Limbas 4.3.36.1319 is vulnerable to Cross Site Scripting (XSS).

Like Access, from basic features such as table management, form and report generator as well as charting and workflow features it can be dynamically modeled with one another to any product solution. Limbas is based on PHP.

**Features**

*   quickly create webbased applications
*   completly webbased for allmost all browsers
*   easy to use graphical userinterface
*   graphical wizzards for building views, forms and reports
*   support of many databases like maxdb, postgresql, ingres, mssql
*   Administration tools for backup and export, rulemanagement, triggers and more
*   integrated filemanager with DMS functionality
*   integrated ajax-based calendar
*   reminder functionality with sending reminders to users or groups
*   recursiv versioning of datasets and files
*   support SOAP and WEBDAV interfaces
*   YII-Framework connection class for limbas

**License**GNU General Public License version 2.0 (GPLv2)

Other Useful Business Software

Discover HPCC Systems - the truly open source big data solution that allows you to quickly process, analyze and understand large data sets, even data stored in massive, mixed-schema data lakes. Designed by data scientists, HPCC systems is a complete integrated solution from data ingestion and data processing to data delivery. The free online introductory courses and a robust developer community allow you to get started quickly.

**User Ratings**

5.0 out of 5 stars

★★★★★

★★★★

★★★

★★

★

ease 1 of 5 2 of 5 3 of 5 4 of 5 5 of 5 0 / 5

features 1 of 5 2 of 5 3 of 5 4 of 5 5 of 5 0 / 5

design 1 of 5 2 of 5 3 of 5 4 of 5 5 of 5 0 / 5

support 1 of 5 2 of 5 3 of 5 4 of 5 5 of 5 0 / 5

**User Reviews**

*   All
*   ★★★★★
*   ★★★★
*   ★★★
*   ★★
*   ★

*   1 user found this review helpful.
    
*   A powerful system very flexible and easy to handle. Using a browser to access LIMBAS gives you the possibility to work from any location and device. No license fees.
    
*   looks like the answer of my prayers :-)
    

Read more reviews >

**Additional Project Details**

**Languages**French, English, German

**Intended Audience**Information Technology, Developers, End Users/Desktop

**User Interface**Web-based

**Programming Language**PHP

**Database Environment**Other network-based DBMS, ODBC

**Registered**

2006-01-04

CVE-2022-28454: Limbas

WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS).

**Latest commit**

**Files**Permalink

Failed to load latest commit information.

Type

Name

Latest commit message

Commit time

CVE-2022-28477: GitHub - APTX-4879/CVE

Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit ????? plugin <= 3.1.6 on WordPress via &title parameter.

*   Details
*   Reviews
*   Support
*   Development

This plugin has been closed as of April 25, 2022 and is not available for download. This closure is temporary, pending a full review.

知道该插件已经是好几年前了，之后很少有机会在网上写博客了，所以可能就不会再用到这个插件了，直到前几天又要做个小东西，我想到了这个插件，发现作者还在更新，百感交集，先不谈插件好不好，单单作者这份坚持和用心，就已经打动了我，当然，作者写的插件易用小巧，适用多环境下，这也是我第一次给WordPress widget评价，对作者的坚持表示敬佩和感谢。 PS：如果能支持一下微信小程序就更好了，现在我是通过Webview来使用的，经过简单的模板适配，依然适用！

用了两年了，作者一直有在不断更新！这是目前能用的到的最简洁、美观、实用的音乐播放插件，支持网易和虾米。虽然还有一部分音乐版权在QQ音乐手上，但是已经知足了，毕竟同类可以调用三者的插件UI简直辣眼睛。

Read all 4 reviews

“Hermit 音乐播放器” is open source software. The following people have contributed to this plugin.

Contributors

*    mu feng

CVE-2022-29413: Hermit 音乐播放器

Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin <= 2.16 at WordPress.

**ravpage**

**Software**

**Ravpage**

**Vulnerable Versions**

**<= 2.16**

**Fixed in version**

**CVE**

**CVE-2022-29415**

**References**

**Credits**

**Classification**

**Cross Site Scripting (XSS)**

**OWASP Top 10**

**A7: Cross-Site Scripting (XSS)**

**Disclosure Date**

**2022-04-28**

**CVSS 3.0 score**

**Can be exploited remotely without any authentication.**

**Plugin does not exist, is not supported or discontinued.**

**Are your websites subject to this vulnerability?**

**Details**

**Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability was discovered by Tien Nguyen Anh (Patchstak Alliance) in the WordPress Ravpage plugin (versions <= 2.16).**

**Solution**

**Deactivate and delete. This plugin has been closed as of April 21, 2022 and is not available for download. This closure is temporary, pending a full review.**

**Found a vulnerability that puts your sites at risk?**

**Found a vulnerability? Help us secure the web and join our community of ethical hackers.**

**Are you the developer of this software? Hire our researchers for a thorough security audit.**

CVE-2022-29415: WordPress Ravpage plugin <= 2.16 - Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress.

