miniOrange's Google Authenticator < 5.4.40 - Reflected Cross-Site Scripting

The plugin does not escape the user parameter before outputting it back in an attribute in the dashboard page to confirm the 2FA reset, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/users.php?page=reset&action=resetedit&user="alert/XSS/...

CVE-2021-3294: Improper Neutralization of Input During Web Page Generation

CASAP Automated Enrollment System 1.0 is affected by cross-site scripting XSS in users.php. An attacker can steal a cookie to perform user redirection to a malicious website...

CVE-2021-3294

CVE-2021-3294 concerns the CASAP Automated Enrollment System 1.0. The vulnerability is a Stored Cross-Site Scripting (XSS) in users.php, arising from insufficient validation of user data in the “First Name” field, enabling an attacker to steal cookies and redirect victims to a malicious site. Pub...

CVE-2020-28930: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS issue in the 'update user' and 'delete user' functionalities in settings/users.php in EPSON EPS TSE Server 8 21.0.11 allows an authenticated attacker to inject a JavaScript payload in the user management page that is executed by an administrator...

Nagios XI users.php do_update_user Stored Cross-Site Scripting

A stored cross-site scripting vulnerability exists in Nagios XI. The vulnerability is due to insufficient validation of the phone parameter in users.php...

Cross site scripting

Victor CMS 1.0 has Persistent XSS in admin/users.php?source=adduser via the username, userfirstname, or userlastname parameter...

CVE-2020-13427

Victor CMS 1.0 has Persistent XSS in admin/users.php?source=adduser via the username, userfirstname, or userlastname parameter...

CVE-2020-13427: Improper Neutralization of Input During Web Page Generation

Victor CMS 1.0 has Persistent XSS in admin/users.php?source=adduser via the username, userfirstname, or userlastname parameter...

CVE-2020-13827

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...

Design/Logic Flaw

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...

CVE-2020-13827: Improper Neutralization of Input During Web Page Generation

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php...

CVE-2020-10433: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-users.php by adding a question mark ? followed by the payload...

CVE-2020-10453: Improper Neutralization of Input During Web Page Generation

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/search-users.php by adding a question mark ? followed by the payload...

CVE-2019-17515: Improper Neutralization of Input During Web Page Generation

The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting XSS. The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and...

CVE-2018-12628: Cross-Site Request Forgery (CSRF)

An issue was discovered in Eventum 3.5.0. CSRF in htdocs/manage/users.php allows creating another user with admin privileges...

CVE-2019-11537: Improper Neutralization of Input During Web Page Generation

In osTicket before 1.12, XSS exists via /upload/file.php, /upload/scp/users.php?do=import-users, and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer, because file contents can appear in an error message. The XSS can lead to local file...

CVE-2018-20590

CVE-2018-20590 affects the Ivan Cordoba Generic Content Management System (CMS) up to 2018-04-28. The vulnerability is a Cross-Site Scripting (XSS) flaw in the file or path used by the Administrator/users.php user ID. The linked CNVD entry describes that the XSS can allow execution of arbitrary J...

CVE-2018-20590: Improper Neutralization of Input During Web Page Generation

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/users.php user ID...

CVE-2018-15713: Improper Neutralization of Input During Web Page Generation

Nagios XI 5.5.6 allows persistent cross site scripting from remote authenticated attackers via the stored email address in admin/users.php...

PT-2018-13163

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.5.6 Description The issue allows persistent cross-site scripting, which can be exploited by remote authenticated attackers. This is achieved via the stored email address in the admin/users.php page. Recommendations For Nagi...