TQRG/raw-osv-data huggingface dataset:
Vulnerability: GHSA-3v56-q6r6-4gcw
Summary: Insecure Inherited Permissions in neoan3-apps/template
Aliases: CVE-2021-41170
Severity: HIGH
CWE: CWE-732, CWE-277, CWE-74
Published: 2021-11-10T16:41:08Z

### Impact
Versions prior 1.1.1 have allowed for passing in closures directly into the template engine. As a result values that are callable are executed by the template engine. The issue arises if a value has the same name as a method or function in scope and can therefore be executed either by mistake or maliciously. 

In theory all users of the package are affected as long as they either deal with direct user input or database values. A multi-step attack on is therefore plausible. 


### Patches
Version 1.1.1 has addressed this vulnerability. 
```php
$params = [
   'reverse' => fn($input) => strrev($input),    // <-- no longer possible with version ~1.1.1
   'value' => 'My website' 
]
TemplateFunctions::registerClosure('reverse', fn($input) => strrev($input));  // <-- still possible (and nicely isolated)
Template::embrace('<h1>{{reverse(value)}}</h1>', $params);
```

### Workarounds
Unfortunately only working with hardcoded values is safe in prior versions. As this likely defeats the purpose of a template engine, please upgrade.

### References
As a possible exploit is relatively easy to achieve, I will not share steps to reproduce the issue for now.

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [our repo](https://github.com/sroehrl/neoan3-template)
Vulnerability: GHSA-3j58-p785-f27x
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0378
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-28T22:15:24Z

There is a reflected cross sitem scripting attack in microweber via url parameters.
Vulnerability: GHSA-xm3x-787m-p66r
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0964
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:46Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via `.webmv` file upload.
Vulnerability: GHSA-6v6p-g8cg-2hgg
Summary: Improper Certificate Validation in node-sass affects eZ Platform
Severity: MODERATE
CWE: CWE-295
Published: 2022-04-01T12:56:28Z

Certificate validation in node-sass 2.0.0 to 4.14.1 is disabled when requesting binaries even if the user is not specifying an alternative download path. This affects eZ Platform v2.5 only. The maintainers resolved it by replacing node-sass 4.11 with sass 1.32.13. This issue also affects ezsystems/ezplatform and ezsystems/ezplatform-page-builder.
Vulnerability: GHSA-vxh4-x6gv-mphf
Summary: Cross-Site Request Forgery (CSRF) in livehelperchat/livehelperchat
Aliases: CVE-2022-0245
Severity: MODERATE
CWE: CWE-352
Published: 2022-01-21T23:25:45Z

Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat.
Vulnerability: GHSA-3988-h75v-hwf6
Summary: Arbitrary shell execution
Severity: HIGH
Published: 2022-03-26T00:06:45Z

A properly crafted filename would allow for arbitrary code execution when using the --filter=gitmodified command line option
Vulnerability: GHSA-wmj9-xh24-j4gx
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0558
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-11T00:00:47Z

microweber prior to version 1.2.11 is vulnerable to cross-site scripting.
Vulnerability: GHSA-j57w-3c39-gpp5
Summary: Improper Privilege Management in Snipe-IT
Aliases: CVE-2022-0611
Severity: HIGH
CWE: CWE-269
Published: 2022-02-17T00:00:35Z

An unprivileged user of Snipe-IT prior to version 5.3.11 can create maintenance for an asset. Version 5.3.11 contains a patch for this issue.
Vulnerability: GHSA-fxwm-rx68-p5vx
Summary: XSS in richtext custom tag attributes in ezsystems/ezplatform-richtext
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-01T18:28:29Z

The rich text editor does not escape attribute data when previewing custom tags. This means XSS is possible if custom tags are used, for users who have access to editing rich text content. Frontend content view is not affected, but the vulnerability could be used by editors to attack other editors. The fix ensures custom tag attribute data is escaped in the editor.
Vulnerability: GHSA-mj2c-5mjv-gmmj
Summary: SQL Injection in Pimcore
Aliases: CVE-2022-1339
Severity: HIGH
CWE: CWE-89
Published: 2022-04-14T00:00:19Z

Pimcore prior to version 10.3.5 is vulnerable to SQL injection in ElementController.php. This vulnerability causes loss of data confidentiality.
Vulnerability: GHSA-j33j-fg2g-mcv2
Summary: Cross-Site Request Forgery in CakePHP
Aliases: CVE-2020-15400
Severity: MODERATE
CWE: CWE-79, CWE-352
Published: 2022-02-10T22:27:58Z

CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.
Vulnerability: GHSA-6pqm-xvfc-w7p4
Summary: showdoc is vulnerable to Cross-Site Request Forgery (CSRF)
Aliases: CVE-2021-3993
Severity: MODERATE
CWE: CWE-352
Published: 2021-12-03T20:42:35Z

showdoc is vulnerable to Cross-Site Request Forgery (CSRF).
Vulnerability: GHSA-9pm8-xcj6-2m33
Summary: Missing Authorization in TYPO3 extension
Aliases: CVE-2020-12698
Severity: MODERATE
CWE: CWE-862
Published: 2021-07-26T21:34:52Z

The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
Vulnerability: GHSA-mg2g-8pwj-r2j2
Summary: Authentication bypass in SilverStripe GraphQL
Aliases: CVE-2020-26136
Severity: MODERATE
CWE: CWE-287, CWE-288
Published: 2021-06-10T17:21:33Z

The GraphQL module accepts basic-auth as an authentication method by default. This can be used to bypass MFA authentication if the silverstripe/mfa module is installed, which is now a commonly installed module. A users password is still required though.

