Tag
#xss
SuperCali version 1.1.0 suffers from a cross site scripting vulnerability.
Time to get patching!
### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being rendered within a [`Choices`](https://labelstud.io/tags/choices) or [`Labels`](https://labelstud.io/tags/labels) tag, resulting in an XSS vulnerability. ### Details Need permission to use the "data import" function. This was reproduced on Label Studio 1.10.1. ### PoC 1. Create a project.  2. Upload a file containing the payload using the "Upload Files" function.   The following are the contents of the files used in the PoC ``` { "data": { "prompt": "...
There is a XSS Vulnerability in Site search Feature to baserCMS. ### Target baserCMS 5.0.8 and earlier versions ### Vulnerability Malicious code may be executed in Site search Feature. ### Countermeasures Update to the latest version of baserCMS Please refer to the following page to reference for more information. https://basercms.net/security/JVN_73283159
There is a XSS Vulnerability in Content Management Feature to baserCMS. ### Target baserCMS 5.0.8 and earlier versions ### Vulnerability Malicious code may be executed in Content Management Feature. ### Countermeasures Update to the latest version of baserCMS Please refer to the following page to reference for more information. https://basercms.net/security/JVN_73283159
A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field.
A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Create Tag text field.
A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Undertitle text field.
CMS Made Simple version 2.2.19 suffers from a persistent cross site scripting vulnerability.
SitePad version 1.8.2 suffers from a persistent cross site scripting vulnerability.