Drupal TacJS module < 6.7.0 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module TacJS versions 6.7.0...

ABB Cylon Aspect 3.08.02 (tscConfiguration.php) Authenticated Reflected XSS

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an authenticated reflected...

PT-2024-8350 · Palo Alto Networks · Pan-Os

Palo Alto Networks PAN-OS software is affected by a cross-site scripting XSS issue, which allows an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator, who can perform restrict...

Exploit for Cross-site Scripting in Salesagility Suitecrm

CVE-2024-50335: Authenticated XSS in "Publish Key" Field Allow...

WordPress Expert Invoice plugin <= 1.0.2 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Guido Iván García Duva in WordPress Plugin Expert Invoice versions = 1.0.2...

BIT-WORDPRESS-2020-4046 Authenticated XSS through embed block in WordPress

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

PT-2023-27505 · Unknown · Gurcharan Singh Fitness Calculators Plugin

Name of the Vulnerable Software and Affected Versions: Gurcharan Singh Fitness calculators plugin plugin versions 2.0.7 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject...

CVE-2023-32575

CVE-2023-32575 concerns the WordPress plugin “Product page shipping calculator for WooCommerce” (WooCommerce extension by PI Websolution). Affected versions are

PT-2023-19359 · Wpazure Themes · Wpazure Themes Upfrontwp

Name of the Vulnerable Software and Affected Versions: Wpazure Themes Upfrontwp theme versions = 1.1 Description: The issue is related to an Authenticated Reflected Cross-site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into the website, whi...

PT-2023-24297 · WordPress · Hijiri Custom Post Type Generator

Name of the Vulnerable Software and Affected Versions: Hijiri Custom Post Type Generator plugin versions = 2.4.2 Description: The issue is related to an Authenticated Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into the...

Vulnerabilities fixed in SolarWinds Platform

Solarwinds has fixed vulnerabilities in Solarwinds Platform and the Database Performance Analyzer DPA. A pre-authenticated malicious person can exploit the vulnerabilities exploit them for attacks that can result in the following categories of damage: Cross-Site Scripting XSS. Remote code executi...

PT-2023-18625 · Altanic · Altanic No Api Amazon Affiliate Plugin

Name of the Vulnerable Software and Affected Versions: Altanic No API Amazon Affiliate plugin versions = 4.2.2 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scripts into the...

CVE-2022-45363

Auth. subscriber+ Stored Cross-Site Scripting XSS in Muffingroup Betheme theme = 26.6.1 on WordPress...

CVE-2022-40963

Multiple Auth. author+ Stored Cross-Site Scripting XSS vulnerabilities in WP Page Builder plugin = 1.2.6 on WordPress...

CVE-2021-36899

The CVE-2021-36899 entry concerns the WordPress Asset CleanUp: Page Speed Booster plugin, versions

CVE-2022-38460

CVE-2022-38460 : Authenticated (contributor+) Stored Cross-Site Scripting in the WordPress plugin NOTICE BOARD (versions ≤ 1.1). The vulnerability arises from inadequate data filtering/escaping of user input, enabling XSS when a user with contributor+ privileges interacts with the plugin. Several...

CVE-2022-36365

Multiple Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerabilities in WHA Crossword plugin = 1.1.10 at WordPress...

PT-2022-22952 · Hans Matzen · Wp-Forecast

Name of the Vulnerable Software and Affected Versions: Hans Matzen's wp-forecast plugin versions = 7.5 Description: The issue is an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin or higher privileges can inject malicious scripts into the...

CVE-2022-36405

Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in amCharts: Charts and Maps plugin = 1.4 at WordPress...

PT-2022-21929 · WordPress · Bxslider Wp

Name of the Vulnerable Software and Affected Versions: BxSlider WP plugin versions = 2.0.0 Description: The issue is an Authenticated Cross-Site Scripting XSS vulnerability. It affects users with contributor or higher roles. There is no information provided about the estimated number of potential...