Basic-auth has been removed as a default authentication method. If desired, it can be re-enabled by adding it to the authenticators key of a schema, or on SilverStripe\Graphql\Auth\Handler
Vulnerability: GHSA-44gv-fgcj-w546
Summary: Missing Authorization in DayByDay CRM
Aliases: CVE-2022-22107
Severity: MODERATE
CWE: CWE-862
Published: 2022-01-08T00:31:55Z

In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
Vulnerability: GHSA-c5c9-8c6m-727v
Summary: Cross-Site Scripting via Rich-Text Content
Aliases: CVE-2021-32768
Severity: MODERATE
CWE: CWE-79
Published: 2021-08-19T15:53:12Z

> ### Meta
> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7)

### Problem
Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality _[HTMLparser](https://docs.typo3.org/m/typo3/reference-typoscript/10.4/en-us/Functions/Htmlparser.html)_ do not consider all potentially malicious HTML tag & attribute combinations per default.

In addition, the lack of comprehensive default node configuration for rich-text fields in the backend user interface fosters this malfunction.

In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required.

### Solution
Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described above.

Custom package _[typo3/html-sanitizer](https://github.com/TYPO3/html-sanitizer)_ - based on allow-lists only - takes care of sanitizing potentially malicious markup. The default behavior is based on safe and commonly used markup - however, this can be extended or restricted further in case it is necessary for individual scenarios.

During the frontend rendering process, sanitization is applied to the default TypoScript path `lib.parseFunc`, which is implicitly used by the Fluid view-helper instruction `f:format.html`. Rich-text data persisted using the backend user interface is sanitized as well. Implementation details are explained in corresponding [ChangeLog documentation](https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/9.5.x/Important-94484-IntroduceHTMLSanitizer.html).

### Credits
Thanks to Benjamin Stiber, Gert-Jan Jansma, Gábor Ács-Kurucz, Alexander Kellner, Richie Lee, Nina Rösch who reported this issue, and to TYPO3 security team member Oliver Hader, as well as TYPO3 contributor Susanne Moog who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-013](https://typo3.org/security/advisory/typo3-core-sa-2021-013)
Vulnerability: GHSA-rfh8-25h9-mhgf
Summary: Cross-site Scripting in YII2-CMS
Aliases: CVE-2019-16130
Severity: MODERATE
CWE: CWE-79
Published: 2019-10-14T21:12:08Z

YII2-CMS v1.0 has XSS in protected\core\modules\home\models\Contact.php via a name field to /contact.html.
Vulnerability: GHSA-rr6v-h7m8-wc9f
Summary: Cross-site Scripting in Froala WYSIWYG Editor
Aliases: CVE-2021-28114
Severity: MODERATE
CWE: CWE-79
Published: 2021-07-19T21:21:33Z

Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.
Vulnerability: GHSA-q9qc-pp5x-mc8c
Summary: Improper Neutralization of Special Elements Used in a Template Engine in microweber
Aliases: CVE-2022-0896
Severity: HIGH
CWE: CWE-94, CWE-1336
Published: 2022-03-10T00:00:40Z

Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
Vulnerability: GHSA-fm68-89m8-4gjj
Summary: JavaScript injection possible via html comments
Aliases: CVE-2019-8233
Severity: MODERATE
CWE: CWE-79
Published: 2019-11-12T22:59:47Z

In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments.
Vulnerability: GHSA-prff-6j8q-vrv7
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0379
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-28T22:15:33Z

There is a persistent XSS Vulnerability exsists in the checkout page where we can able to execute any javascription in the last name field
Vulnerability: GHSA-rhf5-f553-xg82
Summary: Password exposure in concrete5/core
Aliases: CVE-2021-22951
Severity: MODERATE
CWE: CWE-639, CWE-200
Published: 2021-11-23T18:18:16Z

Unauthorized individuals could view password protected files using view_inline in Concrete CMS (previously concrete 5) prior to version 8.5.7. Concrete CMS now checks to see if a file has a password in view_inline and, if it does, the file is not rendered.For version 8.5.6, the following mitigations were put in place a. restricting file types for view_inline to images only b. putting a warning in the file manager to advise users.
Vulnerability: GHSA-6vc5-v7hw-h5h2
Summary: Cross-site Scripting in RosarioSIS
Aliases: CVE-2020-15721
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T22:26:10Z

RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.
Vulnerability: GHSA-pf38-v6qj-j23h
Summary: Malfunction of CSRF token validation in Shopware
Aliases: CVE-2022-24879
Severity: HIGH
CWE: CWE-352
Published: 2022-04-28T21:01:53Z

### Impact
The CSRF tokens were not renewed after login and logout.
An attacker could impersonate the victim if the attacker is able to use the same device as the victim used beforehand.

### Patches
We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/changelog-sw5/#5-7-9

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022
Vulnerability: GHSA-7mq6-cp5m-f4j5
Summary: Cross-site Scripting in Anchor CMS
Aliases: CVE-2021-44116
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-05T14:54:36Z

Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie, thereby achieving other malicious operations.
Vulnerability: GHSA-r23f-c2j5-rx2f
Summary: Local File read vulnerability in OctoberCMS
Aliases: CVE-2020-5295
Severity: MODERATE
CWE: CWE-98
Published: 2020-06-03T21:58:16Z

### Impact
An attacker can exploit this vulnerability to read local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission.

### Patches
Issue has been patched in Build 466 (v1.0.466).

### Workarounds
Apply https://github.com/octobercms/october/commit/2b8939cc8b5b6fe81e093fe2c9f883ada4e3c8cc to your installation manually if unable to upgrade to Build 466.

### References
Reported by [Sivanesh Ashok](https://stazot.com/)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1108" alt="Screen Shot 2020-03-31 at 2 37 53 PM" src="https://user-images.githubusercontent.com/7253840/78072989-44b3ac80-735d-11ea-8676-09c69f0409c4.png">
Vulnerability: GHSA-phrq-v4q2-hmq6
Summary: Code injection vulnerability in allSelectors()
Aliases: CVE-2020-13756
Severity: CRITICAL
CWE: CWE-20
Published: 2022-03-26T00:15:22Z

Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data, possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.
Vulnerability: GHSA-c8wh-6jw4-2h79
Summary: Potential unauthorized access to stored request & session data when plugin is misconfigured in October CMS Debugbar
Aliases: CVE-2020-11094
Severity: MODERATE
CWE: CWE-532
Published: 2020-06-03T23:19:12Z

### Impact
The debugbar contains a perhaps little known feature where it will log all requests (and all information pertaining to each request including session data) whenever it is enabled. This presents a problem if the plugin is ever enabled on a system that is open to untrusted users as the potential exists for them to use this feature to view all requests being made to the application and obtain sensitive information from those requests. There even exists the potential for account takeovers of authenticated users by non-authenticated public users, which would then lead to a number of other potential issues as an attacker could theoretically get full access to the system if the required conditions existed.

### Patches
Issue has been patched in v3.1.0 by locking down access to the debugbar to all users; it now requires an authenticated backend user with a specifically enabled permission before it is even usable, and the feature that allows access to stored request information is restricted behind a different permission that's more restrictive.

### Workarounds
Apply https://github.com/rainlab/debugbar-plugin/commit/86dd29f9866d712de7d98f5f9dc67751b82ecd18 to your installation manually if unable to upgrade to v3.1.0.

### For more information
If you have any questions or comments about this advisory:
* Email us at [octobercms@luketowers.ca](mailto:octobercms@luketowers.ca) & [hello@octobercms.com](mailto:hello@octobercms.com)

### Acknowledgements

Thanks to [Freddie Poser](https://twitter.com/vogonjeltz101) for reporting the issue to the RainLab team.
Vulnerability: GHSA-36mj-6r7r-mqhf
Summary: User can obtain JWT token even if account is disabled
Severity: HIGH
CWE: CWE-284
Published: 2021-09-29T17:09:23Z

Users can authenticate this way even if their user account is disabled. This is a high risk vulnerability when account disabling is used to block users' access to the system. (Someone who never had an account cannot exploit this vulnerability.) The fix ensures tokens are generated only for enabled user accounts, and is distributed via Composer as ezsystems/ezplatform-rest v1.3.8
Vulnerability: GHSA-h2fw-93qx-vrcq
Summary: SQL Injection in Moodle
Aliases: CVE-2022-0983
Severity: HIGH
CWE: CWE-89
Published: 2022-03-26T00:00:29Z

An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
Vulnerability: GHSA-8cw5-rv98-5c46
Summary: Arbitrary PHP code execution in Drupal
Aliases: CVE-2019-6339
Severity: CRITICAL
CWE: CWE-20
Published: 2022-01-06T22:30:06Z

In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6, and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in
PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core, contrib, and custom) may be performing file operations on insufficiently validated user input, thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.
Vulnerability: GHSA-3jxh-789f-p7m6
Summary: Cross-site Scripting
Aliases: CVE-2021-27902
Severity: MODERATE
CWE: CWE-79
Published: 2021-07-02T18:36:31Z

An issue was discovered in Craft CMS before 3.6.0. In some circumstances, a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.
Vulnerability: GHSA-82j4-vr25-x394
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0940
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-15T00:01:01Z

ShowDoc is vulnerable to stored cross-site scripting due to unrestricted file upload in versions 2.10.3 and prior. A patch is available and anticipated to be part of version 2.10.4.
Vulnerability: GHSA-p523-jrph-qjc6
Summary: Insufficient Session Expiration in shopware
Aliases: CVE-2022-21652
Severity: LOW
CWE: CWE-613
Published: 2022-01-06T23:49:17Z

### Impact

Automatically invalidate sessions upon password change

### Patches

We recommend updating to the current version 5.7.7. You can get the update to 5.7.7 regularly via the Auto-Updater or directly via the download overview.

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html

### References

https://docs.shopware.com/en/shopware-5-en/securityupdates/security-update-01-2022
Vulnerability: GHSA-58w4-w77w-qv3w
Summary: Reflected XSS with parameters in PostComment
Aliases: CVE-2020-26225
Severity: MODERATE
CWE: CWE-79
Published: 2020-11-16T21:23:29Z

### Impact
An attacker could inject malicious web code into the users' web browsers by creating a malicious link.

### Patches
The problem is fixed in 4.2.0

### References
[Cross-site Scripting (XSS) - Reflected (CWE-79) ](https://cwe.mitre.org/data/definitions/79.html)
Vulnerability: GHSA-2cv6-6437-39p2
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0930
Severity: HIGH
CWE: CWE-79
Published: 2022-03-13T00:00:53Z

File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Vulnerability: GHSA-6m93-343m-3jrc
Summary: Cross-site Scripting in HTML2PDF
Aliases: CVE-2021-45394
Severity: HIGH
CWE: CWE-918, CWE-79
Published: 2022-01-21T23:29:48Z

An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.
Vulnerability: GHSA-5v5h-4w2g-gxxc
Summary: SQL Injection in t3/dce
Aliases: CVE-2021-31777
Severity: HIGH
CWE: CWE-89
Published: 2021-06-08T20:12:23Z

The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
Vulnerability: GHSA-fw5q-j9p4-3vxg
Summary: Blog comment posting, Cross Site Scripting(XSS) Vulnerability in Latest Release 4.4.0
Aliases: CVE-2020-15276
Severity: LOW
CWE: CWE-79
Published: 2020-10-30T19:10:20Z

baserCMS 4.4.0 and earlier is affected by Cross Site Scripting (XSS).

Impact: XSS via Arbitrary script execution.
Components are: Blog comment posting
Tested baserCMS Version : 4.4.0 (Latest)
Affected baserCMS Version : 4.0.0 ~ 4.4.0
Patches : https://basercms.net/security/20201029
Found by yama
Vulnerability: GHSA-c7fm-jx59-wjf6
Summary: Authorization Bypass Through User-Controlled Key in LiveHelperChat
Aliases: CVE-2022-0266
Severity: MODERATE
CWE: CWE-639
Published: 2022-01-21T18:50:58Z

Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.
Vulnerability: GHSA-r7cj-8hjg-x622
Summary: DBAL 3 SQL Injection Security Vulnerability
Aliases: CVE-2021-43608
Severity: CRITICAL
CWE: CWE-89
Published: 2021-11-16T17:25:57Z

We have released a new version Doctrine DBAL 3.1.4 that fixes a critical SQL injection vulnerability in the LIMIT clause generation API provided by the Platform abstraction.

We advise everyone using Doctrine DBAL 3.0.0 up to 3.1.3 to upgrade to 3.1.4 immediately.

The vulnerability can happen when unsanitized input is passed to many APIs in Doctrine DBAL and ORM that ultimately end up calling `AbstractPlatform::modifyLimitQuery`. 

As a workaround you can cast all limit and offset parameters to integers before passing them to Doctrine APIs.

This vulnerability has been assigned [CVE-2021-43608](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43608).
Vulnerability: GHSA-3p85-p4qg-hcrp
Summary: pimcore is vulnerable to Cross-site Scripting
Aliases: CVE-2021-4081
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-16T14:27:58Z

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-754h-5r27-7x3r
Summary: RCE in Symfony
Aliases: CVE-2020-15094
Severity: HIGH
CWE: CWE-212
Published: 2020-09-02T17:29:56Z

Description
-----------

The `CachingHttpClient` class from the HttpClient Symfony component relies on the `HttpCache` class to handle requests. `HttpCache` uses internal headers like `X-Body-Eval` and `X-Body-File` to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by `CachingHttpClient` and if an attacker can control the response for a request being made by the `CachingHttpClient`, remote code execution is possible.

Resolution
----------

HTTP headers designed for internal use in `HttpCache` are now stripped from remote responses before being passed to `HttpCache`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/d9910e0b33a2e0f993abff41c6fbc86951b66d78) for the 4.4 branch.

Credits
-------

I would like to thank Matthias Pigulla (webfactory GmbH) for reporting and fixing the issue.
Vulnerability: GHSA-x7j7-qp7j-hw3q
Summary: Cross-site scripting (XSS) from writer field content in the site frontend
Aliases: CVE-2021-41252
Severity: MODERATE
CWE: CWE-79
Published: 2021-11-16T17:04:19Z

### Impact

Kirby's [writer field](https://getkirby.com/docs/reference/panel/fields/writer) stores its formatted content as HTML code. Unlike with other field types, it is not possible to [escape HTML special characters](https://getkirby.com/docs/guide/templates/escaping) against cross-site scripting (XSS) attacks, otherwise the formatting would be lost.

Cross-site scripting (XSS) is a type of vulnerability that allows to execute any kind of JavaScript code inside the site frontend or Panel session of other users. If the user is logged in to the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim.

Because the writer field did not securely sanitize its contents on save, it was possible to inject malicious HTML code into the content file by sending it to Kirby's API directly without using the Panel. This malicious HTML code would then be displayed on the site frontend and executed in the browsers of site visitors and logged in users who are browsing the site.

