CVE-2022-30429

Multiple cross-site scripting XSS vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also ...

PT-2022-20114 · Neos Cms · Neos Cms

Name of the Vulnerable Software and Affected Versions: Neos CMS versions 3.3.29 through 8.0.1 Description: Multiple cross-site scripting XSS vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion o...

Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS

The plugin does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create a new Grid/Caroussel, in the General Settings, enable "Display Header Title" and put the...

Post Grid, Slider & Carousel Ultimate < 1.5.0 - Admin+ Stored XSS

The plugin does not sanitise and escape the Header Title, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Create a new Grid/Caroussel, in the General Settings, enable "Display Header Title" and put the following...

GHSA-JJ94-J4R3-5GR4 Subrion Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability in Subrion 4.2.1 via the title when adding a page...

Subrion Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability in Subrion 4.2.1 via the title when adding a page...

GHSA-74GC-HF33-5353 Fork CMS Cross-site Scripting Vulnerability

Fork before 5.8.3 allows XSS via navigationtitle or title...

GHSA-CCMG-W4XM-P28V Grafana XSS in header column rename

Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip...

GHSA-PJV5-VV93-P648 Possible to circumvent title-blacklist

MediaWiki through 1.33.1 allows attackers to bypass the Titleblacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page...

Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via a Journal Article Title

Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journalarticle/page.jsp in journal/journal-taglib...

GHSA-M2GX-7PVX-3GVG Liferay Portal Vulnerable to Cross-Site Scripting (XSS) via a Journal Article Title

Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journalarticle/page.jsp in journal/journal-taglib...

GHSA-PH84-VG7Q-FQQ8 Bolt Cross-site Scripting (XSS) via a title that is mishandled in the system log

Bolt before 3.6.10 has XSS via a title that is mishandled in the system log...

m1k1o's Blog v.10 - Remote Code Execution (RCE) (Authenticated)

Exploit Title: m1k1o's Blog v.10 - Remote Code Execution RCE Authenticated Date: 2022-01-06 Exploit Author: Malte V Vendor Homepage: https://github.com/m1k1o/blog Software Link: https://github.com/m1k1o/blog/archive/refs/tags/v1.3.zip Version: 1.3 and below Tested on: Linux CVE : CVE-2022-23626...

GHSA-5GH4-V2CH-PCX4 phpMyAdmin Multiple cross-site scripting (XSS) vulnerabilities

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 3.5.x before 3.5.8.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving a JavaScript event in 1 an anchor identifier to setup/index.php or 2 a chartTitle aka chart title value...

Alkacon OpenCMS XSS via title and requestedResource parameters

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to system/workplace/views/admin/admin-main.jsp or the 2 requestedResource parameter to system/login/index.html...

GHSA-4GFX-P2J4-W2VH Alkacon OpenCMS XSS via title and requestedResource parameters

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to system/workplace/views/admin/admin-main.jsp or the 2 requestedResource parameter to system/login/index.html...

Apache Jetspeed vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a 1 link, 2 page, or 3 folder resource...

GHSA-5PGM-9G57-3WC7 Apache Jetspeed vulnerable to Cross-site Scripting

Multiple cross-site scripting XSS vulnerabilities in Apache Jetspeed before 2.3.1 allow remote attackers to inject arbitrary web script or HTML via the title parameter when adding a 1 link, 2 page, or 3 folder resource...

Canvs Canvas Cross-site Scripting (XSS) via title and content fields

cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...

GHSA-3657-Q433-MMPX Canvs Canvas Cross-site Scripting (XSS) via title and content fields

cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a "Posts Add New" action, and during creation of new tags and users...