Ex libris ALEPH 500 Cross-Site Scripting Vulnerability

Ex libris ALEPH 500 is an integrated library system from the Israeli company Ex libris. ex libris ALEPH 500 v18.1 and v20 versions are vulnerable to a cross-site scripting vulnerability that stems from the program's lack of data validation filtering of user-supplied data and output. An attacker...

CVE-2022-24177: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows attackers to execute arbitrary web scripts or HTML...

Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability (CNVD-2022-19498)

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

CVE-2021-38269

Cross-site scripting XSS vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell...

Cross site scripting

Cross-site scripting XSS vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the keywords parameter. This issue is caused by an incomplete fix in CVE-2021-35463...

Cross site scripting

Cross-site scripting XSS vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell...

Cross site scripting

Cross-site scripting XSS vulnerability in the Blogs module's edit blog entry page in Liferay Portal 7.3.2 through 7.3.6, and Liferay DXP 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the comliferayblogswebportletBlogsAdminPortlettitle and...

Htmly Cross-Site Scripting Vulnerability (CNVD-2022-73492)

Htmly is a PHP-based blogging platform. version 2.8.1 of Htmly is vulnerable to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to execute arbitrary web script HTML via a specially crafted payload in the blog post content field...

Liferay Portal and Liferay DXP cross-site scripting vulnerabilities

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

PluXml Cross-Site Scripting Vulnerability (CNVD-2022-73493)

PluXml is a content management system that does not require a database to work.A cross-site scripting vulnerability exists in PluXML version 5.8.7. An attacker can exploit this vulnerability to execute arbitrary web script or HTML via a payload in the thumbnail path of a blog post...

CVE-2021-38269

The CVE-2021-38269 affects the Gogo Shell module in Liferay Portal (versions 7.1.0–7.3.6 and 7.4.0) and Liferay DXP (7.1 before fix pack 23, 7.2 before fix pack 13, 7.3 before fix pack 2). It enables remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command, i...

CVE-2021-38264

Cross-site scripting XSS vulnerability in the Frontend Taglib module in Liferay Portal 7.4.0 and 7.4.1 allows remote attackers to inject arbitrary web script or HTML into the management toolbar search via the keywords parameter. This issue is caused by an incomplete fix in CVE-2021-35463...

CVE-2021-38264

CVE-2021-38264 affects Liferay Portal’s Frontend Taglib module in versions 7.4.0 and 7.4.1 , enabling XSS via the management toolbar search keywords parameter . The issue stems from an incomplete fix in CVE-2021-35463. The Connected documents confirm the affected product/version and the underlyin...

CVE-2021-38265

CVE-2021-38265 is an XSS vulnerability in the Asset module of Liferay Portal, affecting version 7.3.4–7.3.6. An attacker can remotely inject arbitrary web script or HTML when creating a collection page using the parameter _com_liferay_asset_list_web_portlet_AssetListPortlet_title. The connected d...

PaquitoSoftware Notimoo Cross-Site Scripting Vulnerability

Notimoo is a method for web developers to display notifications to users. PaquitoSoftware Notimoo suffers from a cross-site scripting vulnerability that can be exploited by attackers to execute arbitrary web script or HTML via a carefully crafted header or message in a notification...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in forms generated by JQueryForm.com before 2022-02-05 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to admin.php...

CVE-2022-24981

CVE-2022-24981 describes a reflected XSS in forms generated by JQueryForm.com prior to 2022-02-05. The vulnerability is triggered via the redirect parameter to admin.php, allowing remote attackers to inject arbitrary web script or HTML. Documents consistently identify the affected component as th...

CVE-2022-24590

A stored cross-site scripting XSS vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML...

PT-2022-12798

Name of the Vulnerable Software and Affected Versions Issabel PBX version 20200102 Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the username and password fields in the Add User module. This enables the execution of malicious...

PT-2022-16737

Name of the Vulnerable Software and Affected Versions PluXml version 5.8.7 Description A stored cross-site scripting XSS issue in the /core/admin/comment.php component allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter. Recommendations For PluX...