CVE-2023-44216

PVRIC PowerVR Image Compression on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origin pixel-stealing attacks against feTurbulence and feBlend in the SVG Filter specification, aka a GPU.zip issue. For example, attackers can sometimes accurately...

CVE-2023-47811

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin = 1.0.5 versions...

CVE-2023-26291

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Forcepoint Cloud Security Gateway CSG Portal on Web Cloud Security Gateway, Email Security Cloud loginform.mhtml modules, Forcepoint Web Security Portal on Hybrid loginform.mhtml modules allows...

CVE-2023-26290

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Forcepoint Cloud Security Gateway CSG Portal on Web Cloud Security Gateway, Email Security Cloud loginresetrequest.mhtml modules, Forcepoint Web Security Portal on Hybrid loginresetrequest.mhtml...

CVE-2023-26292

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Forcepoint Cloud Security Gateway CSG Portal on Web Cloud Security Gateway, Email Security Cloud loginsubmit.mhtml modules, Forcepoint Web Security Portal on Hybrid loginsubmit.mhtml modules allows...

CVE-2023-45053

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in pluginever WP Content Pilot – Autoblogging & Affiliate Marketing Plugin allows Code Injection.This issue affects WP Content Pilot – Autoblogging & Affiliate Marketing Plugin: from n/a through 1.3.3...

CVE-2023-24352

D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWPS...

CVE-2023-27489

Kiwi TCMS is an open source test management system for both manual and automated testing. Kiwi TCMS accepts SVG files uploaded by users which could potentially contain JavaScript code. If SVG images are viewed directly, i.e. not rendered in an HTML page, this JavaScript code could execute. This...

CVE-2023-50874

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS.This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a through 6.1.0.1...

CVE-2023-23597

A compromised web child process could disable web security opening restrictions, leading to a new child process being spawned within the file:// context. Given a reliable exploit primitive, this new process could be exploited again leading to arbitrary file read. This vulnerability affects Firefo...

CVE-2023-51548

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Neil Gee SlickNav Mobile Menu allows Stored XSS.This issue affects SlickNav Mobile Menu: from n/a through 1.9.2...

CVE-2023-47768

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Russell Jamieson Footer Putter plugin = 1.17 versions...

CVE-2023-47755

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AazzTech WooCommerce Product Carousel Slider plugin = 3.3.5 versions...

CVE-2023-47810

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Asdqwe Dev Ajax Domain Checker plugin = 1.3.0 versions...

CVE-2022-26114

An improper neutralization of input during web page generation vulnerability CWE-79 in the Webmail of FortiMail before 7.2.0 may allow an unauthenticated attacker to trigger a cross-site scripting XSS attack via sending specially crafted mail messages...

The vulnerability of the /adv_arpspoofing.php file, a component of the ARP Spoofing Prevention software for D-Link DAP-2695 wireless access points, allows attackers to execute cross-site scripting attacks.

The vulnerability of the /advarpspoofing.php file, a component of the ARP Spoofing Prevention software for D-Link DAP-2695 wireless access points, is related to the lack of security measures for the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site...

PT-2025-22788 · Unknown · Catkin Redi Restaurant Reservation

Name of the Vulnerable Software and Affected Versions: catkin ReDi Restaurant Reservation versions n/a through 24.1209 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means tha...

CVE-2022-3245

HTML injection attack is closely related to Cross-site Scripting XSS. HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input...

CVE-2021-38555

An XML external entity XXE injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions 2.5. XML external entity injection also known as XXE is a web security vulnerability that allows an attacker to interfere with an application's processing of...

CVE-2021-32503

Unauthenticated users can access sensitive web URLs through GET request, which should be restricted to maintenance users only. A malicious attacker could use this sensitive information’s to launch further attacks on the system...