5970 matches found
CVE-2020-19266: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in the index.php/Dswjcms/Site/articleList component of Dswjcms 1.6.4 allows attackers to execute arbitrary web scripts or HTML...
CVE-2020-19288: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in the /localhost/u component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in a private message...
CVE-2020-19295: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting XSS vulnerability in the /weibo/topic component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML...
CVE-2020-19292: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in the /question/ask component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in a posted question...
CVE-2020-19293: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in the /article/add component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in a posted article...
CVE-2020-19283: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting XSS vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML...
CVE-2020-19281: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in the /manage/loginusername component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the username field...
CVE-2020-19265: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in the index.php/Dswjcms/Basis/links component of Dswjcms 1.6.4 allows attackers to execute arbitrary web scripts or HTML...
PT-2021-10335
Name of the Vulnerable Software and Affected Versions: Jeesns version 1.4.2 Description: A reflected cross-site scripting XSS issue in the "/weibo/topic" API endpoint allows attackers to execute arbitrary web scripts or HTML. This could potentially lead to unauthorized actions on behalf of the...
PT-2021-10332
Name of the Vulnerable Software and Affected Versions: Jeesns version 1.4.2 Description: A stored cross-site scripting XSS issue in the "/question/ask" component allows attackers to execute arbitrary web scripts or HTML via a crafted payload in a posted question. Recommendations: For Jeesns versi...
PT-2021-10331
Name of the Vulnerable Software and Affected Versions: Jeesns version 1.4.2 Description: A stored cross-site scripting XSS issue in the /weibo/publishdata component allows attackers to execute arbitrary web scripts or HTML via a crafted payload in a posted Weibo. This can be achieved by exploitin...
CVE-2020-19287: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in the /group/post component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the title...
Konnichiwa! Membership <= 0.8.3 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the planid parameter in the /views/subscriptions.html.php file which allows attackers to inject arbitrary web scripts...
simpleSAMLphp Authentication <= 0.7.0 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /simplesamlphp-authentication.php file which allows attackers to inject arbitrary web scripts...
Twitter Friends Widget <= 3.1 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the pmcTFuser and pmcTFpassword parameter found in the /twitter-friends-widget.php file which allows attackers to inject arbitrary web scripts...
RentPress <= 6.6.4 - Reflected Cross-Site Scripting
The plugin is vulnerable to Reflected Cross-Site Scripting via the selections parameter found in the /src/rentPress/AjaxRequests.php file which allows attackers to inject arbitrary web scripts...
Cross site scripting
The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the /inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names, in versions up to and including 4.14.1...
CVE-2020-18126
Multiple stored cross-site scripting XSS vulnerabilities in the Sections module of Indexhibit 2.1.5 allows attackers to execute arbitrary web scripts or HTML...
