CVE-2024-8874: Improper Neutralization of Input During Web Page Generation

The AJAX Login and Registration modal popup + inline form plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.24. This makes it possible for unauthenticated attackers to...

Synology Router Manager (SRM) 1.3.x Multiple Vulnerabilities (Synology-SA-24:16) - Remote Known Vulnerable Versions Check

Synology Router Manager SRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-9610: Improper Neutralization of Input During Web Page Generation

The Language Switcher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 3.7.13. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-48933

LemonLDAP::NG is affected by CVE-2024-48933: an XSS in the login page via username when userControl allows special HTML characters. Affected versions are prior to 2.19.3. Remediation is to upgrade to a fixed release (e.g., 2.19.3+; later advisories mention 2.20.1 as a fix). The issue is a client-...

CVE-2024-41513

A reflected cross-site scripting (XSS) vulnerability exists in the Artikel.aspx component of CADClick version 1.11.0 and earlier. The root cause is the improper neutralization of input, which allows remote attackers to inject arbitrary web scripts or HTML via the searchindex parameter. This allow...

CVE-2024-41515

A reflected cross-site scripting XSS vulnerability in "ccHandlerResource.ashx" in CADClick = 1.11.0 allows remote attackers to inject arbitrary web script or HTML via the "resurl" parameter...

PT-2024-32853

Name of the Vulnerable Software and Affected Versions Veritas Data Insight versions prior to 7.1 Description A security issue was discovered that allows a remote attacker to inject an arbitrary web script into an HTTP request, which could reflect back to an authenticated user without sanitization...

CVE-2024-8741: Improper Neutralization of Input During Web Page Generation

The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to inject...

CVE-2024-8713: Improper Neutralization of Input During Web Page Generation

The Kodex Posts likes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

CVE-2024-8724: Improper Neutralization of Input During Web Page Generation

The Waitlist Woocommerce Back in stock notifier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to inject...

Fortinet FortiSOAR Cross-Site Scripting Vulnerability (CNVD-2025-00411)

Fortinet FortiSOAR is a Security Orchestration, Automation and Response SOAR solution from Fortinet. Fortinet FortiSOAR suffers from a cross-site scripting vulnerability that originates from entering an incorrect neutralization during web page generation. A remote attacker could exploit this...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2024-37811)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Kashipara Hotel Management System security vulnerabilities

Kashipara Hotel Management System is a hotel management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Hotel Management System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the useremail parameter of...

Record Management System school parameter cross-site scripting vulnerability

Record Management System is a record management system. A cross-site scripting vulnerability exists in Record Management System version 1.0, which stems from the lack of effective filtering and escaping of user-supplied data by parameter school, and can be exploited by an attacker to execute...

CVE-2024-40101: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-site scripting XSS vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote attackers to inject arbitrary web script or HTML via the 'keywords' parameter...

CVE-2024-5215

The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2024-30836)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2024-30060)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2024-37798

Cross-site scripting XSS vulnerability in search-appointment.php in the Admin Panel in Phpgurukul Beauty Parlour Management System 1.0 allows remote attackers to inject arbitrary web script or HTML via the search input field...

Adobe Experience Manager security vulnerabilities

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...