Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title

Exploit Title: Authenticated Persistent XSS in Cameleon CMS 2.7.4 Google Dork: intext:"Camaleon CMS is a free and open-source tool and a fexible content management system CMS based on Ruby on Rails" Date: 2023-10-05 Exploit Author: Yasin Gergin Vendor Homepage: http://camaleon.tuzitio.com Softwar...

Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title Vulnerability

Exploit Title: Authenticated Persistent XSS in Cameleon CMS 2.7.4 Google Dork: intext:"Camaleon CMS is a free and open-source tool and a fexible content management system CMS based on Ruby on Rails" Exploit Author: Yasin Gergin Vendor Homepage: http://camaleon.tuzitio.com Software Link:...

Malicious code in docs-component-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1e4e933240e0533957a39c9132a6925469e069081320949dc198545fd1080a49 The OpenSSF Package Analysis project identified 'docs-component-title' @ 1.2.2 npm as malicious. It is considered malicious because: - The packa...

GHSA-M44F-9JHG-59CR alkacon-OpenCMS vulnerable to stored Cross-site Scripting

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

PT-2023-23381 · Alkacon · Alkacon Opencms

Name of the Vulnerable Software and Affected Versions: alkacon-OpenCMS version 11.0.0.0 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module. This enables...

Alkacon Software OpenCMS 跨站脚本漏洞

Alkacon Software OpenCMS is Germany's Alkacon Software a set of open source Java and XML-based content management system CMS. The system supports template engine, WYSIWYG editor and so on. A security vulnerability exists in Alkacon Software OpenCMS version v11.0.0.0. An attacker can exploit the...

CVE-2023-31544

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

Hostel < 1.1.5.2 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to Manage Rooms and click on "Click here to...

Cross site scripting

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter...

CVE-2023-31800

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter...

CVE-2023-31800

CVE-2023-31800 : Chamilo LMS version 1.11.18 is affected by a Cross Site Scripting (XSS) vulnerability in the forum title parameter that could allow a local attacker to execute arbitrary code. The provided connected documents confirm the affected product/version and the vulnerable parameter but d...

CVE-2023-31800

Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter...

Chamilo LMS 跨站脚本漏洞

Chamilo LMS is an open source online learning and collaboration system from the Chamilo Association. The system supports the creation of instructional content, distance training, and online question and answer sessions. A security vulnerability exists in Chamilo LMS version v.1.11.18. A local...

PT-2023-23461 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo Lms version 1.11.18 Description: A Cross Site Scripting issue allows a local attacker to execute arbitrary code via the forum title parameter. This enables the attacker to inject malicious scripts into the website, potentially leading...

CVE-2023-30619 XSS in the tooltip via an artifact title

Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifact is not properly escaped in the tooltip. A malicious user with the capability to create an artifact or to edit a field title could force victim to execute...

CVE-2023-30619

CVE-2023-30619 affects Tuleap Open ALM. The vulnerability is an XSS in the tooltip caused by the artifact title not being properly escaped, which could allow a user with permissions to create an artifact or edit a field title to force execution of malicious code. Affected versions are before 14.7...

PT-2023-22815 · Unknown · Tuleap Open Alm

Name of the Vulnerable Software and Affected Versions: Tuleap Open ALM versions prior to 14.7.99.143 Description: The title of an artifact is not properly escaped in the tooltip, allowing a malicious user with the capability to create an artifact or edit a field title to force a victim to execute...

phpMyFAQ 3.1.12 CSV Injection

Exploit Title: phpMyFAQ v3.1.12 - CSV Injection Application: phpMyFAQ Version: 3.1.12 Bugs: CSV Injection Technology: PHP Vendor URL: https://www.phpmyfaq.de/ Software Link: https://download.phpmyfaq.de/phpMyFAQ-3.1.12.zip Date of found: 21.04.2023 Author: Mirabbas Ağalarov Tested on: Windows 2...

PT-2023-22345

Name of the Vulnerable Software and Affected Versions ZHENFENG13 My-Blog affected versions not specified Description A cross site scripting XSS issue allows attackers to inject arbitrary web script or HTML via the title field in the "blog management" page due to the default configuration not usin...

Cross site scripting

Multiple stored cross-site scripting XSS vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Article Title or Article Summary parameters...