CVE-2022-28284

SVG's use element could have been used to load unexpected content that could have executed script in certain circumstances. While the specification seems to allow this, other browsers do not, and web developers relied on this property for script security so gecko's implementation was aligned with...

Rdiffweb 跨站请求伪造漏洞

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. It provides quick access to your archives through an efficient web interface. A cross-site request forgery vulnerability exists in rdiffweb versions prior to 2.5.4. An attacker can exploit this vulnerability to...

CVE-2022-42362

CVE-2022-42362 concerns Adobe Experience Manager (AEM) 6.5.14 and earlier, with a reflected Cross-Site Scripting (XSS) vulnerability. An attacker who lure a user to a crafted URL can cause malicious JavaScript to run in the victim’s browser context. The available connected documents confirm the a...

Unsanitized input returned in response is conducive to XSS exploitation

Description During the initial installation process it was identified that the "Create user" form that collects user data, does not properly sanitize the data entry and then prints them on the screen with an error message without any apparent validation, thus allowing the insertion of HTML or...

Cross-site scripting - Stored via upload `.svg` file in

Description When user upload a file with .svg extension and direct access this file, the server response with Content-type: image/svg+xml lead to processing SVG as HTML file Proof of Concept POST /api/resource HTTP/2 Host: demo.usememos.com Cookie:...

Emby Server Cross-Site Scripting Vulnerability (CNVD-2025-20435)

Emby Server is a personal media server software that supports storing, managing, and streaming personal media content with support for multiple device access. A cross-site scripting vulnerability exists in Emby Server, which stems from the lack of effective filtering and escaping of user-supplied...

zaidap.com Cross Site Scripting vulnerability OBB-3106927

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

webtv.utc.fr Cross Site Scripting vulnerability OBB-3106919

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-42366

Adobe Experience Manager version 6.5.14 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

transad.my Cross Site Scripting vulnerability OBB-3103179

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

etp-bor.imfr.cgi.com Cross Site Scripting vulnerability OBB-3102576

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-46698

CVE-2022-46698 is a logic issue in WebKitGTK where processing malicious web content may disclose sensitive user information. Multiple connected advisories confirm this issue in WebKitGTK/WebKit2GTK components and list it among fixed CVEs after updates to WebKitGTK packages. Affected products incl...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Adobe Experience Manager 跨站脚本漏洞

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2022-46117

Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=viewproduct&id=...

ka1.18girl.club Cross Site Scripting vulnerability OBB-3099582

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

webadventure.at Cross Site Scripting vulnerability OBB-3099431

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

boa.be Cross Site Scripting vulnerability OBB-3092898

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PyRDFA 跨站脚本漏洞

PyRDFA is a parser library for RDFLib open source. It can be used to generate serialized versions of extracted graphics or simply generate RDFLib graphics. PyRDFA suffers from a cross-site scripting vulnerability. An attacker could exploit this vulnerability to perform a cross-site scripting atta...

CVE-2022-45008

Online Leave Management System v1.0 contains a stored cross-site scripting (XSS) vulnerability in the component /leave_system/admin/?page=maintenance/department. The flaw allows an attacker to run arbitrary web scripts or HTML by injecting a payload into the Name field under the Create New module...