HAWKI 跨站脚本漏洞

HAWKI is a university teaching interface based on the OpenAI API by the German team HAWK Digital Environments. HAWKI suffers from a cross-site scripting vulnerability that stems from a reflected cross-site scripting XSS vulnerability in the file login.php...

CVE-2024-34923

In Avocent DSR2030 Appliance firmware 03.04.00.07 before 03.07.01.23, and SVIP1020 Appliance firmware 01.06.00.03 before 01.07.00.00, there is reflected cross-site scripting XSS...

CVE-2024-34923

In Avocent DSR2030 Appliance firmware 03.04.00.07 before 03.07.01.23, and SVIP1020 Appliance firmware 01.06.00.03 before 01.07.00.00, there is reflected cross-site scripting XSS...

PT-2024-28375 · WordPress · The Pet Manager

Name of the Vulnerable Software and Affected Versions: The Pet Manager WordPress plugin versions 1.4 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the...

CVE-2024-2119 LuckyWP Table of Contents <= 2.1.5 - Reflected Cross-Site Scripting

The LuckyWP Table of Contents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the attrs parameter in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2024-4971

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.2.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2024-4971

CVE-2024-4971 refers to LearnPress – WordPress LMS Plugin. Affected: LearnPress ≤ 4.2.6.6. Issue: Stored Cross-Site Scripting via id parameter (per Wordfence details) arising from input handling; the initial description cites Reflected XSS. Root cause per sources: insufficient input sanitization/...

PT-2024-18839 · WordPress · Luckywp Table Of Contents

Name of the Vulnerable Software and Affected Versions: LuckyWP Table of Contents plugin for WordPress versions up to, and including, 2.1.4 Description: The issue is related to Reflected Cross-Site Scripting via the attrs parameter due to insufficient input sanitization and output escaping. This...

CVE-2024-28063

Kiteworks Totemomail through 7.0.0 allows /responsiveUI/EnvelopeOpenServlet envelopeRecipient reflected XSS...

GitLab 12.9 < 13.11.6 / 13.12 < 13.12.6 / 14.0 < 14.0.2 (CVE-2021-22227)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and trigger actions on their behalf if they...

CVE-2024-3822

The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-3822

CVE-2024-3822 corresponds to the WordPress plugin Base64 Encoder/Decoder (versions

CVE-2024-3548 Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS

The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-3548 Shortcodes Ultimate < 7.1.2 - Contributor+ Stored XSS

The WP Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 7.1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-28866

GoCD is a continuous delivery server. GoCD versions from 19.4.0 to 23.5.0 inclusive are potentially vulnerable to a reflected cross-site scripting vulnerability on the loading page displayed while GoCD is starting, via abuse of a redirectto query parameter with inadequate validation. Attackers...

CVE-2024-3579 XSS in Online Shopping System Advanced

Open-source project Online Shopping System Advanced is vulnerable to Reflected Cross-Site Scripting XSS. An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser...

CVE-2024-3579

The CVE-2024-3579 entry concerns the Online Shopping System Advanced and its Reflected Cross-Site Scripting (XSS) vulnerability. The flaw is triggered when a user is convinced to visit a crafted URL, causing a script to run in the victim’s browser. The affected component is the web application’s ...

CVE-2024-3579 XSS in Online Shopping System Advanced

Open-source project Online Shopping System Advanced is vulnerable to Reflected Cross-Site Scripting XSS. An attacker might trick somebody into using a crafted URL, which will cause a script to be run in user's browser...

FS Product Inquiry <= 1.1.1 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or unauthenticated users PoC Have any user admin or unauthenticated open an HTML page...

PT-2024-22615 · Gocd · Gocd

Name of the Vulnerable Software and Affected Versions: GoCD versions 19.4.0 through 23.5.0 Description: The issue is a reflected cross-site scripting vulnerability on the loading page displayed while GoCD is starting, via abuse of a redirect to query parameter with inadequate validation. Attacker...