This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users. They can escalate their privileges if they get access to the Panel session of an admin user. Depending on your site, other JavaScript-powered attacks are possible.

You are *not* affected if you don't use the writer field in any of your blueprints. The attack can only be performed by logged-in users and only surfaces in the site frontend (i.e. in your templates). The Panel itself is unaffected and will not execute JavaScript that was injected into writer field content.

### Patches

We have patched the vulnerability in [Kirby 3.5.8](https://github.com/getkirby/kirby/releases/tag/3.5.8) by sanitizing all writer field contents on the backend whenever the content is modified via Kirby's API. Please update to this or a [later version](https://github.com/getkirby/kirby/releases/) to fix the vulnerability.

### Credits

Thanks to Azrul Ikhwan Zulkifli (@azrultech) from BAE Systems AI Vulnerability Research Team for responsibly reporting the identified issue.
Vulnerability: GHSA-h3gg-7wx2-cq3h
Summary: XSS in Flarum Sticky extension
Aliases: CVE-2021-21283
Severity: MODERATE
CWE: CWE-79
Published: 2021-01-29T18:13:41Z

### Impact
A change in release beta 14 of the Sticky extension caused the plain text content of the first post of a pinned discussion to be injected as HTML on the discussion list. The issue was discovered following an internal audit.

Any HTML would be injected through Mithril's `m.trust()` helper. This resulted in an HTML injection where `<script>` tags would not be executed. However it was possible to run javascript from other HTML attributes, enabling a cross-site scripting (XSS) attack to be performed.

Since the exploit only happens with the first post of a pinned discussion, an attacker would need the ability to pin their own discussion, or be able to edit a discussion that was previously pinned.

On forums where all pinned posts are authored by your staff, you can be relatively certain the vulnerability has not been exploited.

Forums where some user-created discussions were pinned can look at the first post edit date to find whether the vulnerability might have been exploited. Because Flarum doesn't store the post content history, you cannot be certain if a malicious edit was reverted.

### Patches
The fix will be available in version v0.1.0-beta.16 with Flarum beta 16. The fix has already been back-ported to Flarum beta 15 as version v0.1.0-beta.15.1 of the Sticky extension.

### Workarounds
Forum administrators can disable the Sticky extension until they are able to apply the update. The vulnerability cannot be exploited while the extension is disabled.

### References

- [Release announcement](https://discuss.flarum.org/d/26042-security-update-to-flarum-sticky-010-beta151)
- [Pull Request](https://github.com/flarum/sticky/pull/24)

### For more information
If you have any questions or comments about this advisory, please start a new discussion on our [support forum](https://discuss.flarum.org/t/support).

If you discover a security vulnerability within Flarum, please send an e-mail to [security@flarum.org](mailto:security@flarum.org). All security vulnerabilities will be promptly addressed. More details can be found in our [security policy](https://github.com/flarum/core/security/policy).
Vulnerability: GHSA-5r9v-8w62-r26j
Summary: livehelperchat is vulnerable to Cross-site Scripting
Aliases: CVE-2022-0253
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-21T23:48:25Z

livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-wgjx-hm34-qgf7
Summary: SQL injection in Centreon
Aliases: CVE-2019-16194
Severity: CRITICAL
CWE: CWE-89
Published: 2020-02-11T20:36:04Z

SQL injection vulnerabilities in Centreon through 19.04 allow attacks via the svc_id parameter in include/monitoring/status/Services/xml/makeXMLForOneService.php.
Vulnerability: GHSA-592v-7frm-h44q
Summary: Cross-site scripting in LavaLite-CMS
Aliases: CVE-2020-23700
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-08T17:25:36Z

Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.
Vulnerability: GHSA-4qwp-7c67-jmcc
Summary: Unauthenticated remote code execution in Ignition
Aliases: CVE-2021-3129
Severity: CRITICAL
CWE: CWE-94
Published: 2021-03-29T20:23:46Z

Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
Vulnerability: GHSA-4gwh-2pqx-f5cc
Summary: Cross-site Scripting in LibreNMS
Aliases: CVE-2021-44277
Severity: MODERATE
CWE: CWE-79
Published: 2021-12-03T20:48:42Z

LibreNMS 21.11.0 is affected by is affected by a Cross Site Scripting (XSS) vulnerability in includes/html/common/alert-log.inc.php.
Vulnerability: GHSA-39wj-j3jc-858m
Summary: XSS vulnerability leveraged through referrers could allow un-authorized admin access in Mautic
Aliases: CVE-2020-35124
Severity: CRITICAL
CWE: CWE-79
Published: 2021-01-19T20:43:56Z

### Impact
This is a cross-site scripting vulnerability which affects every version of Mautic and could allow an attacker unauthorised administrator level access to Mautic.

This vulnerability was reported by Naveen Sunkavally at Horizon3.ai.

