Cross-site Scripting (XSS)

facturascripts/facturascripts is vulnerable to cross-site scripting. Lack of checking for file types for downloads before reading files allows an attacker to inject and execute malicious scripts...

WordPress plugin Copify 跨站请求伪造漏洞

WordPress is a set of blogging platform developed using the PHP language. A cross-site request forgery vulnerability exists in the WordPress plugin Copify 1.3.0 and prior versions, which stems from a lack of random number validation on the CopifySettings page. An attacker could exploit this...

PT-2022-14515

Name of the Vulnerable Software and Affected Versions titra versions prior to 0.77.0 Description The issue is related to Cross-site Scripting XSS - DOM, which occurs when an application includes user input in its output without proper validation or escaping, allowing an attacker to inject malicio...

GHSA-X78V-4FVJ-RG9J Camaleon CMS Stored Cross-site Scripting vulnerability

In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious...

Camaleon CMS Stored Cross-site Scripting vulnerability

In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious...

PT-2022-37729

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by a stored cross-site scripting vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s brows...

Camaleon CMS Stored Cross-site Scripting vulnerability

In “Camaleon CMS” application, versions 0.0.1 through 2.6.0 are vulnerable to stored XSS, that allows unprivileged application users to store malicious scripts in the comments section of the post. These scripts are executed in a victim’s browser when they open the page containing the malicious...

PT-2022-19601

Name of the Vulnerable Software and Affected Versions Muneeb's WP Slider Plugin versions 1.4.5 and earlier Description A Cross-Site Scripting XSS issue has been identified. This type of issue allows attackers to inject malicious scripts into content from otherwise trusted websites. No information...

invoiceninja cross-site scripting vulnerability

invoiceninja is an open source invoicing application built with Laravel and Flutter. invoiceninja suffers from a cross-site scripting vulnerability that can be exploited by attackers to execute malicious scripts...

PT-2022-19992

Name of the Vulnerable Software and Affected Versions Shopwind versions 3.4.2 and earlier Description A stored cross-site scripting XSS issue was found. This means an attacker can inject malicious scripts into the application, which will be executed by the user's browser. Recommendations For...

PT-2022-17787

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions prior to 5.0.2 Description The issue is a Reflected Cross Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, which are then executed by the user's browser. The...

livehelperchat 跨站脚本漏洞

livehelperchat is an open source application that provides free live support on a website through live helper chat. A cross-site scripting XSS vulnerability exists in livehelperchat versions prior to 3.99, which can be exploited by an attacker to execute malicious JS scripts on the application...

Reflected XSS on clients-registrations endpoint

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. When a malicious request is sent to the client registration endpoint, the error message is not properly escaped, allowing an attacker to execute malicious scripts into the user's browser. Acknowledgement...

Organizr file upload vulnerability

Organizr is a tab management system. Designed to be a one-stop store for server front ends, Organizr versions prior to 2.1.1810 have a file upload vulnerability that stems from the lack of valid validation of uploaded files by the application, which can be exploited by attackers to upload .svg...

CVE-2021-45228

An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task, it is possible to store malicious JavaScript code in the task description. This is later executed when it is reflected back to the user...

CVE-2022-1346

Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

Cross site scripting

Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

CVE-2022-1345 Stored XSS viva .svg file upload in causefx/organizr

Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

CVE-2022-1344

Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse...

PT-2022-18461

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue is related to reflected cross site scripting XSS, which allows an attacker to inject malicious scripts into a website, potentially affecting users who access the compromised pag...