CVE-2025-5015

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one...

CVE-2025-5015: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a malicious one...

Design/Logic Flaw

RT aka Request Tracker before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL...

CVE-2015-1464: Improper Access Control

RT aka Request Tracker before 4.0.23 and 4.2.x before 4.2.10 allows remote attackers to hijack sessions via an RSS feed URL...

PT-2015-5304

Name of the Vulnerable Software and Affected Versions RT aka Request Tracker versions prior to 4.0.23 RT aka Request Tracker versions 4.2.x prior to 4.2.10 Description The issue allows remote attackers to hijack sessions via an RSS feed URL. Recommendations For versions prior to 4.0.23, update to...

CVE-2012-2770: Undefined Security Weakness

The Authen::ExternalAuth extension before 0.11 for Best Practical Solutions RT allows remote attackers to obtain a logged-in session via unspecified vectors related to the "URL of a RSS feed of the user."...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in eXV2 CMS 2.10 allow remote attackers to inject arbitrary web script or HTML via the 1 rssfeedURL parameter to manual/caferss/example.php and the sumb parameter to 2 modules/news/archive.php, 3 modules/news/topics.php, and 4...