### Patches
Upgrade to 3.2.4 or 2.16.5.

Link to patch for 2.x versions: https://github.com/mautic/mautic/compare/2.16.4...2.16.5.diff

Link to patch for 3.x versions: https://github.com/mautic/mautic/compare/3.2.2...3.2.4.diff

### Workarounds
None

### For more information
If you have any questions or comments about this advisory:
* Post in https://forum.mautic.org/c/support
* Email us at security@mautic.org
Vulnerability: GHSA-79gr-58r3-pwm3
Summary: Forbid serializing AbstractAdapter and TagAwareAdapter instances
Aliases: CVE-2019-18889
Severity: CRITICAL
CWE: CWE-94
Published: 2019-12-02T18:07:16Z

An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.
Vulnerability: GHSA-cxvr-r92m-q9hw
Summary: XSS in Dolibarr
Aliases: CVE-2020-13094
Severity: MODERATE
CWE: CWE-79
Published: 2020-05-21T21:08:47Z

Dolibarr before 11.0.4 allows XSS.
Vulnerability: GHSA-33gc-6cw9-w3g4
Summary: Deserialization of Untrusted Data in topthink/framework
Aliases: CVE-2021-36564
Severity: CRITICAL
CWE: CWE-502
Published: 2021-12-10T20:23:19Z

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php.
Vulnerability: GHSA-xj7h-g7rh-gjcw
Summary: Cross-site Scripting in Subrion CMS
Aliases: CVE-2020-18324
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-05T00:00:45Z

Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the `q` parameter in the Kickstart template.
Vulnerability: GHSA-hf4q-52x6-4p57
Summary: Unrestricted file upload leads to stored cross-site scripting in Microweber
Aliases: CVE-2022-0906
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-11T00:02:36Z

Microweber prior to version 1.2.12 allows unrestricted file upload, which could lead to stored cross-site scripting.
Vulnerability: GHSA-v567-q267-phpg
Summary: pimcore is vulnerable to Cross-site Scripting
Aliases: CVE-2022-0257
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-21T23:50:11Z

pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerability: GHSA-32hw-3pvh-vcvc
Summary: XSS vulnerability on password reset page
Aliases: CVE-2021-27909
Severity: MODERATE
CWE: CWE-79
Published: 2021-09-01T18:40:56Z

### Impact
For Mautic versions prior to 3.3.4, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized. 

### Patches

Upgrade to 3.3.4 or 4.0.0

### Workarounds

No

### References

https://github.com/mautic/mautic/releases/tag/3.3.4
https://github.com/mautic/mautic/releases/tag/4.0.0

### For more information
If you have any questions or comments about this advisory:
* Email us at [security@mautic.org](mailto:security@mautic.org)
Vulnerability: GHSA-3j78-7m59-r7gv
Summary: Private data exposure via REST API in BuddyPress
Aliases: CVE-2020-5244
Severity: HIGH
CWE: CWE-284
Published: 2020-02-24T17:18:26Z

In BuddyPress before 5.1.2, requests to a certain REST API endpoint can result in private user data getting exposed. Authentication is not needed.

This has been patched in version 5.1.2.
Vulnerability: GHSA-q73m-3q7r-fpf7
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0957
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:48Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via file upload.
Vulnerability: GHSA-hrf4-hcpc-3345
Summary: Denial of service in microweber
Aliases: CVE-2022-0961
Severity: HIGH
CWE: CWE-190
Published: 2022-03-16T00:00:48Z

Microweber is drag and drop website builder and CMS with E-commerce. The microweber prior 1.2.12 application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. The post title input can be limited to 500 characters or max 1000 characters as a workaround.
Vulnerability: GHSA-84px-q68r-2fc9
Summary: Privilege escalation in the Sulu Admin panel
Aliases: CVE-2021-43835
Severity: HIGH
CWE: CWE-269
Published: 2021-12-15T22:55:16Z

### Impact

Impacted are only users which already have access to the admin UI. Over the API it was possible for them to give themselves permissions to areas which they did not already had. This issue was introduced in 2.0.0-RC1 with the new ProfileController putAction.

### Patches

The versions have been patched in 2.2.18, 2.3.8 and 2.4.0.

### Workarounds

Patching the ProfileController of affected sulu versions yourself by overwriting it.

### References

_Are there any links users can visit to find out more?_

Currently not.

### For more information

If you have any questions or comments about this advisory:
* Open an issue in [sulu/sulu repo](https://github.com/sulu/sulu/issues)
* Email us at [security@sulu.io](mailto:security@sulu.io)
Vulnerability: GHSA-75c5-f4gw-38r9
Summary: Multiple vulnerabilities through filename manipulation in Archive_Tar
Aliases: CVE-2020-28949
Severity: HIGH
CWE: CWE-74
Published: 2021-04-22T16:20:59Z

Archive_Tar through 1.4.10 has :// filename sanitization only to address phar attacks, and thus any other stream-wrapper attack (such as file:// to overwrite files) can still succeed. See: https://github.com/pear/Archive_Tar/issues/33
Vulnerability: GHSA-vcgf-vmpc-ph79
Summary: Improper Access Control in microweber
Aliases: CVE-2022-0277
Severity: MODERATE
CWE: CWE-284, CWE-269
Published: 2022-01-21T18:06:16Z

Improper Access Control in Packagist microweber/microweber prior to 1.2.11.
Vulnerability: GHSA-2cjf-w7c4-fhf6
Summary: Cross-site Scripting in Beanstalk console
Aliases: CVE-2022-0539
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-10T00:00:30Z

Beanstalk console (ptrofimov/beanstalk_console) prior to 1.7.14 is vulnerable to cross-site scripting.
Vulnerability: GHSA-x79j-wgqv-g8h2
Summary: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form
Aliases: CVE-2021-21358
Severity: MODERATE
CWE: CWE-79
Published: 2021-03-23T01:54:06Z


### Problem
It has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability.

### Solution
Update to TYPO3 versions 10.4.14 or 11.1.1 that fix the problem described.

### Credits
Thanks to Richie Lee who reported this issue and to TYPO3 framework merger Andreas Fernandez who fixed the issue.

