CVE-2021-32853: Improper Neutralization of Input During Web Page Generation

Erxes, an experience operating system XOS with a set of plugins, is vulnerable to cross-site scripting in versions 0.22.3 and prior. This results in client-side code execution. The victim must follow a malicious link or be redirected there from malicious web site. There are no known patches...

CVE-2022-42967

Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code execution...

Design/Logic Flaw

Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code execution...

CVE-2022-42967

Caret is affected by an XSS vulnerability in the Markdown preview mode that allows client-side code execution when a crafted Markdown file is opened. The issue is described across multiple sources as an XSS in Caret’s Markdown viewer, with impact on confidentiality, integrity, and availability of...

CVE-2022-42967: Improper Neutralization of Input During Web Page Generation

Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code execution...

Multiple XSS Vulnerabilities in Queue Condition

Description Cross-Site Scripting XSS vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request that, if issued by another application user, will cause JavaScript code...

@appsocially/timepassport (>=0.1.2-0.1, <=0.1.29), @becompliancebr/shared-components (>=1.0.0, <=1.10.0) +80 more potentially affected by CVE-2022-25873 via vuetify (>=2.0.0, <=2.6.9)

vuetify NPM version =2.0.0, =0.1.2-0.1, =1.0.0, =1.2.5-1, =5.0.1-beta.0, =0.0.128-beta.33, =0.0.101-beta.22, =0.0.132-alpha.448, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.132-alpha.448, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.132-beta.446 and more Source cves:...

CVE-2022-35554

Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at client side...

CVE-2022-24692: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The new menu option within the general Parameters page is vulnerable to stored XSS. The attacker can create a menu option, make it visible to every application user, and conduct session hijacking, account takeover, or malicious code...

PT-2022-15892

Name of the Vulnerable Software and Affected Versions Sysaid version 14.2.0 Description The parameter helpPageName used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting issue. To exploit this, the affected product must expose the Offline Help Pages. An attacker ma...

PT-2022-16486

Name of the Vulnerable Software and Affected Versions QingScan version 1.3.0 Description The issue is related to a Cross Site Scripting XSS vulnerability that affects all search functions. This means an attacker could potentially inject malicious scripts into the search functionality of the...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-22704)

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications. cross-site scripting vulnerabilities exist ...

Pimcore Cross-Site Scripting Vulnerability (CNVD-2022-22703)

Pimcore is an open source Web content management platform for creating and managing Web applications from the Austrian company Pimcore. The platform integrates Web content management, e-commerce framework and product information management applications. cross-site scripting vulnerability exists i...

Car Driving School Management System Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability exists in Car Driving School Management System, a driving school management system, which stems from the fact that the product's User Enrollment Form does not effectively filter user input data and can be exploited by attackers to The vulnerability causes...

WordPress Dynamic Widgets plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Dynamic Widgets plugin prior to version 1.5.16,...

Taocms Cross-Site Scripting Vulnerability (CNVD-2022-11522)

Taocms is a micro Cms content management system in China. Taocms suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data in the WEB application, which can be exploited by attackers to execute client-side code...

DayByDay CRM Cross-Site Scripting Vulnerability (CNVD-2022-68549)

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. A cross-site scripting vulnerability exists in DayByDay CRM. The vulnerability stems from the title field of a new task in the product...

WordPress plugin Wappointment cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Wappointment. The vulnerability...

WordPress Cross-Site Scripting Vulnerability (CNVD-2021-100246)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in Wordpress Plugin Events Manager, which stems from the...

Acronis Cyber Protect 15 Cross-Site Scripting Vulnerability (CNVD-2021-100276)

Acronis Cyber Protect is an application. Provides unified protection for your network by integrating backup, disaster recovery, artificial intelligence-based malware protection, remote assistance and security into a single, reliable tool. Acronis Cyber Protect 15 suffers from a cross-site scripti...