113 matches found
Linux Distros Unpatched Vulnerability : CVE-2016-2559
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in the format function in libraries/sql- parser/src/Utils/Error.php in the SQL parser in phpMyAdmin 4.5.x before 4.5.5.1...
Linux Distros Unpatched Vulnerability : CVE-2017-6814
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In WordPress before 4.7.3, there is authenticated Cross-Site Scripting XSS via Media File Metadata. This is demonstrated by both 1 mishandling of the playlist...
Drupal GoogleTag Manager module < 1.10.0 - Authenticated Cross Site Scripting (XSS) vulnerability
Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module GoogleTag Manager versions 1.10.0...
CVE-2025-52896 Frappe authenticated XSS via data import
Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting XSS. This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds f...
CVE-2023-47658
Auth. ShopManager+ Stored Cross-Site Scripting XSS vulnerability in actpro Extra Product Options for WooCommerce plugin = 3.0.3 versions...
CVE-2020-13980
OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states "this is not a massive issue as you...
Drupal TacJS module < 6.7.0 - Authenticated Cross Site Scripting (XSS) vulnerability
Authenticated Cross Site Scripting XSS vulnerability discovered by Pierre Rudloff prudloff in WordPress Module TacJS versions 6.7.0...
ABB Cylon Aspect 3.08.02 (tscConfiguration.php) Authenticated Reflected XSS
Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an authenticated reflected...
PT-2024-8350 · Palo Alto Networks · Pan-Os
Palo Alto Networks PAN-OS software is affected by a cross-site scripting XSS issue, which allows an authenticated read-write Panorama administrator to push a specially crafted configuration to a PAN-OS node. This enables impersonation of a legitimate PAN-OS administrator, who can perform restrict...
Exploit for Cross-site Scripting in Salesagility Suitecrm
CVE-2024-50335: Authenticated XSS in "Publish Key" Field Allow...
WordPress Expert Invoice plugin <= 1.0.2 - Authenticated Stored Cross-Site Scripting vulnerability
Authenticated Stored Cross-Site Scripting vulnerability discovered by Guido Iván García Duva in WordPress Plugin Expert Invoice versions = 1.0.2...
BIT-WORDPRESS-2020-4046 Authenticated XSS through embed block in WordPress
In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...
PT-2023-27505 · Unknown · Gurcharan Singh Fitness Calculators Plugin
Name of the Vulnerable Software and Affected Versions: Gurcharan Singh Fitness calculators plugin plugin versions 2.0.7 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject...
CVE-2023-32575
CVE-2023-32575 concerns the WordPress plugin “Product page shipping calculator for WooCommerce” (WooCommerce extension by PI Websolution). Affected versions are
PT-2023-19359 · Wpazure Themes · Wpazure Themes Upfrontwp
Name of the Vulnerable Software and Affected Versions: Wpazure Themes Upfrontwp theme versions = 1.1 Description: The issue is related to an Authenticated Reflected Cross-site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into the website, whi...
PT-2023-24297 · WordPress · Hijiri Custom Post Type Generator
Name of the Vulnerable Software and Affected Versions: Hijiri Custom Post Type Generator plugin versions = 2.4.2 Description: The issue is related to an Authenticated Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker could potentially inject malicious scripts into the...
Vulnerabilities fixed in SolarWinds Platform
Solarwinds has fixed vulnerabilities in Solarwinds Platform and the Database Performance Analyzer DPA. A pre-authenticated malicious person can exploit the vulnerabilities exploit them for attacks that can result in the following categories of damage: Cross-Site Scripting XSS. Remote code executi...
PT-2023-18625 · Altanic · Altanic No Api Amazon Affiliate Plugin
Name of the Vulnerable Software and Affected Versions: Altanic No API Amazon Affiliate plugin versions = 4.2.2 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scripts into the...
