CVE-2024-7008 Calibre Reflected Cross-Site Scripting (XSS)

Unsanitized user-input in Calibre = 7.15.0 allow attackers to perform reflected cross-site scripting...

CVE-2024-7008 Calibre Reflected Cross-Site Scripting (XSS)

Unsanitized user-input in Calibre = 7.15.0 allow attackers to perform reflected cross-site scripting...

PT-2024-38026 · Calibre · Calibre

Name of the Vulnerable Software and Affected Versions: Calibre versions prior to 7.15.0 Description: The issue is related to unsanitized user-input, allowing attackers to perform reflected cross-site scripting. Recommendations: For Calibre versions prior to 7.15.0, update to version 7.15.0 or lat...

CVE-2024-41333

A reflected cross-site scripting XSS vulnerability in Phpgurukul Tourism Management System v2.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the uname parameter...

CVE-2024-40101

Microweber 2.0.15 and earlier are affected by a Reflected XSS in the /search endpoint. The vulnerability is triggered by supplying arbitrary script/HTML via the keywords parameter, and exploitation does not require authentication. The issue stems from insufficient input validation in the /search ...

CVE-2024-40101

A Reflected Cross-site scripting XSS vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter...

WordPress Ultimate Classified Listings plugin < 1.4 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Erwan LR WPScan in WordPress Plugin Ultimate Classified Listings versions 1.4...

CVE-2024-6529

CVE-2024-6529 is a Reflected XSS in the Ultimate Classified Listings WordPress plugin prior to version 1.4. Public sources in connected documents confirm the vulnerability arises from insufficient sanitisation/escaping of a parameter before output. The Red Hat advisory reiterates the same descrip...

CVE-2024-6529 Ultimate Classified Listings < 1.4 - Reflected XSS

The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6529 Ultimate Classified Listings < 1.4 - Reflected XSS

The Ultimate Classified Listings WordPress plugin before 1.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-41810

A Cross-site scripting XSS vulnerability exists in Python-Twisted in the twisted.web.util.redirectTo function. This flaw allows an attacker to control the redirect URL, leading to reflected XSS in the HTML body of the redirect response. If exploited, a remote attacker could inject malicious HTML,...

PT-2024-37500 · WordPress · Spidercontacts

Name of the Vulnerable Software and Affected Versions: The SpiderContacts WordPress plugin versions 1.1.7 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in t...

CVE-2024-6226

The WpStickyBar WordPress plugin through 2.1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-5809

The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users...

CVE-2024-6223

The Send email only on Reply to My Comment WordPress plugin through 1.0.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-6226

CVE-2024-6226 relates to the WpStickyBar WordPress plugin (versions up to 2.1.0). It describes a reflected XSS flaw where a user-supplied parameter is not properly sanitized/escaped before being echoed on a page. The impact is described as allowing an attacker to target high-privilege users (e.g....

CVE-2024-5809 WP Ajax Contact Form <= 2.2.2 - Reflected Cross-Site Scripting

The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users...

CVE-2024-5809

CVE-2024-5809 affects the WordPress plugin WP Ajax Contact Form (versions up to and including 2.2.2). The issue is a Reflected Cross-Site Scripting caused by not sanitising/escaping a parameter before echoing it in the page, potentially targeting admin users. Public details confirm the vulnerabil...

CVE-2024-5809 WP Ajax Contact Form <= 2.2.2 - Reflected Cross-Site Scripting

The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users...

CVE-2024-3669 Web Directory Free < 1.7.2 - Reflected XSS

The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...