Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
CWE-82
The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.
We track 7 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.2.
Latest Improper Neutralization of Script in Attributes of IMG Tags in a Web Page vulnerabilities
- 7.5 High severity
magento-lts: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to exe
- 8.5 High severity
JetEngine: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0.
- 9.1 Critical severity
Popup by Supsystic: Improper Control of Generation of Code
Deserialization of Untrusted Data vulnerability in supsystic Popup by Supsystic popup-by-supsystic allows Command Injection.This issue affects Popup by Supsystic: from n/a through <= 1.10.29.
- 8.8 High severity
Event Tickets with Ticket Scanner: Improper Control of Generation of Code
Deserialization of Untrusted Data vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Server Side Include (SSI) Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.3.11.
- 7.2 High severity
Podlove Podcast Publisher: Improper Control of Generation of Code
Deserialization of Untrusted Data vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress.This issue affects Podlove Podcast Publisher: from n/a through <= 4.1.15.
- 7.2 High severity
Unlimited Elements For Elementor (Free…: Improper Control of Generation of Code
Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Command Injection.This issue affects Unlimited Elements For Elementor (Free Widgets
- 9.1 Critical severity
Contact Form by Supsystic: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
Deserialization of Untrusted Data vulnerability in supsystic Contact Form by Supsystic contact-form-by-supsystic allows Command Injection.This issue affects Contact Form by Supsystic: from n/a through <= 1.7.28.