PT-2024-32386 · Contao +1 · Contao Open Source Cms +1

Name of the Vulnerable Software and Affected Versions: Oveleon Cookie Bar versions prior to 1.16.3 and 2.1.3 Description: The block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the backend's HTTP response, thereby causing reflected cross-site...

CVE-2024-22444

A vulnerability within the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow a remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a...

CVE-2024-32484

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability...

CVE-2024-32484

Affected product: Ankitects Anki (entries reference Anki up to 25.02). The connected documents indicate CVE-2025-43703 describes an incomplete fix for CVE-2024-32484, resulting in attacker‑controlled access to the internal API via crafted decks/SRC attributes, effectively enabling scripted access...

CVE-2024-32484

An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A specially crafted flashcard can lead to JavaScript code execution and result in an arbitrary file read. An attacker can share a malicious flashcard to trigger this vulnerability...

CVE-2024-37206

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Theme4Press Demo Awesome allows Reflected XSS.This issue affects Demo Awesome: from n/a through 1.0.1...

CVE-2024-37206

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Theme4Press Demo Awesome allows Reflected XSS.This issue affects Demo Awesome: from n/a through 1.0.1...

CVE-2024-37117

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Uncanny Owl Uncanny Automator Pro allows Reflected XSS.This issue affects Uncanny Automator Pro: from n/a through 5.3...

CVE-2024-37097

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in UnitedThemes Shortcodes by United Themes allows Reflected XSS.This issue affects Shortcodes by United Themes: from n/a before 5.0.5...

CVE-2024-37097

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in UnitedThemes Shortcodes by United Themes allows Reflected XSS.This issue affects Shortcodes by United Themes: from n/a before 5.0.5...

CVE-2024-35656

CVE-2024-35656 is an input handling flaw in Elementor Pro (WordPress) that enables Reflected XSS in the Elementor Website Builder Pro up to version 3.21.2. The issue occurs during web page generation and affects Elementor Pro releases prior to the patched version. The connected documents identify...

CVE-2024-37433

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EverPress Mailster mailster.This issue affects Mailster: from n/a through = 4.0.9...

CVE-2024-37433

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in EverPress Mailster allows Reflected XSS.This issue affects Mailster: from n/a through 4.0.9...

CVE-2024-37416

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.00.002...

CVE-2024-37416

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.00.002...

CVE-2024-37267

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in kaptinlin Striking allows Reflected XSS.This issue affects Striking: from n/a through 2.3.4...

CVE-2024-37259

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through = 2.4.7...

CVE-2024-37257

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Maciej Bis Permalink Manager Lite allows Reflected XSS.This issue affects Permalink Manager Lite: from n/a through 2.4.3.3...

CVE-2024-37257

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Maciej Bis Permalink Manager Lite allows Reflected XSS.This issue affects Permalink Manager Lite: from n/a through 2.4.3.3...

CVE-2024-37245

CVE-2024-37245 is a Reflected Cross-Site Scripting (XSS) vulnerability in Vsourz Digital All In One Redirection for WordPress. The issue affects All In One Redirection versions from n/a through 2.2.0. The vulnerability arises from improper input neutralization during web page generation, enabling...