WordPress Quiz And Survey Master plugin <= 7.3.4 - Auth. Reflected Cross-Site Scripting (XSS) vulnerability

Auth. Reflected Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress Quiz And Survey Master plugin versions = 7.3.4. Solution Update the WordPress Quiz And Survey Master plugin to the latest available version at least 7.3.5...

CVE-2022-43018

OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting XSS vulnerability via the email parameter in the Check Email function...

CVE-2022-43014

OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting XSS vulnerability via the joborderID parameter...

MGASA-2022-0372 Updated dokuwiki packages fix security vulnerability

Cross-site Scripting XSS - Reflected in GitHub repository splitbrain/dokuwiki prior to 2022-07-31a. CVE-2022-3123...

CVE-2022-3339

A reflected cross-site scripting XSS vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to...

CVE-2022-3339 Reflected XSS in Trellix ePO server

A reflected cross-site scripting XSS vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to...

WordPress core <= 6.0.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability via SQL Injection SQLi in Media Library discovered by Ben Bidner WordPress security team and Marc Montpas Automattic in WordPress core versions = 6.0.2. Solution Update the WordPress to the latest available version at least 6.0.3...

Grid Kit Premium <= 1.8.53 - Reflected Cross-Site Scripting

The plugin does not escape generated URLs before outputting them back in attributes, leading to a Reflected Cross-Site Scripting. PS: The original advisory mentions the issue being in photo-gallery, however it is not the case. On a page where there is a gallery embed, append a'-alert/XSS///=1 e.g...

Grid Kit Premium <= 1.8.53 - Reflected Cross-Site Scripting

The plugin does not escape generated URLs before outputting them back in attributes, leading to a Reflected Cross-Site Scripting. PS: The original advisory mentions the issue being in photo-gallery, however it is not the case. PoC On a page where there is a gallery embed, append a'-alert/XSS///=1...

PT-2022-7072 · Opencats · Opencats

Name of the Vulnerable Software and Affected Versions: OpenCATS version 0.9.6 Description: The issue is related to a reflected cross-site scripting XSS vulnerability in the Check Email function of OpenCATS. This vulnerability can be exploited via the email parameter, potentially allowing a remote...

McAfee ePolicy Orchestrator Multiple Vulnerabilities (SB10387)

The instance of McAfee ePolicy Orchestrator installed on the remote host is affected by multiple vulnerabilities, including the following: - An External XML entity XXE vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side...

PT-2022-25880 · Rpcms · Rpcms

Name of the Vulnerable Software and Affected Versions: RPCMS version 3.0.2 Description: A reflected cross-site scripting XSS issue was found in the Search function. This could potentially allow an attacker to inject malicious scripts into the website. Recommendations: For RPCMS version 3.0.2,...

CVE-2022-41473

RPCMS v3.0.2 was discovered to contain a reflected cross-site scripting XSS vulnerability in the Search function...

CVE-2022-41473

RPCMS 3.0.2 contains a reflected Cross-Site Scripting (XSS) vulnerability in the Search function. An attacker can inject arbitrary script in the victim’s browser, potentially stealing cookie-based credentials and enabling additional browser-based attacks. Affected product: RPCMS 3.0.2; vulnerabil...

PT-2022-25822 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite version 8.8.15 Description: The issue allows for the execution of arbitrary JavaScript on the victim's machine due to a Reflected XSS vulnerability. This is caused by the /h/search?action=voicemail&action=listen...

CVE-2021-36899

Authenticated admin+ Reflected Cross-Site Scripting XSS vulnerability in Gabe Livan's Asset CleanUp: Page Speed Booster plugin = 1.3.8.4 at WordPress...

PT-2022-21943 · WordPress · Fontmeister

Name of the Vulnerable Software and Affected Versions: FontMeister plugin versions = 1.08 at WordPress. Description: The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, potentially stealing user data or taking contro...

CVE-2022-41376

Metro UI v4.4.0 to v4.5.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the Javascript function...

CVE-2021-25044

The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpwsetpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue...

Rock Convert < 2.6.0 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape an URL before outputting it back in an attribute when a specific widget is present on a page, leading to a Reflected Cross-Site Scripting On a page where the "Capture box | Rock Convert" widget is present, append ?"alert/XSS/, e.g:...