JReviews <= 4.1.5 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting https://example.com/top-user-rated-listings?listview=2&q%22%3e%3cscript%3ealert1%3c%2fscript%3e=1...

Newspaper < 12 - Reflected Cross-Site Scripting

Description The theme does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting PoC Affected parameter: acts.tdatts.imagesize...

CVE-2021-25044 Cryptocurrency Pricing list and Ticker <= 1.5 - Reflected Cross-Site Scripting

The Cryptocurrency Pricing list and Ticker WordPress plugin through 1.5 does not sanitise and escape the ccpwsetpage parameter before outputting it back in pages where its shortcode is embed, leading to a Reflected Cross-Site Scripting issue...

Newspaper < 12 - Reflected Cross-Site Scripting

Description The theme does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting Affected parameter: acts.tdatts.imagesize input type="hidden" name="atts"...

JReviews <= 4.1.5 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting PoC https://example.com/top-user-rated-listings?listview=2%22%3e%3cscript%3ealert1%3c%2fscript%3e=1...

Reflected Cross-Site Scripting in Front Payment CC

Description The frontpaymentcc.php was not properly encoding parameters cardHolderName and zip when the mode AuthorizeNet is sent. The response was a JSON string including unparsed values that will probably be sent using content-type header as text/html, leaving it vulnerable to XSS. Proof of...

Multiple Reflected Cross-Site Scripting in Messages Module

Description The first occurrence affects messages.php file. The parameter stage was not properly encoded before being printed as HTML. This occurs when go parameter is set to setup value. The second instance affects save.php file. There was a POST parameter called parameter in JSON format that wa...

WordPress Sabai Discuss premium plugin <= 1.4.13 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by CraCkEr in WordPress Sabai Discuss premium plugin versions = 1.4.13. Solution Update the WordPress Sabai Discuss plugin to the latest available version at least 1.4.14...

CVE-2022-28851 AEM Reflected XSS Arbitrary code execution

Adobe Experience Manager versions 6.5.13.0 and earlier is affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's...

CVE-2021-45843

glFusion CMS v1.7.9 is affected by a reflected Cross Site Scripting XSS vulnerability. The value of the title request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. This input was echoed unmodified in the application's response...

CVE-2022-28816 Reflected XSS in Carlo Gavazzi UWP 3.0

In Carlo Gavazzi UWP3.0 in multiple versions and CPY Car Park Server in Version 2.8.3 the Sentilo Proxy is prone to reflected XSS which only affects the Sentilo service...

CVE-2022-39053

Heimavista Rpage has insufficient filtering for platform web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS Reflected Cross-Site Scripting attack...

CVE-2022-39054

Cowell enterprise travel management system has insufficient filtering for special characters within web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS Reflected Cross-Site Scripting attack...

CVE-2022-39053 HEIMAVISTA INC. Rpage - Reflected XSS

Heimavista Rpage has insufficient filtering for platform web URL. An unauthenticated remote attacker can inject JavaScript and perform XSS Reflected Cross-Site Scripting attack...

CVE-2022-39053

CVE-2022-39053 affects Heimavista Rpage. The issue is described as insufficient filtering for platform web URLs, allowing an unauthenticated remote attacker to inject JavaScript and perform a reflected XSS. This is supported by multiple sources in the connected set (NVD, CVE Records, CNNVD, etc.)...

PT-2022-24699 · Unknown · Cowell Enterprise Travel Management System

Name of the Vulnerable Software and Affected Versions: Cowell enterprise travel management system affected versions not specified Description: The issue is related to insufficient filtering for special characters within web URLs, allowing an unauthenticated remote attacker to inject JavaScript an...

CVE-2022-2404

The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

CVE-2022-3062 Simple File List < 4.4.12 - Reflected Cross-Site Scripting

The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting...

CVE-2022-3062 Simple File List < 4.4.12 - Reflected Cross-Site Scripting

The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting...

CVE-2022-3062

CVE-2022-3062 affects the WordPress Simple File List plugin prior to 4.4.12. The vulnerability arises from not escaping parameters before outputting them in HTML attributes, enabling reflected Cross-Site Scripting. Impact is the execution of arbitrary JavaScript in the victim’s browser; remediati...