CVE-2020-26153

A cross-site scripting XSS vulnerability in wp-content/plugins/event-espresso-core-reg/adminpages/messages/templates/eemsgadminoverview.template.php in the Event Espresso Core plugin before 4.10.7.p for WordPress allows remote attackers to inject arbitrary web script or HTML via the page paramete...

PT-2021-20592

Name of the Vulnerable Software and Affected Versions: WP Upload Restriction WordPress plugin versions 2.2.3 and prior Description: A vulnerability in the saveCustomType function allows low-level authenticated users to inject arbitrary web scripts. Recommendations: For versions 2.2.3 and prior,...

GHSA-378P-HRQ3-X4P3 Cross-site scripting in Shopizer

A reflected cross-site scripting XSS vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL...

CVE-2011-3656

CVE-2011-3656 affects Mozilla Firefox up to version 3.6.24 and 4.x through 7, with a Cross-Site Scripting (XSS) flaw that allows remote attackers to inject arbitrary script or HTML via HTTP 0.9 error handling, non-default ports, and content-sniffing. The provided documents consistently describe t...

Shopizer Cross-Site Scripting Vulnerability (CNVD-2021-38077)

Shopizer is a Java open source e-commerce software. A cross-site scripting vulnerability exists in Shopizer versions prior to 2.17.0. A remote attacker can exploit this vulnerability by using the ref parameter to inject arbitrary Web script or HTML into a page about any product...

CVE-2021-30082

An issue was discovered in Gris CMS v0.1. There is a Persistent XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML via admin/dashboard...

Cross site scripting

Cross Site Scripting XSS vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized "f" variable in app\vars\varstextarea.php...

CVE-2021-29051

CVE-2021-29051 affects Liferay Portal/DXP: Asset Publisher app vulnerable to XSS via _com_liferay_asset_publisher_web_portlet_AssetPublisherPortlet_INSTANCE_XXXXXXXXXXXX_assetEntryId parameter. Affected: Portal 7.2.1–7.3.5; DXP 7.1 before FP21, 7.2 before FP10, and 7.3 before FP1. Root cause: inp...

CVE-2021-29051

Cross-site scripting XSS vulnerability in the Asset module's Asset Publisher app in Liferay Portal 7.2.1 through 7.3.5, and Liferay DXP 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary web script or HTML via the...

CVE-2021-29044

Cross-site scripting XSS vulnerability in the Site module's membership request administration pages in Liferay Portal 7.0.0 through 7.3.5, and Liferay DXP 7.0 before fix pack 97, 7.1 before fix pack 21, 7.2 before fix pack 10 and 7.3 before fix pack 1 allows remote attackers to inject arbitrary w...

CVE-2021-30212

Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting XSS. An attacker can inject arbitrary web script in '/knowage/restful-services/documentnotes/saveNote' via the 'nota' parameter...

CVE-2021-30211

Knowage Suite 7.3 is vulnerable to Stored Cross-Site Scripting XSS. An attacker can inject arbitrary web script in '/knowage/restful-services/signup/update' via the 'surname' parameter...

CVE-2020-23374

Cross-site scripting XSS vulnerability in admin/article/add.html in noneCMS v1.3.0 allows remote authenticated attackers to inject arbitrary web script or HTML via the name parameter...

CVE-2020-23371

Cross-site scripting XSS vulnerability in static/admin/js/kindeditor/plugins/multiimage/images/swfupload.swf in noneCms v1.3.0 allows remote attackers to inject arbitrary web script or HTML via the movieName parameter...

CVE-2021-32092

A Cross-site scripting XSS vulnerability in the DocumentAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter...

Cross site scripting

Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web script or HTML via modifying the name of the users. The XSS is executed when an administrator access the logs...

GHSA-9W49-M7XH-5R39 Cross-site scripting in papermerge

Multiple cross-site scripting XSS vulnerabilities in Papermerge before 1.5.2 allow remote attackers to inject arbitrary web script or HTML via the rename, tag, upload, or create folder function. The payload can be in a folder, a tag, or a document's filename. If email consumption is configured in...

Course Registration Management System Cross Site Scripting (CVE-2021-29663)

A cross-site scripting vulnerability exists in Course Registration Management System. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

WCMS Cross-Site Scripting Vulnerability

WCMS is a content management system CMS that uses an open web interface to build websites. A cross-site scripting vulnerability exists in WCMS version 0.3.2. The vulnerability can be exploited to inject arbitrary web script and HTML via the pagename parameter of wex/html.php...

CVE-2021-30056

Knowage Suite before 7.4 is vulnerable to reflected cross-site scripting XSS. An attacker can inject arbitrary web script in /restful-services/publish via the 'EXECFROM' parameter that can lead to data leakage...