875 matches found
GHSA-C8J6-GQQ8-4PRJ Alkacon OpenCMS XSS via New User module
Alkacon OpenCMS v10.5.4 and before is affected by stored cross site scripting XSS in the module New User /opencms/system/workplace/admin/accounts/usernew.jsp. This allows an attacker to insert arbitrary JavaScript as user input First Name or Last Name, which will be executed whenever the affected...
Cross-site Scripting (XSS)
Overview web-tp3/wecmap is a WEC Google Maps. Affected versions of this package are vulnerable to Cross-site Scripting XSS via unspecified vectors. An attacker can inject arbitrary web script or HTML by crafting malicious input. Details Cross-site scripting or XSS is a code vulnerability that...
GHSA-74C7-R9M3-HVJ4 Dolibarr cross-site scripting (XSS) vulnerability
Multiple cross-site scripting XSS vulnerabilities in Dolibarr ERP/CRM 6.0.0 allow remote authenticated users to inject arbitrary web script or HTML via the 1 CompanyName, 2 CompanyAddress, 3 CompanyZip, 4 CompanyTown, 5 Fax, 6 EMail, 7 Web, 8 ManagingDirectors, 9 Note, 10 Capital, 11 ProfId1, 12...
Withdrawn Advisory: Apache Struts XSS
Withdrawn Advisory This advisory has been withdrawn because it was deemed invalid. This link is maintained to preserve external references. Original Description Multiple cross-site scripting XSS vulnerabilities in Apache Struts 1.3.10 allow remote attackers to inject arbitrary web script or HTML...
Jenkins allows Cross-Site Scripting (XSS)
Cross-site scripting XSS vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via...
YUI Cross-site Scripting (XSS) vulnerability
Cross-site scripting XSS vulnerability in io.swf in the IO Utility component in Yahoo! YUI 3.10.2, as used in Moodle through 2.1.10, 2.2.x before 2.2.11, 2.3.x before 2.3.8, 2.4.x before 2.4.5, 2.5.x before 2.5.1, and other products, allows remote attackers to inject arbitrary web script or HTML...
GHSA-G4FC-J79Q-GJRH Alkacon OpenCms XSS via username during login
Cross-site scripting XSS vulnerability in Alkacon OpenCms before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via the username in the login page...
CVE-2022-27436
A cross-site scripting XSS vulnerability in /public/admin/index.php?adduser at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field...
CVE-2021-20729
Cross-site scripting vulnerability in pfSense CE and pfSense Plus pfSense CE software versions 2.5.2 and earlier, and pfSense Plus software versions 21.05 and earlier allows a remote attacker to inject an arbitrary script via a malicious URL...
PT-2022-18454
Name of the Vulnerable Software and Affected Versions Zero-channel BBS Plus versions 0.7.4 and earlier Description A cross-site scripting issue allows a remote attacker to inject an arbitrary script via unspecified vectors. Recommendations For Zero-channel BBS Plus versions 0.7.4 and earlier, at...
PT-2022-9194
Name of the Vulnerable Software and Affected Versions pfSense CE versions 2.5.2 and earlier pfSense Plus versions 21.05 and earlier Description A cross-site scripting issue allows a remote attacker to inject an arbitrary script via a malicious URL. This enables the attacker to execute unauthorize...
CVE-2022-27496: Improper Neutralization of Input During Web Page Generation
Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors...
D-Link DSL-2760U Gateway Cross-Site Scripting Vulnerability
A cross-site scripting XSS vulnerability exists in the D-Link DSL-2760U gateway, allowing remote authenticated users to inject arbitrary web script or HTML...
CVE-2022-25305
The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the /includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site...
PT-2022-16695
Name of the Vulnerable Software and Affected Versions phpUploader versions 1.2 and earlier Description A cross-site scripting issue allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors. Recommendations For phpUploader versions 1.2 and earlier, at the...
CVE-2021-20877
Cross-site scripting vulnerability in Canon laser printers and small office multifunctional printers LBP162L/LBP162, MF4890dw, MF269dw/MF265dw/MF264dw/MF262dw, MF249dw/MF245dw/MF244dw/MF242dw/MF232w, and MF229dw/MF224dw/MF222dw sold in Japan, imageCLASS MF Series...
CVE-2022-22146
Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors...
PT-2022-15273
Name of the Vulnerable Software and Affected Versions TransmitMail versions 2.5.0 through 2.6.1 Description A cross-site scripting issue allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors. Recommendations For TransmitMail versions 2.5.0 through 2.6.1,...
PT-2022-15137
Name of the Vulnerable Software and Affected Versions ELECOM LAN router WRC-300FEBK-R versions 1.13 and earlier Description A cross-site scripting issue allows an attacker on the adjacent network to inject an arbitrary script via unspecified vectors. This can be exploited by an attacker to inject...