WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

CVE-2021-36381

In Edifecs Transaction Management through 2021-07-12, an unauthenticated user can inject arbitrary text into a user's browser via logon.jsp?logonerror= on the login screen of the Web application...

CVE-2021-32702 Reflected XSS from the callback handler's error query parameter

The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions before and including 1.4.1 are vulnerable to reflected XSS. An attacker can execute arbitrary code by providing an XSS payload in the error query parameter which is then processed by the...

Auth0 跨站脚本漏洞

Auth0 is is an authentication agent that supports social and enterprise identity providers, including Active Directory, LDAP, Google Apps, and Salesforce. The Auth0 Next.js SDK suffers from a cross-site scripting vulnerability that stems from the vulnerability to reflected XSS in versions 1.4.1 a...

CVE-2021-24196

The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘tokenerror’ parameter can be controlled by users and it is directly echoed without being sanitized...

CVE-2021-24196

The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘tokenerror’ parameter can be controlled by users and it is directly echoed without being sanitized...

JIZHICMS Cross-Site Scripting Vulnerability

JIZHICMS Extreme CMS is an open source, free, commercial license-free website building system. A cross-site scripting vulnerability exists in Home/c/ErrorController.php in JIZHICMS 1.7.1. An attacker can exploit this vulnerability to inject arbitrary Web script or HTML via...

CVE-2019-5588

A reflected Cross-Site-Scripting XSS vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the "err" parameter of the error process HTTP requests...

CVE-2019-11398

Multiple cross-site scripting XSS vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon...

CVE-2019-11398

Multiple cross-site scripting XSS vulnerabilities in UliCMS 2019.2 and 2019.1 allow remote attackers to inject arbitrary web script or HTML via the go parameter to admin/index.php, the go parameter to /admin/index.php?register=register, or the error parameter to admin/index.php?action=favicon...

CVE-2019-8400

ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error errorhint parameter...

CVE-2018-17946

The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id, method, Gallerymessage, Galleryerror, or Galleryupdated parameter...

Cross-site Scripting (XSS)

oauth2client is vulnerable to cross-site scripting XSS attack. These attacks are possible because there is no sanitization in the error parameter, allowing attacks to reflect arbitrary code onto the oauth2callback endpoint...

Cross site scripting

Cross-site scripting XSS vulnerability in the Event Import page import-eventbrite-events.php in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "error" parameter to wp-admin/edit.php...

CVE-2015-5485

Cross-site scripting XSS vulnerability in the Event Import page import-eventbrite-events.php in the Modern Tribe Eventbrite Tickets plugin before 3.10.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the "error" parameter to wp-admin/edit.php...

CVE-2015-5485

Summary: CVE-2015-5485 is a reflected XSS in The Events Calendar: Eventbrite Tickets Plugin for WordPress by Modern Tribe. Affected software: WordPress plugin The Events Calendar: Eventbrite Tickets (versions before 3.10.2). Vulnerable component: Event Import page (import-eventbrite-events.php). ...

Cross site scripting

Cross-site scripting XSS vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not properly handled in a pngo...

CVE-2014-6243

Cross-site scripting XSS vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not properly handled in a pngo...

Cross site scripting

Cross-site scripting XSS vulnerability in index.php in Html-edit CMS 3.1.8 allows remote attackers to inject arbitrary web script or HTML via the error parameter...

slickMsg 0.7-alpha Cross Site Scripting

www.eVuln.com advisory: error - Non-persistent XSS in slickMsg Summary: http://evuln.com/vulns/163/summary.html Details: http://evuln.com/vulns/163/description.html -----------Summary----------- eVuln ID: EV0163 Software: slickMsg Vendor: n/a Version: 0.7-alpha Critical Level: low Type: Cross Sit...