CVE-2024-32342

A cross-site scripting (XSS) vulnerability exists in Boid CMS v2.1.0 within the Create Page functionality. The root cause is the improper neutralization of input, allowing an attacker to execute arbitrary web scripts or HTML by injecting a crafted payload into the Permalink parameter. Practical c...

CVE-2024-32342: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Permalink parameter...

HT Mega < 2.4.7 - Contributor+ Stored XSS via size

Description The plugin is vulnerable to Stored Cross-Site Scripting via the 'size' value in several widgets due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to...

CVE-2024-32344

A cross-site scripting XSS vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit parameter under the Language section...

CVE-2024-32340

A cross-site scripting XSS vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the WEBSITE TITLE parameter under the Menu module...

CVE-2024-32342

A cross-site scripting XSS vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Permalink parameter...

CVE-2024-30952

The content publishing platform PESCMS-TEAM v2.3.6 is vulnerable to a stored cross-site scripting (XSS) vulnerability. The issue originates from the youdoamin component, where a lack of proper input neutralization allows an attacker to inject a crafted payload into the domain input field at the /...

CVE-2024-32745

The open-source PHP-based content management system WonderCMS v3.4.3 is vulnerable to a cross-site scripting (XSS) flaw. The root cause is a lack of effective filtering and escaping of user-supplied data within the PAGE DESCRIPTION parameter, located in the Settings section under the CURRENT PAGE...

CVE-2024-32344

CMSimple version 5.15 is susceptible to a cross-site scripting (XSS) vulnerability within the Settings menu . The root cause is the lack of effective filtering and escaping of user-supplied data in the Edit parameter under the Language section . Attackers can exploit this by injecting a crafted p...

CVE-2024-32744

WonderCMS v3.4.3 contains a cross-site scripting (XSS) vulnerability within its Settings section. The root cause is the improper neutralization of input in the PAGE KEYWORDS parameter under the CURRENT PAGE module. An attacker can exploit this by injecting a crafted payload to execute arbitrary w...

CVE-2024-32345

The CMSimple content management system, specifically version 5.15 , is affected by a cross-site scripting (XSS) vulnerability in its Settings menu . The root cause is a lack of effective filtering and escaping of user-supplied data within the Configuration parameter under the Language section. An...

CVE-2024-32746

A cross-site scripting (XSS) vulnerability exists in WonderCMS v3.4.3 within the Settings section. The flaw is caused by a lack of effective filtering and escaping of user-supplied data in the MENU parameter under the Menu module . An attacker can exploit this by injecting a crafted payload to ex...

HT Mega < 2.4.7 - Contributor+ Stored XSS via Lightbox Widget

Description The plugin is vulnerable to Stored Cross-Site Scripting via the plugin's lightbox widget due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject...

CVE-2024-32337

A cross-site scripting XSS vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ADMIN LOGIN URL parameter under the Security module...

CVE-2024-30952

A stored cross-site scripting XSS vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the domain input field under /youdoamin/?g=Team&m=Setting&a=action...

CVE-2024-32341

The open-source PHP-based content management system WonderCMS v3.4.3 is vulnerable to multiple cross-site scripting (XSS) flaws on its Home page . The root cause is a lack of effective filtering and escaping of user-supplied data, allowing an attacker to inject arbitrary web scripts or HTML via a...

CVE-2024-32340

A cross-site scripting XSS vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the WEBSITE TITLE parameter under the Menu module...

CVE-2024-32339: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the HOW TO page of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into any of the parameters...

CVE-2024-32343

A cross-site scripting XSS vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter...

CVE-2024-32343

A cross-site scripting XSS vulnerability in the Create Page of Boid CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter...