CVE-2021-34642

The CVE-2021-34642 entry concerns the WordPress Smart Email Alerts plugin (versions up to 1.0.10) vulnerable to Reflected Cross-Site Scripting via the api_key in ~/views/settings.php. The underlying issue allows injection of arbitrary scripts, with network access and user interaction required (CV...

CVE-2021-34644 Multiplayer Games <= 3.7 Reflected Cross-Site Scripting

The Multiplayer Games WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /multiplayergames.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.7...

CVE-2021-34643 Skaut bazar <= 1.3.2 Reflected Cross-Site Scripting

The Skaut bazar WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /skaut-bazar.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.3.2...

SP Project & Document Manager < 4.26 - Reflected Cross-Site Scripting

The plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the /functions.php file which allows attackers to inject arbitrary web scripts PoC https://example.com/wp-admin/admin.php?page=sp-client-document-manager=" style=animation-name:rotation...

Media Usage <= 0.0.4 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the /mmuadmin.php file which allows attackers to inject arbitrary web scripts...

Scribble Maps <= 1.2 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the map parameter in the /includes/admin.php file which allows attackers to inject arbitrary web scripts...

Simple Popup Newsletter <= 1.4.7 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /simple-popup-newsletter.php file which allows attackers to inject arbitrary web scripts...

TypoFR <= 0.11 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the text function found in the /vendor/OrgHeigl/Hyphenator/index.php file which allows attackers to inject arbitrary web scripts...

2Way VideoCalls and Random Chat < 5.2.8 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting via the vwsnotice AJAX action found in the /inc/requirements.php file which allows attackers to inject arbitrary web scripts...

CVE-2020-20990

A cross site scripting XSS vulnerability in the /segments/edit.php component of Domainmod 4.13 allows attackers to execute arbitrary web scripts or HTML via the Segment Name parameter...

CVE-2020-20977

A stored cross site scripting XSS vulnerability in index.php/legend/6.html of UK CMS v1.1.10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Comments section...

EyouCms Cross-Site Scripting Vulnerability

EyouCms EyouCms is a ThinkPHP-based open source content management system CMS from Hainan Zanzan Network Technology Co. An attacker can use the vulnerability to execute arbitrary web scripts or HTML...

Eyoucms Cross-Site Scripting Vulnerability (CNVD-2022-13194)

Zanzan Network Technology EyouCms EyouCms is a ThinkPHP-based open source content management system CMS from Zanzan Network Technology in China. version v1.4.1 of Eyoucms has a security vulnerability. An attacker can use the vulnerability to execute arbitrary web scripts or HTML...

CVE-2021-34640 Securimage-WP-Fixed <= 3.5.4 Reflected Cross-Site Scripting

The Securimage-WP-Fixed WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /securimage-wp.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.5.4...

Cross site scripting

A stored cross site scripting XSS vulnerability in the webattr2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML...

Cross site scripting

A stored cross site scripting XSS vulnerability in the webcopyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML...

CVE-2020-21930

A stored cross site scripting XSS vulnerability in the webattr2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML...

CVE-2020-21929

A stored cross site scripting XSS vulnerability in the webcopyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML...

CVE-2018-17861

A cross-site scripting XSS vulnerability in SAP J2EE Engine/7.01/Portal/EPP allows remote attackers to inject arbitrary web script via the wsdlLib parameter to /ctcprotocol/Protocol. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

Cross site scripting

UNSUPPORTED WHEN ASSIGNED A cross-site scripting XSS vulnerability in SAP J2EE Engine 7.01 allows remote attackers to inject arbitrary web script via the wsdlPath parameter to /ctcprotocol/Protocol. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...