/editor" API endpoint. This enables attackers to execut...

PT-2022-18200

Name of the Vulnerable Software and Affected Versions AeroCMS version 0.0.1 Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field in add post.php. This enables the execution of malicious code on the web...

PT-2022-18004

Name of the Vulnerable Software and Affected Versions aEnrich a+HRD affected versions not specified Description The issue is related to inadequate privilege restrictions in aEnrich a+HRD, allowing an unauthenticated remote attacker to use an API function to upload and execute malicious scripts...

UBUNTU-CVE-2022-28284

SVG's use element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with...

CVE-2022-26676: Improper Privilege Management

aEnrich a+HRD has inadequate privilege restrictions, an unauthenticated remote attacker can use the API function to upload and execute malicious scripts to control the system or disrupt service...

Cisco Web Security Appliance and Cisco AsyncOS have cross-site scripting vulnerabilities

The Cisco Web Security Appliance WSA and Cisco AsyncOS are both products of Cisco, U.S.A. The Cisco Web Security Appliance is a Web security appliance. The appliance provides SaaS-based access control, real-time web reporting and tracking, and development of security policies.Cisco AsyncOS is an...

CVE-2022-26615

A cross-site scripting XSS vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User Profile Name text fields...

PT-2022-4251

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 99 Description The issue is related to the implementation of the SVG element, which could be used to load unexpected content, potentially executing scripts under certain circumstances. Although the specification appea...

Cross site scripting

A stored cross-site scripting XSS vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box...

Cross site scripting

A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...

Total.js Cross-Site Script Vulnerabilities

Total Avengers Totaljs Framework is a Javascript-based code base for building web, desktop, service or IoT applications from Total Avengers, Slovakia. The application is similar to PHPs Laravel, Pythons Django, ASP.NET MVC for building Node applications.A cross-site scripting vulnerability exists...

CVE-2022-24136

Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php. To exploit, an attacker can upload any PHP file, and then execute it...

PT-2022-11889

Name of the Vulnerable Software and Affected Versions Maccms version 10 Description A Cross Site Scripting XSS issue exists due to the link Name parameter. This allows for potential malicious script execution. Recommendations For Maccms version 10, avoid using the link Name parameter until a fix ...

PT-2022-18137

Name of the Vulnerable Software and Affected Versions Archer versions 6.x through 6.10 Description The issue is a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying...

PT-2022-17737

Name of the Vulnerable Software and Affected Versions Hospital Patient Record Management System version 1.0 Description A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the special field. This enables attackers t...

PT-2022-12013

Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.5 and earlier Description The issue allows for cross-site scripting XSS attacks via an HTML 5 element, such as AUDIO. This can potentially lead to malicious script execution on the client-side. Recommendations For OX...

Parsedown Class-Name Injection

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

PT-2022-17750

Name of the Vulnerable Software and Affected Versions Yonyou u8 version 13.0 Description A DOM-based cross-site scripting XSS issue was found in the component /u8sl/WebHelp, which can be exploited to execute malicious scripts. Recommendations For Yonyou u8 version 13.0, consider restricting acces...