6038 matches found
CVE-2023-37302
An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate from resources/wikibase/templates.js for quotes which can be in a title attribute...
CVE-2023-37302
An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate from resources/wikibase/templates.js for quotes which can be in a title attribute...
MediaWiki 跨站脚本漏洞
MediaWiki is a suite of free and freely available web-based Wiki engines from the MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki 1.39.3 and earlier versions, which stems from a...
CVE-2023-30946
A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UU...
CVE-2023-30946
A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UU...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS when rendering pages in pages/actionscomponent.html.erb. A user can embed scripts in a page title via the pageencontentattributes0title parameter. PoC '" Details Cross-site scripting or XSS is a code vulnerabili...
CVE-2023-34831
The "Submission Web Form" of Turnitin LTI tool/plugin version 1.3 is affected by HTML Injection attacks. The security issue affects the submission web form "id" and "title" HTTP POST parameters where the students submit their reports for similarity/plagiarism checks...
PT-2023-25018 · Turnitin · Turnitin Lti Tool
Name of the Vulnerable Software and Affected Versions: Turnitin LTI tool/plugin version 1.3 Description: The issue affects the "Submission Web Form" of the Turnitin LTI tool/plugin, where students submit their reports for similarity/plagiarism checks. Specifically, the submission web form is...
CVE-2020-18404
An issue was discovered in espcms version P8.18101601. There is a cross site scripting XSS vulnerability that allows arbitrary code to be executed via the title parameter...
CVE-2020-18404
An issue was discovered in espcms version P8.18101601. There is a cross site scripting XSS vulnerability that allows arbitrary code to be executed via the title parameter...
EARCLINK ESPCMS 跨站脚本漏洞
Honghu Erchuang Netlink Information Technology EARCLINK ESPCMS is an enterprise website building system of China Honghu Erchuang Netlink Information Technology Company. A security vulnerability exists in EARCLINK ESPCMS version P8.18101601. An attacker exploited the vulnerability to execute...
PT-2023-11495 · Espcms · Espcms
Name of the Vulnerable Software and Affected Versions: espcms version P8.18101601 Description: The issue allows arbitrary code to be executed via the title parameter, enabling cross-site scripting XSS. This means an attacker could inject malicious code into a website, potentially stealing user da...
CVE-2020-18404
An issue was discovered in espcms version P8.18101601. There is a cross site scripting XSS vulnerability that allows arbitrary code to be executed via the title parameter...
CVE-2023-35153 XWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters
XWiki Platform is a generic wiki platform. Starting in version 5.4.4 and prior to versions 14.4.8, 14.10.4, and 15.0, a stored cross-site scripting vulnerability can be exploited by users with edit rights by adding a AppWithinMinutes.FormFieldCategoryClass class on a page and setting the payload ...
PT-2023-3566 · Discourse · Discourse
Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest stable, beta and tests-passed version Description: The issue is related to insufficient input validation when processing topic titles, allowing a remote attacker to impact the integrity and availability ...
CVE-2023-3201
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstoreupdatenewordertitle function. This makes it possible for unauthenticated attackers to update new order title via a forged request granted they can trick a site administrato...
MStore API < 3.9.7 - Multiple CSRF
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as Order Status Update, Order Title Update, Product Limit Update, Order Message Update, and Firebase Server Key Update...
CVE-2023-22585
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter...
