9611 matches found
Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard < 2.11.1 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high-privilege users such as admins. Visit the following path on the site as an admin user:...
CVE-2023-0937 VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS
The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
CVE-2023-0937 VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS
The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
CVE-2023-0937 VK All in One Expansion Unit < 9.87.1.0 - Reflected XSS
The VK All in One Expansion Unit WordPress plugin before 9.87.1.0 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
CVE-2023-22682
Reflected Cross-Site Scripting XSS vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin = 1.4.0.1 versions...
CVE-2022-47592
Reflected Cross-Site Scripting XSS vulnerability in Dmytriy.Cooperman MagicForm plugin = 0.1 versions...
CVE-2022-47592
Reflected Cross-Site Scripting XSS vulnerability in Dmytriy.Cooperman MagicForm plugin = 0.1 versions...
CVE-2022-47592 WordPress MagicForm Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)
Reflected Cross-Site Scripting XSS vulnerability in Dmytriy.Cooperman MagicForm plugin = 0.1 versions...
CVE-2022-47592
CVE-2022-47592 is a reflected XSS in the WordPress MagicForm plugin <= 0.1 (Dmytriy.Cooperman). The vulnerability arises from insufficient sanitization/escaping of input, allowing an attacker to inject scripts via a reflected parameter. Exploitation is unauthenticated and network-based; the CV...
PT-2023-18627 · Pixedelic.Com · Pixedelic.Com Camera Slideshow Plugin
Name of the Vulnerable Software and Affected Versions: Manuel Masia | Pixedelic.Com Camera slideshow plugin versions = 1.4.0.1 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into otherwise trusted websites,...
PT-2023-15416 · Unknown · Dmytriy.Cooperman Magicform
Name of the Vulnerable Software and Affected Versions: Dmytriy.Cooperman MagicForm plugin versions = 0.1 Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, which will then be executed by the user's...
PYSEC-2023-50
Streamlit, software for turning data scripts into web applications, had a cross-site scripting XSS vulnerability in versions 0.63.0 through 0.80.0. Users of hosted Streamlit apps were vulnerable to a reflected XSS vulnerability. An attacker could craft a malicious URL with Javascript payloads to ...
CVE-2023-1421 Reflected XSS in OAuth flow completion endpoints
A reflected cross-site scripting vulnerability in the OAuth flow completion endpoints in Mattermost allows an attacker to send AJAX requests on behalf of the victim via sharing a crafted link with a malicious state parameter...
CVE-2023-25593 Reflected Cross Site Scripting Vulnerabilities (XSS) in ClearPass Policy Manager Web-Based Management Interface
Vulnerabilities within the web-based management interface of ClearPass Policy Manager could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit allows an attacker to execute arbitrary script code in a victim's browse...
CVE-2023-0021
Due to insufficient encoding of user input, SAP NetWeaver - versions 700, 701, 702, 731, 740, 750, allows an unauthenticated attacker to inject code that may expose sensitive data like user ID and password, which could lead to reflected Cross-Site scripting. These endpoints are normally exposed...
CVE-2023-0746
The help page in GigaVUE-FM, when using GigaVUE-OS software version 5.0 202, does not require an authenticated user. An attacker could enforce a user into inserting malicious JavaScript code into the URI, that could lead to a Reflected Cross site Scripting...
Cross site scripting
The help page in GigaVUE-FM, when using GigaVUE-OS software version 5.0 202, does not require an authenticated user. An attacker could enforce a user into inserting malicious JavaScript code into the URI, that could lead to a Reflected Cross site Scripting...
PT-2023-16884 · Pimcore · Pimcore
Name of the Vulnerable Software and Affected Versions: pimcore versions prior to 10.5.19 Description: The issue allows for Cross-site Scripting XSS - Reflected, which can potentially be used to steal a user's cookie, leading to unauthorized access to the user's account. It can also redirect users...
CVE-2023-0746
The CVE-2023-0746 entry describes a Reflected Cross-Site Scripting vulnerability in Gigamon GigaVUE-FM when operating with GigaVUE-OS 5.0 202. The issue arises on the help page, where an unauthenticated user could trigger JavaScript in a URI, leading to client-side script execution. Affected prod...
Debian: Security Advisory (DLA-488-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...