CVE-2019-1578

Cross-site scripting vulnerability in Palo Alto Networks MineMeld version 0.9.60 and earlier may allow a remote attacker able to convince an authenticated MineMeld admin to type malicious input in the MineMeld UI could execute arbitrary JavaScript code in the admin’s browser...

CVE-2018-20372

TP-Link TD-W8961ND devices allow XSS via the hostname of a DHCP client...

CVE-2019-14792

The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...

CVE-2018-20951

cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config SEC-387...

CVE-2018-20868

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface SEC-464...

CVE-2018-17423

An issue was discovered in e107 v2.1.9. There is a XSS attack on e107admin/comment.php...

CVE-2016-1000237

sanitize-html before 1.4.3 has XSS...

CVE-2017-17972

packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362...

CVE-2019-16148

Sakai through 12.6 allows XSS via a chat user name...

CVE-2015-9434

The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?posttype=kwlogos=kwlogossettings tab or tabflagsorder parameter...

CVE-2018-20558

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/system.php?rec=update has XSS via the sitename parameter...

CVE-2015-1390

Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator...

CVE-2015-9533

The Easy Digital Downloads EDD Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2008-4930

MyBB aka MyBulletinBoard 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences, which allows remote attackers to cause that file to be processed as HTML by Internet Explorer's content inspection, aka "Incomplete protection against MIME-sniffing....

CVE-2024-0852

The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin...

CVE-2024-3901

The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts like those with the contributor role to conduct Stored XSS attacks...

CVE-2024-11719

The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-10076

The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and abo...

CVE-2024-8032

The Smooth Gallery Replacement WordPress plugin (versions 1.0 and earlier ) is vulnerable to a Cross-Site Request Forgery (CSRF) attack due to missing CSRF checks, sanitization, and escaping in certain areas. This flaw could allow an attacker to trick a logged-in administrator into adding Stored ...

CVE-2024-12282

The WordPress连接微博 (wp-connect) plugin, versions 2.5.6 and earlier , is vulnerable to Stored Cross-Site Scripting (XSS) via a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF checks in certain areas, combined with insufficient sanitization and escaping of input data. This...