Taurusomar

Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to execute arbitrary code by injecting malicious payloads into markdown files stored within the application. Attackers can craft malicious markdown files with embedded JavaScript that executes system commands when opened, enabling remote code execution on the victim's computer.

The Banco Guayaquil mobile iOS application version 8.0.0 has a persistent cross-site scripting issue in the TextBox Name Profile input. An attacker can inject malicious script code via a POST request, which will execute when the application is reviewed, without requiring user interaction.

Markright is affected by a persistent cross-site scripting issue. Attackers can embed malicious payloads within markdown files. Uploading specially crafted markdown files allows execution of arbitrary JavaScript when the files are opened, potentially leading to remote code execution.

Marky version 0.0.1 contains a persistent cross-site scripting issue. Attackers can upload crafted markdown files with embedded JavaScript payloads. When these files are opened, the embedded scripts execute, potentially enabling remote code execution. The issue allows attackers to inject malicious scripts into markdown files.

The software contains a persistent cross-site scripting issue. Attackers can store malicious payloads within markdown files. Uploading specially crafted markdown files with embedded JavaScript allows execution when opened, potentially enabling remote code execution on the victim's system.

The software contains a cross-site scripting issue that allows attackers to inject malicious payloads into command snippets. Attackers can execute arbitrary code by embedding malicious JavaScript that triggers remote command execution through file or title inputs.

StudyMD version 0.3.2 has a persistent cross-site scripting issue. Attackers can inject malicious scripts into markdown files. Uploading crafted markdown files with embedded JavaScript payloads allows execution when the file is opened, potentially enabling remote code execution.

Xmind 2020 is affected by a cross-site scripting issue. This allows attackers to inject malicious payloads into mind mapping files or custom headers. Attackers can create malicious files containing embedded JavaScript that execute system commands when opened. Exploitation can occur through mouse interactions or file opening, potentially leading to remote code execution.

The software contains a persistent cross-site scripting issue. Attackers can store malicious payloads in custom widget titles and files. Attackers can craft malicious files with embedded scripts that execute when victims interact with the application, potentially enabling remote code execution.

Markdown Explorer version 0.1.1 is affected by a cross-site scripting issue. This allows attackers to inject malicious code through file uploads and editor inputs. By uploading markdown files containing JavaScript payloads, attackers can execute remote commands and potentially gain system access.

Markdownify version 1.2.0 has a persistent cross-site scripting issue. Attackers can store malicious payloads within markdown files. Uploading crafted markdown files with embedded scripts allows execution when the file is opened, potentially enabling remote code execution.

Tagstoo 2.0.1 contains a stored cross-site scripting issue that allows attackers to inject malicious payloads through files or custom tags. Successful exploitation can lead to the execution of arbitrary JavaScript code, potentially enabling attackers to spawn system processes, access files, and perform remote code execution on a victim’s computer.

The issue is related to a Reflected Cross-Site Scripting (XSS) vulnerability. It occurs because the `updraft interval` parameter is not properly sanitized and escaped before being outputted back in an admin page.

A directory traversal issue exists, allowing remote attackers to read arbitrary files by utilizing a .. (dot dot) in the `path` parameter of the download.php file in the components/filemanager directory.

A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via the `short name` parameter in a rename action. This issue was originally incorrectly mapped, but it has been identified and described.

The issue allows remote attackers to execute arbitrary SQL commands via the `create` parameter to "index.php". This can be leveraged for cross-site scripting (XSS) attacks by creating a file that generates an error.