PT-2022-4251

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 99 Description The issue is related to the implementation of the SVG element, which could be used to load unexpected content, potentially executing scripts under certain circumstances. Although the specification appea...

Cross site scripting

A stored cross-site scripting XSS vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box...

Cross site scripting

A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...

Total.js Cross-Site Script Vulnerabilities

Total Avengers Totaljs Framework is a Javascript-based code base for building web, desktop, service or IoT applications from Total Avengers, Slovakia. The application is similar to PHPs Laravel, Pythons Django, ASP.NET MVC for building Node applications.A cross-site scripting vulnerability exists...

CVE-2022-24136

Hospital Management System v1.0 is affected by an unrestricted upload of dangerous file type vulerability in treatmentrecord.php. To exploit, an attacker can upload any PHP file, and then execute it...

PT-2022-11889

Name of the Vulnerable Software and Affected Versions Maccms version 10 Description A Cross Site Scripting XSS issue exists due to the link Name parameter. This allows for potential malicious script execution. Recommendations For Maccms version 10, avoid using the link Name parameter until a fix ...

PT-2022-18137

Name of the Vulnerable Software and Affected Versions Archer versions 6.x through 6.10 Description The issue is a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying...

PT-2022-17737

Name of the Vulnerable Software and Affected Versions Hospital Patient Record Management System version 1.0 Description A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the special field. This enables attackers t...

PT-2022-12013

Name of the Vulnerable Software and Affected Versions OX App Suite versions 7.10.5 and earlier Description The issue allows for cross-site scripting XSS attacks via an HTML 5 element, such as AUDIO. This can potentially lead to malicious script execution on the client-side. Recommendations For OX...

Parsedown Class-Name Injection

Parsedown before 1.7.2, when safe mode is used and HTML markup is disabled, might allow attackers to execute arbitrary JavaScript code if a script already running on the affected page executes the contents of any element with a specific class. This occurs because spaces are permitted in code bloc...

PT-2022-17750

Name of the Vulnerable Software and Affected Versions Yonyou u8 version 13.0 Description A DOM-based cross-site scripting XSS issue was found in the component /u8sl/WebHelp, which can be exploited to execute malicious scripts. Recommendations For Yonyou u8 version 13.0, consider restricting acces...

WordPress and WordPress plugins have cross-site scripting vulnerabilities

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

showdoc .m3u8a file upload vulnerability

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability that stems from the lack of effective detection of .m3u8a file extensions in the application's file upload feature. An attacker could exploit this...

CVE-2022-0893

Cross-site Scripting XSS - Stored in GitHub repository pimcore/pimcore prior to 10.4.0...

JVN#87751554: Multiple vulnerabilities in pfSense

pfSense software provided by Netgate contains multiple vulnerabilities listed below. Cross-site scripting CWE-79 - CVE-2021-20729 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:M/Au:N/C:N/I:P/A:N| Base Score: 4.3 Improper...

showdoc Cross-Site Scripting Vulnerabilities

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability that stems from the lack of effective detection of .aspx file extensions in the application's file upload functionality. An attacker could use this...

showdoc Cross-Site Scripting Vulnerabilities

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 are vulnerable to file uploads, which stem from the lack of effective detection of .md file extensions in the application's file upload feature. An attacker could use this vulnerability to...

showdoc Cross-Site Scripting Vulnerabilities

showdoc is an open source tool for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability that stems from the lack of effective detection of .properties file extensions in the application's file upload feature. An attacker could exploit this...

showdoc Cross-Site Scripting Vulnerabilities

showdoc is an open source tool ideal for IT teams to share documents online. showdoc versions prior to v2.10.4 contain a file upload vulnerability, which stems from the lack of valid detection of .aspx file extensions in the application's file upload feature. An attacker could exploit this...

PT-2022-12995

Name of the Vulnerable Software and Affected Versions The Cookie Information | Free GDPR Consent Solution WordPress plugin versions prior to 2.0.8 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly escape user data before...