389 matches found
CVE-2022-26198: Undefined Security Weakness
Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field...
CVE-2021-25057: Improper Neutralization of Input During Web Page Generation
The Translation Exchange WordPress plugin through 1.0.14 was vulnerable to Authenticated Stored Cross-Site Scripting XSS within the Project Key text field found in the plugin's settings...
CVE-2021-25058: Improper Neutralization of Input During Web Page Generation
The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting XSS within the Twitter username to mention text field...
Petfinder Listings < 1.1 - Admin+ Stored Cross-Site Scripting
The plugin does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in any of the text field settings of the plugin such as 'Your Petfinder API Key v1.0': "...
CVE-2020-22719: Improper Neutralization of Input During Web Page Generation
Shimo Document v2.0.1 contains a cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the table content text field...
Cross site scripting
The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitizetextfield but does not escape them before outputting in attributes, resulting in Stored Cross-Site Scripting issues...
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress WPSchoolPress plugin prior to version 2.1.17, whi...
Cross site scripting
Maccms 10 contains a cross-site scripting XSS vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted payload in the nickname text field...
CVE-2020-21434
Maccms 10 contains a cross-site scripting XSS vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted payload in the nickname text field...
CVE-2020-21434: Improper Neutralization of Input During Web Page Generation
Maccms 10 contains a cross-site scripting XSS vulnerability in the Editing function under the Member module. This vulnerability is exploited via a crafted payload in the nickname text field...
Shopkit Cross-Site Scripting Vulnerability
Shopkit is an open source Kirby Cms version 2 integrated commerce solution from the Canadian personal developer Sam Nabi.Shopkit version 2.7 contains a cross-site scripting vulnerability that could be exploited by attackers to hijack user credentials via a carefully crafted payload in an email te...
CVE-2020-20508
Shopkit v2.7 contains a reflective cross-site scripting XSS vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field...
Cross site scripting
Shopkit v2.7 contains a reflective cross-site scripting XSS vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field...
CVE-2020-20508: Improper Neutralization of Input During Web Page Generation
Shopkit v2.7 contains a reflective cross-site scripting XSS vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field...
CVE-2020-23481
CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field...
CVE-2020-23481: Improper Neutralization of Input During Web Page Generation
CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field...
CVE-2021-24596
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users editors and admins to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-24596
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users editors and admins to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-24596: Improper Neutralization of Input During Web Page Generation
The youForms for WordPress plugin through 1.0.5 does not sanitise escape the Button Text field of its Templates, allowing high privilege users editors and admins to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...