120 matches found
EUVD-2023-34896
Malicious code in bioql PyPI...
CVE-2025-3745 WP Lightbox 2 < 3.0.6.8 - Unauthenticated Stored XSS
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks...
CVE-2023-34008
Unauth. Reflected Cross-Site Scripting XSS vulnerability in weDevs WP ERP plugin = 1.12.3 versions...
CVE-2023-30491
Unauth. Reflected Cross-Site Scripting XSS vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin = 2.1.8 versions...
CVE-2023-32300
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Yoast Yoast SEO: Local plugin = 14.8 versions...
CVE-2021-24304
The Newsmag WordPress theme before 5.0 does not sanitise the tdblockid parameter in its tdajaxblock AJAX action, leading to an unauthenticated Reflected Cross-site Scripting XSS vulnerability...
CVE-2020-14206
The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function via an arbitrary parameter...
CVE-2020-9405
IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page...
CVE-2019-19134
The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of ...
Vulnerabilities fixed in Cisco Webex
Cisco has fixed vulnerabilities in Cisco Webex. The vulnerabilities are in the way Cisco Webex filters user input. Unauthenticated attackers can exploit these vulnerabilities to perform cross-site scripting XSS attacks by convincing users to click on malicious links. Such an attack can lead to...
CVE-2025-1303 Plugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSS
The Plugin Oficial WordPress plugin through 1.7.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against only unauthenticated users...
ABB Cylon Aspect 4.00.00 (factorySaved.php) - Unauthenticated XSS
Exploit title: ABB Cylon Aspect 4.00.00 factorySaved.php Unauthenticated XSS Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =4.00.00 Summary: ASPECT is an award-winning scalable building energy...
Drupal Ignition by Thrive Themes module < 1.0.4 - Unauthenticated Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS vulnerability discovered by Dieter Holvoet in WordPress Module Ignition Error Pages versions 1.0.4...
GHSA-WPHC-5F2J-JHVG Unauthenticated DOM Based XSS in YesWiki
Unauthenticated DOM Based XSS in YesWiki ' . "\n"; if $nbtotal 1 $output .= t'TAGSTOTALNBPAGES', 'nbtotal' = $nbtotal; elseif $nbtotal == 1 $output .= t'TAGSONEPAGEFOUND'; else $output .= t'TAGSNOPAGE'; $output .= !empty$tabselectedtags ? ' ' . t'TAGSWITHKEYWORD' . ' ' . implode' '...
Unauthenticated DOM Based XSS in YesWiki
Unauthenticated DOM Based XSS in YesWiki ' . "\n"; if $nbtotal 1 $output .= t'TAGSTOTALNBPAGES', 'nbtotal' = $nbtotal; elseif $nbtotal == 1 $output .= t'TAGSONEPAGEFOUND'; else $output .= t'TAGSNOPAGE'; $output .= !empty$tabselectedtags ? ' ' . t'TAGSWITHKEYWORD' . ' ' . implode' '...
CVE-2025-24017
YesWiki DOM-based XSS (CVE-2025-24017) affects YesWiki up to version 4.4.5. The vulnerability stems from insufficient sanitization in the tag-search workflow: when a user-provided tag is reflected on pages, it can inject client-side script, enabling an attacker to craft a malicious link that trig...
ABB Cylon Aspect 4.00.00 (factorySaved.php) Unauthenticated XSS
Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB Cylon Aspect BMS/BAS controller suffers from an unauthenticat...
WordPress Music Request Manager plugin <= 1.3 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Music Request Manager versions = 1.3...
PT-2024-12301 · Norman · Norman Api
Name of the Vulnerable Software and Affected Versions: Norman API versions prior to the patched versions Description: A vulnerability has been identified in Norman's public API endpoint, allowing unauthenticated cross-site scripting XSS to be exploited. This can lead to an attacker triggering...