9596 matches found
CVE-2022-0879
The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting...
CVE-2022-0879 Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting
The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting...
CVE-2021-25120
The CVE-2021-25120 affects the WordPress plugins Easy Social Feed Free/Pro prior to version 6.2.7. Affected component: parameters used via AJAX actions that are not sanitized before being reflected in responses, enabling a reflected Cross-Site Scripting (XSS) condition. The issue can execute Java...
CVE-2022-27422
A reflected cross-site scripting XSS vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL...
CVE-2020-25158 B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
A reflected cross-site scripting XSS vulnerability in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows remote attackers to inject arbitrary web script or HTML into various locations...
CVE-2022-22181
CVE-2022-22181 is a reflected XSS in Juniper Junos OS J-Web. Affected: Junos OS versions prior to 18.3R3-S5; 18.4 before 18.4R3-S9; 19.1 before 19.1R3-S6; 19.2 before 19.2R3-S3; 19.3 before 19.3R2-S6, 19.3R3-S3; 19.4 before 19.4R3-S5; 20.1 before 20.1R3-S4; 20.2 before 20.2R3-S2; 20.3 before 20.3...
Uber: Full read SSRF in flyte-poc-us-east4.uberinternal.com
Uber summary TBD. @shubs and I discovered an instance of Flyte Console on uberinternal.com. After auditing the open source code, we noticed an unauthenticated route for a “CORS proxy”. This was a classic server-side request forgery issue, allowing us to pass an arbitrary request to be performed b...
CVE-2022-27505
Reflected cross site scripting XSS...
Admin Menu Editor <= 1.0.4 - Reflected Cross-Site Scripting
The plugin does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. https://example.com/wp-admin/options-general.php?page=admin-menu-restriction&role="...
CVE-2021-36914
Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS in CalderaWP License Manager WordPress plugin = 1.2.11...
CVE-2021-36914
Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS in CalderaWP License Manager WordPress plugin = 1.2.11...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS in CalderaWP License Manager WordPress plugin = 1.2.11...
CVE-2021-36914 WordPress CalderaWP License Manager plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability leading to Reflected Cross-Site Scripting (XSS)
Cross-Site Request Forgery CSRF vulnerability leading to Reflected Cross-Site Scripting XSS in CalderaWP License Manager WordPress plugin = 1.2.11...
CalderaWP License Manager <= 1.2.11 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape some parameters before outputting them back, leading to a Reflected Cross-Site Scripting...
Themify - Post Type Builder Search Addon < 1.4.0 - Reflected Cross-Site Scripting
The plugin does not properly escape the current page URL before reusing it in a HTML attribute, leading to a reflected cross site scripting vulnerability. PoC On a page or post with a search form, add the following url query parameter: ?%22%3E%3Cscript%3Ealert1%3C/script%3E...
PT-2022-10605 · Calderawp · Calderawp License Manager
Name of the Vulnerable Software and Affected Versions: CalderaWP License Manager versions prior to 1.2.12 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that can lead to Reflected Cross-Site Scripting XSS. This means an attacker could potentially trick a user into...
CVE-2022-0314
The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...
CVE-2022-1007
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue...
CVE-2022-0314
The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...