CVE-2017-10886

CS-Cart Japanese Edition (and Multivendor Japanese Edition) is affected by CVE-2017-10886. A cross-site scripting vulnerability exists in CS-Cart Japanese Edition versions 4.3.10 and earlier (excluding v2/v3), enabling an attacker to inject arbitrary web script or HTML via unspecified vectors. Th...

Octopus Deploy 'Variable Set Name' Parameter Cross-Site Scripting Vulnerability

Octopus Deploy is an automation tool from Octopus Deploy Australia for development and deployment of . A cross-site scripting vulnerability exists in the All Variables tag in Octopus Deploy versions 3.4.0-3.13.6. A remote attacker can exploit this vulnerability to inject arbitrary web script or...

CVE-2017-16792

Gem in a Box (geminabox) prior to version 0.13.10 is affected by a stored XSS vulnerability. An attacker can inject arbitrary script via the homepage field in a .gemspec, related to the views/gem.erb and views/index.erb templates. The CVE-2017-16792 entry is corroborated by multiple sources (incl...

CVE-2012-4378

Multiple cross-site scripting XSS vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php...

CVE-2017-15867

Multiple cross-site scripting XSS vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 datefrom, 2 dateto, 3 userid, 4 username, 5 countryname, 6 browser, 7 operatingsystem, or 8 ipaddress parameter to...

GHSA-8QRH-H9M2-5FVF Cross site scripting that affects rails

Cross-site scripting XSS vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper...

actionview Cross-site Scripting vulnerability

Cross-site scripting XSS vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in LabWiki 1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 from parameter to index.php or the 2 pageno parameter to recentchanges.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in LetoDMS formerly MyDMS before 3.3.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in 1 inc/inc.ClassUI.php or 2 out/out.DocumentNotify.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Paid Memberships Pro PMPro plugin before 1.8.4.3 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 s parameter to membershiplevels.php, 2 memberslist.php, or 3 orders.php in adminpages/ or the 4 edit...

CVE-2012-4569

Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2012-4569

Multiple cross-site scripting XSS vulnerabilities in out/out.UsrMgr.php in LetoDMS formerly MyDMS before 3.3.9 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Cross site scripting

Cross-site scripting XSS vulnerability stored in SPIP before 3.1.7 allows remote attackers to inject arbitrary web script or HTML via a crafted string, as demonstrated by a PGP field, related to prive/objets/contenu/auteur.html and ecrire/inc/textemini.php...

CVE-2017-15736

CVE-2017-15736 is a stored XSS in SPIP (pre-3.1.7) exploitable via crafted strings in the PGP field, related to prive/objets/contenu/auteur.html and ecrire/inc/texte_mini.php. Affected versions: SPIP before 3.1.7. Remediation: upgrade to SPIP 3.1.7 or later. Exploitation details are not described...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified...

CVE-2010-3659

CVE-2010-3659 concerns multiple cross-site scripting (XSS) flaws in TYPO3 CMS. The vulnerabilities affect TYPO3 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1, allowing remote authenticated backend users to inject arbitrary script/HTML via unspecified paramet...

CVE-2010-3659

Multiple cross-site scripting XSS vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified...

phpMyFAQ 2.9.8 Cross Site Scripting

Exploit Title: phpMyFAQ 2.9.8 Stored XSS Vendor Homepage: http://www.phpmyfaq.de/ Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip Exploit Author: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: webapps CVE: CVE-2017-1461...

CVE-2017-7352

Stored Cross-site scripting XSS vulnerability in Pure Storage Purity 4.7.5 allows remote authenticated users to inject arbitrary web script or HTML via the "host" parameter on the 'System Configuration SNMP Add SNMP Trap Manager' screen...

Cross-site Scripting (XSS)

genix/cms is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the Menu ID field ininc/lib/Control/Backend/menus.control.php , allowing a malicious user to inject and execute arbitrary web script through a page=menus request...