Lucene search
+L

33131 matches found

Nuclei
Nuclei
added 2026/08/23 2:28 a.m.23 views

WP Hotel Booking <= 2.3.2 - Cross-Site Scripting

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'checkindate' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

6.1CVSS5.6AI score0.00511EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.90 views

EPrints 3.4.2 - Cross-Site Scripting

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability in the dataset parameter to the cgi/dataset dictionary URI. id: CVE-2021-26702 info: name: EPrints 3.4.2 - Cross-Site Scripting author: ritikchaddha severity: medium description: EPrints 3.4.2 contains a reflected cross-site...

6.1CVSS6.7AI score0.03072EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.92 views

Gryphon Tower - Cross-Site Scripting

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

6.1CVSS6AI score0.02557EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.13 views

WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting

Competition Form WordPress plugin = 2.0 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires victim to visit a...

7.1CVSS8.3AI score0.00571EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.67 views

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. id: CVE-2018-19386 info: nam...

6.1CVSS5.7AI score0.12616EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.30 views

MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting

paintballrefjosh/MaNGOSWebV4 4.0.8 contains a reflected XSS caused by unsanitized input in install/index.php step parameter, letting attackers execute arbitrary scripts in the victim's browser, exploit requires victim to visit a maliciously crafted URL id: CVE-2017-6478 info: name: MaNGOSWebV4...

6.1CVSS6.3AI score0.02574EPSS
SaveExploits6References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.65 views

Jeesns 1.4.2 - Cross-Site Scripting

Jeesns 1.4.2 is vulnerable to reflected cross-site scripting in the /newVersion component and allows attackers to execute arbitrary web scripts or HTML. id: CVE-2020-19283 info: name: Jeesns 1.4.2 - Cross-Site Scripting author: pikpikcu severity: medium description: Jeesns 1.4.2 is vulnerable to...

6.1CVSS6.1AI score0.02633EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.89 views

Jeesns 1.4.2 - Cross-Site Scripting

Jeesns 1.4.2 is vulnerable to reflected cross-site scripting in the /weibo/topic component and allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field. id: CVE-2020-19295 info: name: Jeesns 1.4.2 - Cross-Site Scripting author:...

6.1CVSS6.1AI score0.03509EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.52 views

TileServer GL <=3.0.0 - Cross-Site Scripting

TileServer GL through 3.0.0 is vulnerable to reflected cross-site scripting via server.js because the content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page. id: CVE-2020-15500 info: name: TileServer GL =3.0.0 - Cross-Site Scripting author:...

6.1CVSS5.7AI score0.12224EPSS
SaveExploits4References5
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.90 views

Wordpress Multiple Themes - Reflected Cross-Site Scripting

All of the above Aapna WordPress theme through 1.3, Anand WordPress theme through 1.2, Anfaust WordPress theme through 1.1, Arendelle WordPress theme before 1.1.13, Atlast Business WordPress theme through 1.5.8.5, Bazaar Lite WordPress theme before 1.8.6, Brain Power WordPress theme through 1.2,...

6.1CVSS6.9AI score0.01002EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.40 views

DevDojo Voyager <=1.8.0 - Cross-Site Scripting

DevDojo Voyager through version 1.8.0 is vulnerable to reflected XSS via /admin/compass. By manipulating an authenticated user to click on a link, arbitrary Javascript can be executed. id: CVE-2024-55416 info: name: DevDojo Voyager =1.8.0 - Cross-Site Scripting author:...

3.5CVSS8.9AI score0.20273EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.17 views

Legull WordPress - Cross-Site Scripting

Legull WordPress plugin = 1.2.2 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires victim to click malicious link. id: CVE-2024-13352 info: name: Legull WordPress -...

7.1CVSS8.7AI score0.0055EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.18 views

Lyrion Music Server <= 9.2.0 - Cross-Site Scripting

Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers. id: CVE-2026-50230 info: name: Lyrion Music Server = 9.2.0 - Cross-Site Scripting...

6.1CVSS5.5AI score0.00406EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.168 views

Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected)

Pulse Secure Pulse Connect Secure PCS 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3 contain a reflected cross-site scripting caused by insufficient sanitization on the Application Launcher page, letting attackers execute scripts in the context of the affected page, exploit requires victim to visit ...

6.1CVSS6.2AI score0.04055EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.80 views

Apache Tomcat Examples Web Application - Cross-Site Scripting

Apache Tomcat 8.5.50 to 8.5.81, 9.0.30 to 9.0.64, 10.0.0-M1 to 10.0.22, and 10.1.0-M1 to 10.1.0-M16 contain a reflected cross-site scripting caused by displaying unfiltered user data in the Form authentication example, letting attackers execute scripts in victim browsers, exploit requires attacke...

6.1CVSS7.3AI score0.06562EPSS
SaveExploits0References4
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.17 views

WordPress Qwizcards < 3.95 - Cross-Site Scripting (Reflected)

The WordPress Qwizcards plugin before version 3.95 does not sanitise and escape the "themestylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting vulnerability. id: CVE-2025-6174 info: name: WordPress Qwizcards alert'randstr'" matchers...

6.1CVSS5.2AI score0.0046EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.22 views

NocoDB < 0.258.0 - Reflected XSS in Password Reset

NocoDB versions before 0.258.0 contain a reflected cross-site scripting caused by insecure use of '\u003C%-' in resetPassword.ts, letting attackers execute malicious scripts in victims' browsers, exploit requires sending crafted requests to /api/v1/db/auth/password/reset/:tokenId. id:...

6.1CVSS5AI score0.00685EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.34 views

FOSSBilling < 0.5.3 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4. id: CVE-2023-3521 info: name: FOSSBilling &datefrom='" HTTP/1.1 Host: Hostname matchers-condition: and matchers: - type: word part: body words:...

6.1CVSS5.4AI score0.00919EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.310 views

PAN-OS - Reflected Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link.The...

6.9CVSS6.3AI score0.46401EPSS
SaveExploits8References2
Nuclei
Nuclei
added 2026/08/23 2:28 a.m.63 views

JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jpyearbuilt leads to cross...

6.1CVSS3.5AI score0.00966EPSS
SaveExploits2References3
Rows per page
Query Builder