CVE-2015-1864

Kallithea (before 0.2.1) is vulnerable to multiple XSS in the administration pages via the first/last name user details and repository/repository group/user group descriptions. Affected component: admin pages; root cause: unsanitized input in multiple fields. Impact: potential injection of arbitr...

CVE-2014-6191

CVE-2014-6191 affects IBM Cúram SPM: vulnerable versions are 6.0 SP2, 6.0.4, and 6.0.5, due to improper validation/sanitization of user-supplied input that enables cross-site scripting. Remote attacker could exploit via a specially crafted URL to run script in a victim’s browser, potentially comp...

CVE-2015-3299

Cross-site scripting XSS vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to original service order...

CVE-2017-14142

Multiple cross-site scripting XSS vulnerabilities in Kaltura before 13.2.0 allow remote attackers to inject arbitrary web script or HTML via the 1 partnerId or 2 playerVersion parameter to server/adminconsole/web/tools/bigRedButton.php; the 3 partnerId, 4 playerVersion, 5 secret, 6 entryId, 7...

CVE-2015-1864

Multiple cross-site scripting XSS vulnerabilities in the administration pages in Kallithea before 0.2.1 allow remote attackers to inject arbitrary web script or HTML via the 1 first name or 2 last name user details, or the 3 repository, 4 repository group, or 5 user group description...

CVE-2014-6191

Cross-site scripting XSS vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 98568...

CVE-2015-3432

Pydio Core before 6.0.7 has multiple XSS vulnerabilities allowing remote script/HTML injection via unspecified vectors. Affected: Pydio Core (pre-6.0.7). Root cause: cross-site scripting in the web application component. Impact: potential execution of arbitrary scripts in user browsers. Remediati...

CVE-2015-3299

Cross-site scripting XSS vulnerability in the Floating Social Bar plugin before 1.1.7 for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to original service order...

Cross-site Scripting (XSS)

concrete5 is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize multiple user input strings, allowing a malicious user to inject and execute arbitrary web script...

Cross-site Scripting (XSS)

concrete5/concrete5 is vulnerable to cross-site scripting attacks. The library does not sanitize multiple user input strings, allowing a malicious user to inject and execute arbitrary web script...

Cross-site Scripting (XSS)

concrete5/concrete5 is vulnerable to cross-site scripting XSS attacks. The library does not sanitize several parameters in web/concrete/singlepages/dashboard/users/groups/bulkupdate.php and web/concrete/tools/dashboard/sitemapdragrequest.php, allowing a malicious user to inject and execute...

Cross-site Scripting (XSS)

concrete5/concrete5 is vulnerable to cross-site scripting XSS attacks. The library does not sanitize the CollectionName or the CollectionDescription parameters in web/concrete/blocks/pageattributedisplay/controller.php, allowing a malicious user to inject and execute arbitrary web script...

Cross-site Scripting (XSS)

dompdf is vulnerable to cross-site scripting XSS attacks. The library does not filter user-supplied strings through uploaded pdf files, allowing a malicious user to inject and execute arbitrary web script...

Cross-site Scripting (XSS)

craftcms/cms is vulnerable to cross-site scripting XSS attacks. The library does not properly validate feed Url fields, allowing a malicious user to inject and execute arbitrary web script...

PT-2017-6661

Name of the Vulnerable Software and Affected Versions Floating Social Bar plugin versions prior to 1.1.7 Description The issue is related to a cross-site scripting XSS vulnerability, which allows remote attackers to inject arbitrary web script or HTML. This is achieved through vectors related to...

PT-2017-5966

Name of the Vulnerable Software and Affected Versions: IBM Curam Social Program Management versions 6.0 SP2 through 6.0.5 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. Recommendations: For versions 6.0 SP2...

PT-2017-6673

Name of the Vulnerable Software and Affected Versions Pydio versions prior to 6.0.7 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The exact vectors used for the injection are n...

CVE-2014-6191: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in IBM Curam Social Program Management 6.0 SP2, 6.0.4, and 6.0.5 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 98568...

PT-2017-13276

Name of the Vulnerable Software and Affected Versions Kaltura versions prior to 13.2.0 Description The issue allows remote attackers to inject arbitrary web script or HTML via various parameters, including partnerId, playerVersion, secret, entryId, adminUiConfId, uiConfId, streamUsername,...

Cross-site Scripting (XSS)

Moodle is vulnerable to cross-site scripting XSS attacks. The application does not sanitize the $subject parameter in the contact form on the "non-respondents" page, allowing a malicious user to inject and execute arbitrary web script...