Cross site scripting

Dell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged network attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user...

Barco Control Room 跨站脚本漏洞

Barco Control Room is a visualization and collaboration solution from Barco Belgium. Used to build control rooms, the Barco Control Room Management Suite web application version 3.14 previously contained a cross-site scripting vulnerability that could be exploited by attackers to execute JavaScri...

Jfinal CMS 跨站脚本漏洞

Jfinal CMS is a powerful information consulting website developed in java, using the simple and powerful JFinal as the web framework, template engine with beetl, database with mysql, and front-end bootstrap framework. cross-site scripting vulnerability exists in Jfinal CMS v5.1.0. The vulnerabili...

WordPress WP 2FA plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress WP 2FA plugin version 2.2.1 before version 2.2.1 has a cross-site scripting vulnerability...

WordPress Easy FAQ with Expanding Text plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Easy FAQ with Expanding Text plugin 3.2.8.3.1 and earlier versions contain a cross-site scripting...

WordPress No Future Posts plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress No Future Posts plugin 1.4 and earlier versions have a cross-site scripting vulnerability that stem...

WordPress New Window/New Tab plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions of WordPress New Window/New Tab plugin prior to 1.43. T...

WordPress Quotes llama plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Quotes llama plugin 0.7 and earlier versions have a cross-site scripting vulnerability that...

WordPress plugin Team Members 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Team Members plugin versions prior to 5.1.1 contain a cross-site scripting vulnerability that stems...

CVE-2022-29091

Summary: CVE-2022-29091 affects Dell Unity, Dell UnityVSA, and Dell UnityXT versions before 5.2.0.0.5.173. A Reflected Cross-Site Scripting vulnerability exists in the Unisphere GUI, enabling an unauthenticated remote attacker to trigger execution of malicious HTML/JavaScript in the victim’s brow...

Covid-19 Travel Pass Management System Cross-Site Scripting Vulnerability

Covid-19 Travel Pass Management System is a Covid-19 travel pass management system. The Covid-19 Travel Pass Management System v1.0 version contains a cross-site scripting vulnerability that originates in /ctpms/classes/Users.php?f=save and lacks data validation filters for user-supplied data and...

Missing Cryptographic Step in cassproject

Impact CaSS Library, npm:cassproject has a missing cryptographic step when storing cryptographic keys that can allow a server administrator access to an account’s cryptographic keys. This affects CaSS servers using standalone username/password authentication, which uses a method that expects e2e...

GHSA-7QCX-4P32-QCMX Missing Cryptographic Step in cassproject

Impact CaSS Library, npm:cassproject has a missing cryptographic step when storing cryptographic keys that can allow a server administrator access to an account’s cryptographic keys. This affects CaSS servers using standalone username/password authentication, which uses a method that expects e2e...

Badminton Center Management System跨站脚本漏洞

Badminton Center Management System is a badminton center management system from Carlo Montero's personal developer. Badminton Center Management System is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and output for the...

Moodle Client side denial of service via personal message

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side browser denial of service for users receiving very large messages...

GHSA-C3J6-33R4-89Q3 Moodle Client side denial of service via personal message

It was found in Moodle before version 3.10.1, 3.9.4, 3.8.7 and 3.5.16 that messaging did not impose a character limit when sending messages, which could result in client-side browser denial of service for users receiving very large messages...

GHSA-VJCM-J85R-7P68 DNN File Upload Vulnerability

DNN formerly DotNetNuke through 9.4.4 has a File upload vulnerability via bypassing client-side file extension check...

Pix-Link MiniRouter 28K.MiniRouter.20190211 Cross-Site Scripting Vulnerability (CNVD-2022-77885)

Pix-Link MiNi Router 28K.MiniRouter.20190211 is a router from Pix-Link China.Pix-Link MiniRouter 28K.MiniRouter.20190211 suffers from a cross-site scripting vulnerability, which stems from an unhandled security key parameter. An attacker could exploit the vulnerability to execute JavaScript code ...

Vaadin Flow Components 信息泄露漏洞

Vaadin Flow Components is a Maven multi-module project that contains all Vaadin flow components. A security vulnerability exists in Vaadin Flow Components that stems from the default configuration of the TreeGrid component that uses Object::toString as the key for client-server communication in...

WordPress wpDataTables plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress wpDataTables plugin 2.1.27 and earlier versions have a cross-site scripting vulnerability...