262 matches found
Exploit for CVE-2025-52097
CVE-2025-52097 – Reflected XSS in InstantForum.NET v4.1.4 Thi...
CVE-2023-28800
When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...
The vulnerability of the system-mounted module in operating systems such as Synology BeeStation Manager (BSM), Synology DiskStation Manager (DSM), and the enterprise-level server Synology Unified Controller allows a perpetrator to execute arbitrary code.
The vulnerability of the system-mounted modules of the Synology BeeStation Manager BSM, Synology DiskStation Manager DSM, and the corporate-level server Synology Unified Controller lies in the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a remote...
The vulnerability of the distributed Git version control system, related to the lack of mechanisms for encoding or shielding output data, allows a hacker to disclose protected information.
The vulnerability of the distributed Git version control system is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential data...
SUSE CVE-2024-42330
The HttpRequest object allows to get the HTTP headers from the server's response after sending the request. The problem is that the returned strings are created directly from the data returned by the server and are not correctly encoded for JavaScript. This allows to create internal strings that...
CVE-2024-42330
CVE-2024-42330 affects Zabbix: the HttpRequest object exposes HTTP header strings constructed directly from server data without proper JavaScript encoding, enabling creation of internal strings that can access hidden object properties. Documents reference Zabbix-related advisories and Debian LTS ...
SAP CRM 跨站脚本漏洞
SAP CRM is a customer relationship management system from SAP, Germany. SAP CRM suffers from a cross-site scripting vulnerability that stems from custom CSS support options that do not adequately encode user-controlled input, which can be exploited by an attacker to execute arbitrary web script o...
ghtml Cross-Site Scripting Vulnerability
ghtml is a toolkit by the individual developer Gürgün Dayıoğlu. A cross-site scripting vulnerability exists in ghtml versions prior to 2.0.0, which stems from unprocessed attribute value encoding and lack of control over href values, and could lead to cross-site scripting...
GHSA-6FC6-CJ2J-H22X TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend
Failing to properly encode editor input, several frontend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML...
Cross Site Scripting (XSS)
typo3/cms-core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a failure to properly encode user input in frontend forms handled by the form framework, allowing malicious users to inject and execute arbitrary JavaScript code in the context of other users' browsers...
PT-2024-40096 · Microsoft · Internet Explorer
Name of the Vulnerable Software and Affected Versions: Silverstripe versions prior to a fixed version affected versions not specified Description: The issue affects Internet Explorer browsers, where requests do not encode all entities in the URL string. As a result, when rewriting hashlinks,...
PT-2024-25049 · Unknown · Data Provisioning Service
Name of the Vulnerable Software and Affected Versions: Data Provisioning Service affected versions not specified Description: The issue is related to the Document Service handler in the Data Provisioning Service, which does not properly encode user-controlled inputs. This results in a Cross-Site...
PT-2023-32544 · Qualys · Qualys Web Application
Name of the Vulnerable Software and Affected Versions: Qualys web application affected versions not specified Description: The issue is related to a stored XSS vulnerability in a Qualys web application. This vulnerability is caused by the absence of HTML encoding in the presentation of logging...
PT-2023-32656 · Unknown · Bigprof Online Invoicing System
Name of the Vulnerable Software and Affected Versions: BigProf Online Invoicing System version 2.6 Description: A vulnerability has been discovered in the BigProf Online Invoicing System, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the...
CVE-2023-37488
In SAP NetWeaver Process Integration - versions SAPXIESR 7.50, SAPXITOOL 7.50, SAPXIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site Scripting XSS attack. On successful exploitation the attacker can cause limited impact on confidentiality and integrity of t...
Cross-Site Scripting (XSS)
typo3/html-sanitizer is vulnerable to Cross-Site Scripting XSS. The vulnerability exists because a malicious text embedded in a noscript element was not encoded appropriately due to a serialization layer encoding bug, which allows an attacker to inject and execute arbitrary JavaScript when noscri...
GHSA-69VW-3PCM-84RW Jenkins Stored Cross-site Scripting vulnerability
Jenkins applies formatting to the console output of builds, transforming plain URLs into hyperlinks. Jenkins 2.415 and earlier, 2.414 and earlier, and LTS 2.401.2 and earlier does not sanitize or properly encode URLs of these hyperlinks in build logs. This results in a stored cross-site scripting...
The vulnerability of the system administration program Sudo, related to the lack of mechanisms for encoding or shielding output data, allows attackers to gain access to confidential information.
The vulnerability of the system administration program Sudo is related to the lack of mechanisms for encoding or shielding output data. Exploiting this vulnerability allows a remote attacker to gain access to confidential data...
Cross site scripting
The web interface of Gira Giersiepen Gira KNX/IP-Router 3.1.3683.0 and 3.3.8.0 responds with a "404 - Not Found" status code if a path is accessed that does not exist. However, the value of the path is reflected in the response. As the application will reflect the supplied path without...
