175140 matches found
CVE-2019-20075
On Netis DL4323 devices, pingrttv6.html has XSS Ping6 Diagnostic...
CVE-2019-20336
In PHP Scripts Mall advanced-real-estate-script 4.0.9, the search-results.php searchtext parameter is vulnerable to XSS...
CVE-2019-20220
In Support Incident Tracker SiT! 3.67, the searchid parameter in the searchincidentsadvanced.php page is affected by XSS...
CVE-2019-20389
An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the vlanguageswitch parameter within multipart/form-data, which is reflected back within a user's browser without proper output encoding...
CVE-2019-20527
Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter...
CVE-2019-20365
An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page...
CVE-2019-20222
In Support Incident Tracker SiT! 3.67, the Short Application Name and Application Name inputs in the config.php page are affected by XSS...
CVE-2019-20141
An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter...
CVE-2011-0544
phpbb 3.0.x-3.0.6 has an XSS vulnerability via the flash BB tag...
CVE-2020-7996
htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header...
CVE-2020-7989
Adive Framework 2.0.8 has admin/user/add userUsername XSS...
CVE-2020-7482
A CWE-79:Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists Andover Continuum All versions, which could cause a Reflective Cross-site Scripting XSS attack when using the products' web server...
CVE-2020-7470
Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field after a successful login with the Web Admin Password...
CVE-2020-7236
UHP UHP-100 3.4.1.15, 3.4.2.4, and 3.4.3 devices allow XSS via cw2?td= Site Name field of the Site Setup section...
CVE-2020-7249
SMC D3G0804W 3.5.2.5-LATGA devices allow XSS via the SSID field on the WiFi Network Configuration page after a successful login to the admin account...
CVE-2020-12707
An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements...
CVE-2020-12635
XSS exists in the WebForms Pro M2 extension before 2.9.17 for Magento 2 via the textarea field...
CVE-2020-12882
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated by an attack by a Student against a Teaching Fellow...