### References
* [TYPO3-CORE-SA-2021-004](https://typo3.org/security/advisory/typo3-core-sa-2021-004)
Vulnerability: GHSA-qfhg-m6r8-xxpj
Summary: Incorrect Authorization in Drupal core
Aliases: CVE-2020-13676
Severity: MODERATE
CWE: CWE-863, CWE-284
Published: 2022-02-12T00:00:46Z

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.
Vulnerability: GHSA-f768-8pvq-mm6r
Summary: Business Logic Errors in dolibarr/dolibarr
Aliases: CVE-2022-0414
Severity: MODERATE
Published: 2022-02-01T22:01:47Z

Dolibarr 14.0.5 and prior versions are vulnerable to Business Logic Errors.
Vulnerability: GHSA-hgjr-632x-qpp3
Summary: Cross-site scripting vulnerability in file upload
Aliases: CVE-2021-39136
Severity: HIGH
CWE: CWE-79
Published: 2021-08-30T16:18:59Z

There is a cross-site scripting vulnerability in file upload on the management system of baserCMS.

This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users.
If you are eligible, please update to the new version as soon as possible.

### Target
baserCMS 4.5.1 and earlier versions

### Vulnerability
Execution of malicious JavaScript code may alter the display of the page or leak cookie information.

### Countermeasures
Update to the latest version of baserCMS

Please refer to the next page for details.
https://basercms.net/security/JVN_14134801
Vulnerability: GHSA-9cq5-xgg4-x477
Summary: SQL Injection in showdoc
Aliases: CVE-2022-0362
Severity: MODERATE
CWE: CWE-89
Published: 2022-01-27T00:01:15Z

Showdoc verions 2.10.2 and prior is vulnerable to SQL injection. A patch is available in the `master` branch of the repository.
Vulnerability: GHSA-g585-j55v-38h7
Summary: Cross-site Scripting in ShowDoc
Aliases: CVE-2022-0966
Severity: MODERATE
CWE: CWE-79
Published: 2022-03-16T00:00:45Z

ShowDoc prior to 2.10.4 is vulnerable to stored cross-site scripting via file upload.
Vulnerability: GHSA-38m9-3vg4-rwvp
Summary: Cross-site Scripting in microweber
Aliases: CVE-2022-0678
Severity: MODERATE
CWE: CWE-79
Published: 2022-02-20T00:00:32Z

microweber prior to version 1.2.11 is vulnerable to cross-site scripting.
Vulnerability: GHSA-fx3v-553x-3c4q
Summary: Stored XSS by authenticated backend user with access to upload files
Aliases: CVE-2020-15249
Severity: LOW
CWE: CWE-79
Published: 2020-11-23T19:47:59Z

### Impact
Backend users with access to upload files were permitted to upload SVG files without any sanitization applied to the uploaded files. Since SVG files support being parsed as HTML by browsers, this means that they could theoretically upload Javascript that would be executed on a path under the website's domain (i.e. /storage/app/media/evil.svg), but they would have to convince their target to visit that location directly in the target's browser as the backend does not display SVGs inline anywhere, SVGs are only displayed as image resources in the backend and are thus unable to be executed.

### Patches
Issue has been patched in Build 469 (v1.0.469) & v1.1.0.

### Workarounds
Apply https://github.com/octobercms/library/commit/80aab47f044a2660aa352450f55137598f362aa4 to your installation manually if unable to upgrade to Build 469 or v1.1.0.

### References
Reported by [Hoan Hoang](https://github.com/hoanhp)

### For more information
If you have any questions or comments about this advisory:
* Email us at [hello@octobercms.com](mailto:hello@octobercms.com)

### Threat assessment:
<img width="1107" alt="Screen Shot 2020-10-10 at 1 47 49 PM" src="https://user-images.githubusercontent.com/7253840/95663787-378f2b80-0aff-11eb-8dfc-b97d162939da.png">
Vulnerability: GHSA-68jc-v27h-vhmw
Summary: Unrestricted Upload of File with Dangerous Type in Drupal core.
Aliases: CVE-2020-13671
Severity: HIGH
CWE: CWE-434
Published: 2021-10-12T16:28:25Z

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.
Vulnerability: GHSA-c442-3278-rhrg
Summary: Unrestricted File Upload in ShowDoc v2.9.5
Aliases: CVE-2021-36440
Severity: CRITICAL
CWE: CWE-434
Published: 2021-09-09T17:08:46Z

Unrestricted File Upload in ShowDoc v2.9.5 allows remote attackers to execute arbitrary code via the 'file_url' parameter in the component AdminUpdateController.class.php'.
Vulnerability: GHSA-pwrf-q7h8-jjr7
Summary: Authorization Bypass Through User-Controlled Key in Bagisto
Aliases: CVE-2019-16403
Severity: MODERATE
CWE: CWE-639
Published: 2019-11-08T20:06:24Z

