CVE-2023-42496

Reflected cross-site scripting XSS vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, 7.4 GA through update 92, and 7.3 before update 34 allows remote attackers to inject arbitrary web script or HTML via the...

CVE-2023-42496

Vulnerability summary (CVE-2023-42496) : A reflected cross-site scripting (XSS) flaw affects Liferay Portal 7.3.3–7.4.3.97 and Liferay DXP 2023.Q3 before patch 6, as well as 7.4 GA through update 92 and 7.3 before update 34. The issue is triggered by supplying user-supplied input in the parameter...

CVE-2024-25895

A reflected cross-site scripting XSS vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web script or HTML via the type parameter of /EventAttendance.php...

CVE-2024-0821

The Cost of Goods Sold COGS: Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'section' parameter in all versions up to, and including, 3.2.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-0821 Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site Scripting

The Cost of Goods Sold COGS: Cost & Profit Calculator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'section' parameter in all versions up to, and including, 3.2.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2023-6923

The CVE-2023-6923 involves the Matomo Analytics – Ethical Stats. Powerful Insights. WordPress plugin. Affected: WordPress Matomo plugin up to version 4.15.3. Root cause: insufficient input sanitization and output escaping in the idsite parameter, enabling Reflected Cross-Site Scripting. Impact: u...

CVE-2023-6923 Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsite

The Matomo Analytics – Ethical Stats. Powerful Insights. plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the idsite parameter in all versions up to, and including, 4.15.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2024-21984 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID formerly StorageGRID Webscale versions prior to 11.8 are susceptible to a difficult to exploit Reflected Cross-Site Scripting XSS vulnerability. Successful exploit requires the attacker to know specific information about the target instance and trick a privileged user into clicking a...

CVE-2024-21984 Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)

StorageGRID formerly StorageGRID Webscale versions prior to 11.8 are susceptible to a difficult to exploit Reflected Cross-Site Scripting XSS vulnerability. Successful exploit requires the attacker to know specific information about the target instance and trick a privileged user into clicking a...

CVE-2024-0010

CVE-2024-0010 : A reflected cross-site scripting (XSS) vulnerability in the PAN-OS GlobalProtect portal could allow an attacker to execute malicious JavaScript in a user’s browser after clicking a crafted link, enabling phishing and potential credential theft. Affected PAN-OS versions (per connec...

CVE-2024-0010 PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Portal

A reflected cross-site scripting XSS vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript in the context of a user’s browser if a user clicks on a malicious link, allowing phishing attacks that could lead to credential...

PT-2024-20665 · WordPress · Unitedthemes Brooklyn

Name of the Vulnerable Software and Affected Versions: UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme versions through 4.9.7.6 Description: The issue affects the UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme, allowing Reflected XSS due to...

CVE-2024-24877

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magic Hills Pty Ltd Wonder Slider Lite allows Reflected XSS.This issue affects Wonder Slider Lite: from n/a through 13.9...

PT-2024-20637 · Veronalabs · Veronalabs Wp Sms

Name of the Vulnerable Software and Affected Versions: VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc versions n/a through 6.5.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-si...

Link Library < 7.6 - Reflected Cross-Site Scripting via 'link_price' and 'link_tags'

Description The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'linkprice' and 'linktags' parameters in versions up to, and including, 7.5.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2024-24131

SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting XSS vulenrability via the component api.php...

CVE-2024-1037

The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2024-0509

The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘request’ parameter in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Cross site scripting

The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘request’ parameter in all versions up to, and including, 1.0.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Security Bulletin: Reflected cross-site scripting vulnerability affects IBM Business Automation Workflow - CVE-2023-50947

Summary IBM Business Automation Workflow is vulnerable to a reflected cross-site scripting attack. Vulnerability Details CVEID:CVE-2023-50947 DESCRIPTION: IBM Business Automation Workflow is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in...