WordPress Popular Posts < 6.0.0 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC When the plugin displays a performance notice: https://example.com/wp-admin/plugins.php?"...

CVE-2022-32126

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company...

CVE-2022-32125

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /job...

CVE-2022-32130

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/downresume/total/nature...

CVE-2022-32130

CVE-2022-32130 affects 74cmsSE v3.5.1. A reflective XSS flaw exists in the /company/down_resume/total/nature path caused by insufficient input validation/output encoding, allowing injected JavaScript to run in the viewer’s browser. Reported impact includes client-side code execution; CVSS metrics...

CVE-2022-32128

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /company/service/increment/add/im...

CVE-2022-32127

CVE-2022-32127 affects 74cmsSE v3.5.1 with a reflective XSS via the path /company/view_be_browsed/total. The NVD entry notes a reflective XSS issue (C/L/I A impacts) with base scores: CVSSv2 4.3 (MEDIUM) and CVSSv3.1 6.1 (MEDIUM); exploit status is not described in the provided documents. Related...

CVE-2022-32125

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the path /job...

CVE-2022-32124

74cmsSE v3.5.1 was discovered to contain a reflective cross-site scripting XSS vulnerability via the component /index/jobfairol/show/...

CVE-2021-40910

There is a reflective cross-site scripting XSS vulnerability in the PHPCMS V9.6.3 management side...

CVE-2022-28290

CVE-2022-28290 affects the WordPress Country Selector plugin until version 1.6.5. The vulnerability is a reflected Cross-Site Scripting (XSS) issue where the plugin does not sanitize/escape the country and lang parameters before output, enabling arbitrary script execution in the user’s browser (c...

CVE-2022-28290: Improper Neutralization of Input During Web Page Generation

Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the HTTP request...

CVE-2022-0879

The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting...

CVE-2021-42838

Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...

CVE-2020-18259

ED01-CMS v1.0 was discovered to contain a reflective cross-site scripting XSS vulnerability in the component sposts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the Post title or Post content fields...

CVE-2021-35228

This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remo...

CVE-2021-21746

ZTE MF971R product has reflective XSS vulnerability. An attacker could use the vulnerability to obtain cookie information...

CVE-2020-20508

Shopkit v2.7 contains a reflective XSS in the /account/register flow. The vulnerability stems from unsanitized input in the E‑Mail text field, allowing an attacker to craft payloads that hijack user credentials. Affected component: Shopkit account registration. Root cause: inadequate input saniti...

JEESNS Reflective Cross-Site Scripting Vulnerability (CNVD-2021-74052)

JEESNS is a social management system developed on the JAVA enterprise platform. The vulnerability can be exploited to execute arbitrary Web scripts or HTML via the system error message text field...

Cross site scripting

WTCMS 1.0 contains a reflective cross-site scripting XSS vulnerability in the page management background which allows attackers to obtain cookies via a crafted payload entered into the search box...