This plugin **hasn’t been tested with the latest 3 major releases of WordPress**. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

**Description**

Provides an interface in the dashboard, similar to the post edit screen, that allows you to easily change the text displayed in the footer on the front-end. After installing the plugin, add the footer_text() template tag to your footer.php theme template where you want the text to display. For more options, see the FAQ.

You can use these shortcodes in the footer text editor:

*   [last_modified] the date that the current page was last modified on
*   [page_link] the full permalink of the current page, formatted. The content wrapped in this shortcode will be used as the link text
*   [year] the current year eg: 2013

Visit the plugin homepage, or contribute to its development at GitHub.

**Screenshots**

**Installation**

1.  Upload the footer-text directory to the /wp-content/plugins/ directory
2.  Activate the plugin through the ‘Plugins’ menu in WordPress
3.  Visit _Appearance > Footer Text_ to write your awesome footer text
4.  Place the footer_text() template tag somewhere in your theme where you want the text displayed
5.  Visit site. Observe.

**FAQ**

**How can I display the footer text in my theme?**

You can use the footer_text() function to display the footer text, or the get_footer_text() function to return it for use in PHP. These template tags should generally be used in the footer.php file of your theme.

The footer_text() function outputs the formatted footer text and accepts three parameters: $before, $after and $default. $before will be outputted _before_ the text, $after will be outputted _after_ the text, and $default will be used instead of the text is none is set. If no text is set $default is empty, nothing will be displayed.

The get_footer_text() function returns the formatted footer text and accepts one parameter: $default, which will be returned if no text is set.

If the plugin isn’t active, the template tag will result in an error. To solve this, you can use an action hook instead:

    do_action( 'footer_text', $default, $before, $after );
    

This works the same as calling the footer_text() function, and any of the three arguments can be omitted.

**Reviews**

Erik September 3, 2016

It still does the trick, even in 4.4!

mojen September 3, 2016

Does exactly what it says on the tin. It works with Insert Pages shortcodes as well. Thank you!

Read all 6 reviews

**Contributors & Developers**

“Footer Text” is open source software. The following people have contributed to this plugin.

Contributors

*    Shea Bunge

**Changelog****2.0.3**

*   Added a message when the text is updated.

**2.0.2**

*   Use a <h1> heading on administration pages

**2.0.1**

*   Update screenshots for WordPress 3.9
*   Add braces to one-line conditionals

**2.0.0**

*   Delete footer text from database on uninstall
*   Added an action as an alternate way to display footer text
*   Restructured code
*   Fixed \[page\_link\] shortcode
*   Added custom ‘edit\_footer\_text’ capability
*   Added support for translations

**1.0.0**

*   Initial release

CVE-2022-27860: Footer Text

Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.

@@ -380,27 +380,32 @@ private function getPluginInfo(string $pluginName, string $iniContent): array

'require' => \[\],

'version' => 1

\];

  

$ini = parse\_ini\_string($iniContent);

if ($ini !== false) {

foreach (\['name', 'version', 'description', 'min\_version'\] as $key) {

$info\[$key\] = $ini\[$key\] ?? $info\[$key\];

}

if ($ini === false) {

return $info;

}

  

if (isset($ini\['require'\])) {

$info\['require'\] = explode(',', $ini\['require'\]);

}

$info\['name'\] = strip\_tags($ini\['name'\] ?? $info\['name'\]);

$info\['version'\] = floatval($ini\['version'\] ?? $info\['version'\]);

$info\['description'\] = strip\_tags($ini\['description'\] ?? $info\['description'\]);

$info\['min\_version'\] = floatval($ini\['min\_version'\] ?? $info\['min\_version'\]);

  

if ($info\['min\_version'\] >= 2018 && $info\['min\_version'\] <= self::CORE\_VERSION) {

$info\['compatible'\] = true;

$info\['description'\] = ('Incompatible' === $info\['description'\]) ? ToolBox::i18n()->trans('compatible') : $info\['description'\];

} else {

$info\['description'\] = ToolBox::i18n()->trans('incompatible-with-facturascripts', \['%version%' => self::CORE\_VERSION\]);

if (isset($ini\['require'\])) {

foreach (explode(',', $ini\['require'\]) as $req) {

$req = trim($req);

if (!empty($req)) {

$info\['require'\]\[\] = $req;

