73 matches found
Cross site scripting
FlyCms 1.0 is vulnerable to Cross Site Scripting XSS in the email settings of the website settings section...
PT-2024-19481 · Flycms · Flycms
Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is related to Cross Site Scripting XSS in the email settings of the website settings section. This allows for potential malicious script injection. Recommendations: For FlyCms version 1.0, as a...
CVE-2024-22549
FlyCms 1.0 is vulnerable to Cross Site Scripting XSS in the email settings of the website settings section...
CVE-2024-22548
FlyCms 1.0 is vulnerable to Cross Site Scripting XSS in the system website settings website name section...
CVE-2024-22548
FlyCms 1.0 is vulnerable to Cross Site Scripting XSS in the system website settings website name section...
Cross-site Scripting (XSS) in Website Settings name field
Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.21 or apply this patches manually...
Dom-based XSS in Website Settings module in Settings
Description pimcore is vulnerable to Dom-based XSS at Name field in Website Settings module in Settings. Payload " Proof of Concept 1.Go to https://11.x-dev.pimcore.fun/admin/ and login. 2.In the left menu bar, go to Settings - Website Settings and input any text into Key field and choose a Type,...
HTML Injection on Settings/Template
Description Found HTML Injection on Template module on Settings. Proof of Concept 1. Login as Administrator and go to Settings. 2. On under Website Settings, go to Template. 3. Specifically, to this URL - https://demo.microweber.org/demo/admin/view:content/action:settings?group=template 4. Then...
SUSE CVE-2015-1261
android/java/src/org/chromium/chrome/browser/WebsiteSettingsPopup.java in Google Chrome before 43.0.2357.65 on Android does not properly restrict use of a URL's fragment identifier during construction of a page-info popup, which allows remote attackers to spoof the URL bar or deliver misleading...
SUSE CVE-2015-6780
Use-after-free vulnerability in the Infobars implementation in Google Chrome before 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted web site, related to browser/ui/views/websitesettings/websitesettingspopupview.cc...
Stored XSS in the module named "Website settings"
Description Our engineer found security problems when testing our website. And I have tested the demo website you provided. I found that there is indeed an xss vulnerability. I hope you can check and provide a fix as soon as possible.Thanks. \\ The reason for the vulnerability is that you have...
CVE-2022-36262
An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php...
Code injection
An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php...
CVE-2022-36262
An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php...
CVE-2022-36262
An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php...
PT-2022-23280 · Taocms · Taocms
Name of the Vulnerable Software and Affected Versions: taocms version 3.0.2 Description: An issue was discovered in the website settings that allows arbitrary php code to be injected by modifying config.php. Recommendations: For taocms version 3.0.2, consider restricting access to the config.php...
Cross-site Scripting (XSS) - Stored on Translations
Description Translations are vulnerable to Cross-Site Scripting. Steps to reproduce 1 - Go to Website - Settings 2 - Click on Languages 3 - Fill any field to be translated with an XSS payload : ". 4 - XSS popup will appear. Proof of concept...
Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Vuln : Stored XSS Description The pimcore/pimcore package is an open source platform that provides PIM, MDM, CDP, DAM, DXP/CMS & Digital Commerce services. stored xss vulnerability occurs when you change the value of name at "Setinngs" = "Website Settings" in the pimcore service. Proof of Concept...
Pagelayer < 1.3.5 - Multiple Reflected Cross-Site Scripting (XSS)
Multiple Cross-Site Scripting issues, via the font-size and color parameters of the Website Settings, were fixed in v1.3.5 of the plugin...
