29800 matches found
Cross site scripting
Cross-site scripting XSS vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remote attackers to inject arbitrary web script or HTML via the movieName parameter...
Cross site request forgery (csrf)
NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html, as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack...
Cross site scripting
Cross-site scripting XSS vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter...
CVE-2020-23370
In YzmCMS 5.6, stored XSS exists via the common/static/plugin/ueditor/1.4.3.3/php/controller.php action parameter, which allows remote attackers to upload a swf file. The swf file can be injected with arbitrary web script or HTML...
CVE-2020-23371
Cross-site scripting XSS vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remote attackers to inject arbitrary web script or HTML via the movieName parameter...
CVE-2020-23371
CVE-2020-23371 is a cross-site scripting (XSS) vulnerability in noneCms v1.3.0, affecting the SWF file static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf. The issue allows remote attackers to inject arbitrary script or HTML via the movieName parameter. The connected CNVD/CNNVD ent...
CVE-2020-23373
Cross-site scripting XSS vulnerability in admin/nav/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter...
PT-2021-10891
Name of the Vulnerable Software and Affected Versions YzmCMS version 5.6 Description The issue allows remote attackers to upload a swf file, which can be injected with arbitrary web script or HTML, via the action parameter in the "common/static/plugin/ueditor/1.4.3.3/php/controller.php" API...
CKEditor 4.0 vulnerability in the HTML Data Processor
A cross-site scripting XSS vulnerability in the HTML Data Processor for CKEditor 4.0 before 4.14.0 allows remote attackers to inject arbitrary web script through a crafted "protected" comment with the ckeprotected syntax...
CVE-2021-32092
A Cross-site scripting XSS vulnerability in the DocumentAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter...
CVE-2021-32092
A Cross-site scripting XSS vulnerability in the DocumentAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter...
Cross site scripting
A Stored XSS vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter...
GHSA-V47F-VP3P-5J6H Cross-site scripting in ThinkAdmin
ThinkAdmin version v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML...
PHPFusion < 8.00.90 / 9.x < 9.10.00 XSS/CSRF Vulnerability
PHPFusion is prone to a cross-site scripting XSS and cross-site request forgery CSRF vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...
CVE-2021-28280
CSRF + Cross-site scripting XSS vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML...
Cross site scripting
CSRF + Cross-site scripting XSS vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML...
Cross site scripting
Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web script or HTML via modifying the name of the users. The XSS is executed when an administrator access the logs...
CVE-2020-22790
CVE-2020-22790 is an authenticated stored XSS in Safe FME Server (2019.2 and 2020.0 Beta). The vulnerability arises from allowing an attacker to inject arbitrary script/HTML by modifying a user’s name, with the XSS triggered when an administrator views the logs. The affected product is Safe FME S...
CVE-2020-22789: Improper Neutralization of Input During Web Page Generation
Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via the login page. The XSS is executed when an administrator accesses the logs...
Nagios Network Analyzer Cross-Site Scripting (CVE-2021-28924)
A cross-site scripting vulnerability exists in Nagios Network Analyzer. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...