135050 matches found
Movies <= 0.6 - Cross-Site Scripting
A cross-site scripting vulnerability in the Movies plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php. id: CVE-2014-4539 info: name: Movies = 0.6 - Cross-Site Scripting author: daffainfo...
kkFileView 4.1.0 - Cross-Site Scripting
kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the errorMsg parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...
Odoo <= 8.0-20160726 & 9.0 - Open Redirect
An Open Redirect vulnerability in Odoo versions = 8.0-20160726 and 9.0. This issue allows an attacker to redirect users to untrusted sites via a crafted URL. id: CVE-2017-5871 info: name: Odoo = 8.0-20160726 & 9.0 - Open Redirect author: 1337rokudenashi severity: medium description: | An Open...
OURPHP <= 7.2.0 - Cross Site Scripting
OURPHP alertdocument.domain" matchers-condition: and matchers: - type: word part: body words: - "alertdocument.domain...
YesWiki Reflected XSS via File Upload
YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been...
Vite Dev Server - Information Exposure
Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...
Jenkins build-metrics 1.3 - Cross-Site Scripting
Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...
WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF
WordPress Automatic plugin 3.92.1 is vulnerable to unauthenticated Arbitrary File Download and SSRF Located in the downloader.php file, could permit attackers to download any file from a site. Sensitive data, including login credentials and backup files, could fall into the wrong hands. This...
XWiki >= 6.2-milestone-1 - Cross-Site Scripting
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:...
XWiki >= 2.5-milestone-2 - Cross-Site Scripting
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the resubmit template to perform a XSS, e.g. by using URL such as:...
mooSocial v.3.1.8 - Cross-Site Scripting
Cross-Site Scripting XSS vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to the mode parameter of the invite friend login function. id: CVE-2023-44813 info: name: mooSocial v.3.1.8 - Cross-Site Scripting author: ritikchaddha severity:...
ROOT-APP-NPM-CVE-2026-16221 CVE-2026-16221 in fast-uri - Patched by Root
Root has patched CVE-2026-16221 in the fast-uri package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-13676 CVE-2026-13676 in fast-uri - Patched by Root
Root has patched CVE-2026-13676 in the fast-uri package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44580 CVE-2026-44580 in next - Patched by Root
Root has patched CVE-2026-44580 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2024-10173 AIKIDO-2024-10173 in next - Patched by Root
Root has patched AIKIDO-2024-10173 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10755 AIKIDO-2026-10755 in next - Patched by Root
Root has patched AIKIDO-2026-10755 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-55173 CVE-2025-55173 in next - Patched by Root
Root has patched CVE-2025-55173 in the next package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2025-57752 CVE-2025-57752 in next - Patched by Root
Root has patched CVE-2025-57752 in the next package for Root:npm. Multiple fixed versions available...