In Webkul Bagisto before 0.1.5, the functionalities for customers to change their own values (such as address, review, orders, etc.) can also be manipulated by other customers.
Vulnerability: GHSA-r37h-j483-cjjm
Summary: Improper rate limiting in Koel
Aliases: CVE-2021-33563
Severity: HIGH
CWE: CWE-799, CWE-916
Published: 2021-06-01T21:38:20Z

Koel before 5.1.4 lacks login throttling, lacks a password strength policy, and shows whether a failed login attempt had a valid username. This might make brute-force attacks easier.
Vulnerability: GHSA-w6rp-4vj7-v2m8
Summary: Missing Authorization in DayByDay CRM
Aliases: CVE-2022-22111
Severity: HIGH
CWE: CWE-862
Published: 2022-01-08T00:31:49Z

In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrator’s. This allows the attacker to gain access to the highest privileged user in the application.
Vulnerability: GHSA-w6jr-wj64-mc9x
Summary: Deserialization of Untrusted Data in Codeigniter4
Aliases: CVE-2022-21647
Severity: HIGH
CWE: CWE-502
Published: 2022-01-06T22:52:41Z

### Impact
Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4.
Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, 
and possibly execute existing PHP code on the server.
We are aware of a working exploit, which can lead to SQL injection.

### Patches
Upgrade to v4.1.6 or later.

### Workarounds
Do not use:
- `old()` and form_helper
- `RedirectResponse::withInput()` and `redirect()->withInput()`

### References
- [PHP Object Injection | OWASP](https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection)

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [codeigniter4/CodeIgniter4](https://github.com/codeigniter4/CodeIgniter4/issues)
* Email us at [SECURITY.md](https://github.com/codeigniter4/CodeIgniter4/blob/develop/SECURITY.md)
Vulnerability: GHSA-wf98-vxv9-jqfv
Summary: XSS Injection Vulnerability
Severity: LOW
Published: 2022-04-05T18:31:51Z

### Impact

Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied.

### Patches

This has been patched in Craft 3.7.29.

### References

* https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#3729---2022-01-18

### For more information

If you have any questions or comments about this advisory, email us at [support@craftcms.com](mailto:support@craftcms.com)

----------

Credits: https://github.com/noobpk
Vulnerability: GHSA-4g29-fccr-p59w
Summary: Reflected Cross-site Scripting in Shopware storefront
Aliases: CVE-2022-24873
Severity: MODERATE
CWE: CWE-79
Published: 2022-04-28T20:59:24Z

### Impact
Not-stored XSS in storefront.
Request parameter were directly assigned to the template, so that malicious code could be send via an URL.

### Patches
We recommend updating to the current version 5.7.9. You can get the update to 5.7.9 regularly via the Auto-Updater or directly via the download overview.
https://www.shopware.com/en/changelog-sw5/#5-7-9

For older versions you can use the Security Plugin:
https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html


### References
https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-04-2022
Vulnerability: GHSA-25fx-mxc2-76g7
Summary: Unauthorized access to Credit card form exposing payer name and not requiring 3DS
Aliases: CVE-2021-41120
Severity: HIGH
CWE: CWE-200
Published: 2021-10-06T17:49:11Z

### Impact
URL to the payment page done after checkout was created with autoincremented payment id (`/pay-with-paypal/{id}`) and therefore it was easy to access for anyone, not even the order's customer. The problem was, the Credit card form has prefilled "credit card holder" field with the Customer's first and last name.
Additionally, the mentioned form did not require a 3D Secure authentication, as well as did not checked the result of the 3D Secure authentication.

### Patches
The problem has been patched in Sylius/PayPalPlugin **1.2.4** and **1.3.1**

### Workarounds
One can override a `sylius_paypal_plugin_pay_with_paypal_form` route and change its URL parameters to (for example) `{orderToken}/{paymentId}`, then override the `Sylius\PayPalPlugin\Controller\PayWithPayPalFormAction` service, to operate on the payment taken from the repository by these 2 values. It would also require usage of custom repository method.
Additionally, one could override the `@SyliusPayPalPlugin/payWithPaypal.html.twig` template, to add `contingencies: ['SCA_ALWAYS']` line in `hostedFields.submit(...)` function call (line 421). It would then have to be handled in the function callback.

### For more information
If you have any questions or comments about this advisory:
- Open an issue in Sylius/PayPalPlugin issues
- Email us at security at sylius dot com
Vulnerability: GHSA-5v44-7647-xfw9
Summary: Blind SQL injection in PrestaShop productcomments module
Aliases: CVE-2020-26248
Severity: LOW
CWE: CWE-89
Published: 2021-01-20T21:33:53Z

### Impact
An attacker can use a Blind SQL injection to retrieve data or stop the MySQL service.

### Patches
The problem is fixed in 4.2.1
Vulnerability: GHSA-73q9-7pwj-gm46
Summary: icecoder is vulnerable to Cross-site Scripting
Aliases: CVE-2021-3862
Severity: MODERATE
CWE: CWE-79
Published: 2022-01-21T23:46:12Z

icecoder is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')