Ad Invalid Click Protector (AICP) < 1.2.7 - Reflected Cross-Site Scripting

The plugin does not have sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting PoC...

Ad Invalid Click Protector (AICP) < 1.2.7 - Reflected Cross-Site Scripting

The plugin does not have sanitise and escape the page parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting alert/XSS/' /...

CVE-2022-0431

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting...

CVE-2022-0431

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting...

Cross site scripting

The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUESTURI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters...

Cross site scripting

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting...

CVE-2022-0901

The CVE-2022-0901 entry concerns the WordPress Ad Inserter Free and Pro plugins prior to version 2.7.12, where the REQUEST_URI is not sanitized/escaped before being output on an admin page, enabling a Reflected Cross-Site Scripting (XSS) vulnerability. The issue affects Ad Inserter and Ad Inserte...

CVE-2022-26616

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...

CVE-2022-26616

PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting XSS attacks via crafted HTTP headers...

LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue https://example.com/purchase/confirm-payment/?order=order-xxxxxxx&PayerID=aa"...

WordPress Content Egg plugin <= 5.2.0 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Content Egg plugin versions = 5.2.0. Solution Update the WordPress Content Egg plugin to the latest available version at least 5.3.0...

Menubar < 5.8 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action available to any authenticated users, leading to a Reflected Cross-Site Scripting PoC...

Menubar < 5.8 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the command parameter before outputting it back in the response via the menubar AJAX action available to any authenticated users, leading to a Reflected Cross-Site Scripting " /...

Cross-Site Scripting (XSS)

Keycloak Core is vulnerable to reflected cross-site scripting. The vulnerability exists via the POST http requests due to lack of escaping which allows a malicious attacker to inject and execute arbitrary javascript...

CVE-2021-43661

totolink EX300v2 V4.0.3c.140B20210429 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /home.asp...

CVE-2021-43661

totolink EX300v2 V4.0.3c.140B20210429 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /home.asp...

Cross site scripting

totolink EX300v2 V4.0.3c.140B20210429 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /home.asp...

Cross site scripting

Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4...

CVE-2022-1180 Reflected Cross Site Scripting in openemr/openemr

Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4...

CVE-2022-1180

CVE-2022-1180 is a reflected XSS in OpenEMR openemr/openemr prior to 6.0.0.4, stemming from lack of input validation in the newname parameter of interface/main/calendar/index.php. Impact: client-side script execution when an authenticated user performs actions in the Calendar module. Affected pro...