}

}

}

  

$info\['enabled'\] = in\_array($info\['name'\], $this\->enabledPlugins());

if ($info\['min\_version'\] <= self::CORE\_VERSION && $info\['min\_version'\] >= 2020) {

$info\['compatible'\] = true;

} else {

$info\['description'\] = ToolBox::i18n()->trans('incompatible-with-facturascripts', \['%version%' => self::CORE\_VERSION\]);

}

  

$info\['enabled'\] = in\_array($info\['name'\], $this\->enabledPlugins());

return $info;

}

CVE-2022-1514: Sanitized the data read from the ini file to avoid security problems. · NeoRazorX/facturascripts@aa9f28c

Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript code is constructed to perform an action.

**Forums | Mahara Community**

This topic is closed. Only moderators and the group administrators can post new replies.

Posts: 693

27 April 2022, 13:21

Vulnerability type: Cross-site scripting (XSS) / stored XSS  
Attack type: Remote  
Impact: Code execution

Affected components: The 'External media' block and anywhere you can enter HTML code, such as a text block, notes, journal entry, and forum post.

Suggested description: Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 are vulnerable to stored cross-site scripting when a particular CSS class for embedly is used and JavaScript code constructed to perform an action.

Reported by: Can't disclose  
Bug report: https://bugs.launchpad.net/mahara/+bug/1968920  
CVE reference: 2022-29584

CVE-2022-29584: Security Announcements - XSS exploit in 'External media' block in Mahara before 20.10.5, 21.04.4, and 21.10.2  - Mahara ePortfolio System

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  211408.

  

**Summary**

A cross-site scripting vulnerability in IBM InfoSphere Information Server was addressed.

**Vulnerability Details**

**CVEID:**   CVE-2021-38952  
**DESCRIPTION:**   IBM InfoSphere Information Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  
CVSS Base score: 5.4  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/211408 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

**Affected Products and Versions**

Affected Product(s)

Version(s)

InfoSphere Information Server, Information Server on Cloud

11.7

  

**Remediation/Fixes**

**Product**

**VRMF**

**APAR**

**Remediation**

InfoSphere Information Server, InfoSphere Information Server on Cloud

11.7

JR64586

\--Apply IBM InfoSphere Information Server version 11.7.1.0  
\--Apply IBM InfoSphere Information Server version 11.7.1.3  
\--Apply Information Server 11.7.1.3 Service pack 4

**Workarounds and Mitigations**

None

**References**

Off

**Change History**

27 Apr 2022: Initial Publication

\*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

**Disclaimer**

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

**Document Location**

Worldwide

\[{"Business Unit":{"code":"BU059","label":"IBM Software w\\/o TPS"},"Product":{"code":"SSZJPZ","label":"InfoSphere Information Server"},"Component":"","Platform":\[{"code":"PF002","label":"AIX"},{"code":"PF033","label":"Windows"},{"code":"PF016","label":"Linux"}\],"Version":"11.7","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}\]

CVE-2021-38952: Security Bulletin: IBM InfoSphere Information Server is vulnerable to cross-site scripting (CVE-2021-38952)

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  218370.

  

**Summary**

A cross-site scripting vulnerability in IBM InfoSphere Information Server was addressed.

**Vulnerability Details**

**CVEID:**   CVE-2022-22322  
**DESCRIPTION:**   IBM InfoSphere Information Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  
CVSS Base score: 5.4  
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/218370 for the current score.  
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

**Affected Products and Versions**

Affected Product(s)

Version(s)

InfoSphere Information Server, Information Server on Cloud

11.7

  

**Remediation/Fixes**

**Product**

**VRMF**

**APAR**

**Remediation**

InfoSphere Information Server, InfoSphere Information Server on Cloud

11.7

JR64704

\--Apply IBM InfoSphere Information Server version 11.7.1.0  
\--Apply IBM InfoSphere Information Server version 11.7.1.3  
\--Apply Information Server 11.7.1.3 Service pack 4

**Workarounds and Mitigations**

None

**References**

Off

**Change History**

27 Apr 2022: Initial Publication

\*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

**Disclaimer**

According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES ""AS IS"" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

**Document Location**

Worldwide

\[{"Business Unit":{"code":"BU059","label":"IBM Software w\\/o TPS"},"Product":{"code":"SSZJPZ","label":"InfoSphere Information Server"},"Component":"","Platform":\[{"code":"PF002","label":"AIX"},{"code":"PF033","label":"Windows"},{"code":"PF016","label":"Linux"}\],"Version":"11.7","Edition":"","Line of Business":{"code":"LOB10","label":"Data and AI"}}\]

Tag

#xss