CVE-2023-53936

Cameleon CMS 2.7.4 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts into post titles. Attackers can create posts with embedded SVG scripts that execute when other users mouse over the post title, potentially stealing...

CVE-2023-53920

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface podcastdetails.php. Malicious JavaScript payloads injected into the podcast title execute when users visit the application's home page...

Cross-site Scripting (XSS)

Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the post title field. An attacker can execute arbitrary JavaScript in the context of oth...

EUVD-2023-60211

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface podcastdetails.php. Malicious JavaScript payloads injected into the podcast title execute when users visit the application's home page...

EUVD-2023-60226

Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the smilie category title parameter. Attackers can create a smilie category with a malicious script that will execute when the admin panel is loaded,...

CVE-2023-53920

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface podcastdetails.php. Malicious JavaScript payloads injected into the podcast title execute when users visit the application's home page...

CVE-2023-53920

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface podcastdetails.php. Malicious JavaScript payloads injected into the podcast title execute when users visit the application's home page...

CVE-2023-53904

Xenforo 2.2.13 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the smilie category title parameter. Attackers can create a smilie category with a malicious script that will execute when the admin panel is loaded,...

CVE-2023-53920 PodcastGenerator Stored Cross-Site Scripting via Podcast Title Field

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface podcastdetails.php. Malicious JavaScript payloads injected into the podcast title execute when users visit the application's home page...

CVE-2023-53920 PodcastGenerator Stored Cross-Site Scripting via Podcast Title Field

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the podcast title field accessible through the podcast details interface podcastdetails.php. Malicious JavaScript payloads injected into the podcast title execute when users visit the application's home page...

CVE-2023-53920

CVE-2023-53920 concerns PodcastGenerator 3.2.9, with a stored cross-site scripting (XSS) vulnerability in the podcast title field exposed via the podcast_details.php interface. The malicious payloads injected into the podcast title can execute when users visit the application’s home page, indicat...

CVE-2023-53918 PodcastGenerator Stored Cross-Site Scripting via Episode Title Field

PodcastGenerator 3.2.9 contains a stored cross-site scripting vulnerability in the episode title field accessible through the episodes upload interface episodesupload.php. Malicious JavaScript payloads injected into episode titles execute when administrators view the episodes list page...

CVE-2023-53904

CVE-2023-53904 affects XenForo 2.2.13: authenticated administrators can trigger a stored XSS via the smilie category title parameter, with scripts executing when the admin panel loads. Public detail confirms the issue, its stored nature, and that the vulnerability is exploitable in the admin cont...

CVE-2025-8082

A flaw was found in Vuetify's VDatePicker component. This vulnerability allows unsanitized HTML to be inserted into the page, leading to a Cross-Site Scripting XSS attack via the 'title-date-format' property accepting a user-created function and assigning its output to the 'innerHTML' property...

PT-2025-51958

Name of the Vulnerable Software and Affected Versions PodcastGenerator version 3.2.9 Description PodcastGenerator version 3.2.9 has a stored cross-site scripting issue in the podcast title field. This flaw is accessible through the podcast details interface, specifically the podcast details.php...

PT-2025-51942

Name of the Vulnerable Software and Affected Versions Xenforo version 2.2.13 Description The software contains a stored cross-site scripting issue. Authenticated administrators can inject malicious scripts through the smilie category title parameter. Creating a smilie category with a malicious...

PT-2025-51956

Name of the Vulnerable Software and Affected Versions PodcastGenerator version 3.2.9 Description PodcastGenerator version 3.2.9 has a stored cross-site scripting issue. A malicious JavaScript payload can be injected into the episode title field through the episodes upload interface, specifically...

Podcast Generator 跨站脚本漏洞

Podcast Generator is an open source set of free podcast publishing scripts written in PHP by PodcastGenerator. A cross-site scripting vulnerability exists in Podcast Generator version 3.2.9, which stems from improper cleaning of the episode title field and could lead to a stored cross-site...

Podcast Generator 跨站脚本漏洞

Podcast Generator is an open source set of free podcast publishing scripts written in PHP by PodcastGenerator. A cross-site scripting vulnerability exists in Podcast Generator version 3.2.9, which stems from improper cleaning of the podcast title field and could lead to a stored cross-site...

Cross-site Scripting (XSS)

Vuetify is vulnerable to Cross-site Scripting XSS. The vulnerability is due to unsanitized HTML being assigned to the innerHTML of the VDatePicker title via the title-date-format property, which allows an attacker to inject and execute arbitrary JavaScript in the victim’s browser...