CVE-2022-42236

A Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form...

Cross site scripting

A Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form...

CVE-2022-42236

A Stored XSS issue in Merchandise Online Store v.1.0 allows to injection of Arbitrary JavaScript in edit account form...

CVE-2022-36036: Improper Control of Generation of Code

mdx-mermaid provides plug and play access to Mermaid in MDX. There is a potential for an arbitrary javascript injection in versions less than 1.3.0 and 2.0.0-rc1. Modify any mermaid code blocks with arbitrary code and it will execute when the component is loaded by MDXjs. This vulnerability was...

Argo CD's external URLs for Deployments can include JavaScript

Impact All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to a cross-site scripting XSS bug allowing a malicious user to inject a javascript: link in the UI. When clicked by a victim user, the script will execute with the victim's permissions up to and including admin. The scri...

PT-2022-14052

Name of the Vulnerable Software and Affected Versions WP Simple Adsense Insertion WordPress plugin versions prior to 2.1 Description The issue allows an attacker to trick a logged-in user into manipulating ads and injecting arbitrary javascript via submitting a form, due to the lack of CSRF check...

CVE-2022-1093

The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed...

PT-2022-15435

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server version 11.7 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

PT-2021-22305

Name of the Vulnerable Software and Affected Versions IBM Jazz for Service Management version 1.1.3.10 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted sessio...

CVE-2021-27910: Improper Neutralization of Input During Web Page Generation

Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "errorrelatedto" parameters of the POST request of the bounce management callback will be permanently stored and execute...

CVE-2021-3529

A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text between tags, including potentially a payload script. The input was echoed unmodified in the application response, resulting in arbitrary...

PT-2021-14002

Name of the Vulnerable Software and Affected Versions: IBM Jazz Foundation Products affected versions not specified Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a...

Cross-Site Scripting (XSS)

jinja2 is vulnerable to Cross Site Scripting. An attacker is able to inject and execute arbitrary Javascript through the gettext and ngettext function due to the lack of output sanitization...

PT-2020-13020

Name of the Vulnerable Software and Affected Versions osCommerce CE Phoenix versions prior to 1.0.6.0 Description The issue allows an attacker to inject and execute arbitrary JavaScript code. This can be achieved by injecting malicious code into specific parameters, including the page parameter t...

PT-2020-17982

Name of the Vulnerable Software and Affected Versions IBM DOORS Next Generation DNG/RRC versions 6.0.2 through 6.0.6.1, version 7.0 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials...

Cross-Site Scripting (XSS)

squid is vulnerasble to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the username or auth parameter in cachemgr.cgi...

CVE-2019-18267

An issue was found in GE S2020/S2020G Fast Switch 61850, S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site...

PT-2019-18947

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1 Description The issue allows an unauthenticated user to inject arbitrary JavaScript code due to the sanitization engine ignoring HTML comments. Recommendation...

Cross site scripting

In NCH Express Accounts Accounting v7.02, persistent cross site scripting XSS exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript...

PT-2019-14630

Name of the Vulnerable Software and Affected Versions NCH Express Accounts Accounting version 7.02 Description The issue concerns a persistent cross-site scripting XSS flaw in the input fields for Invoices, Sales Orders, Items, Customers, and Quotes. An authenticated, unprivileged user can modify...