23 matches found
CVE-2026-56128 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...
EUVD-2026-70496
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...
CVE-2026-56127 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...
CVE-2026-56127
pfSense Plus before 26.07 and pfSense CE before 2.9.0 are affected by a stored XSS in /firewall_rules_edit.php. An authenticated user holding the Firewall: Rules: Edit privilege can inject arbitrary JavaScript via the descr parameter. The rule description is persisted in the pfSense XML configura...
PT-2026-85052
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall rules edit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escapin...
CVE-2026-56127: Improper Neutralization of Input During Web Page Generation
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...
CVE-2026-56128: Improper Neutralization of Input During Web Page Generation
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...
CVE-2019-25370
OPNsense 19.1 is affected by a reflected XSS in interfaces_vlan_edit.php. The vulnerability arises from accepting crafted input in multiple parameters (tag, descr, vlanif) via POST, enabling attackers to inject and execute arbitrary JavaScript in users’ browsers. The CVE entry confirms the affect...
PT-2026-8242
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input through multiple parameters. Attackers can send POST requests to interfaces vlan edit.php with script payloads in the tag, descr, or vlanif parameter...
CVE-2024-58304
SPA-CART CMS version 1.9.0.3 (and versions before 2.0.0 ) is vulnerable to a stored cross-site scripting (XSS) flaw in the product description parameter. The root cause is the improper neutralization of input in the descr parameter of the product edit form. This allows authenticated administrator...
CVE-2024-58304: Improper Neutralization of Input During Web Page Generation
SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute...
Cross-site Scripting (XSS)
Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the generateoverlibcontent function, which is accessible through the descr parameter at t...
Cross-site Scripting (XSS)
Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the descr parameter in EditPortsController.php. A user with permission to edit port...
CVE-2024-51494: Improper Neutralization of Input During Web Page Generation
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Port Settings" page allows authenticated users to inject arbitrary JavaScript through the "descr" parameter when editing a device's port settings. This vulnerability...
CVE-2024-52526: Improper Neutralization of Input During Web Page Generation
LibreNMS is an open-source, PHP/MySQL/SNMP-based network monitoring system. A Stored Cross-Site Scripting XSS vulnerability in the "Services" tab of the Device page allows authenticated users to inject arbitrary JavaScript through the "descr" parameter when adding a service to a device. This...
SPA-CART CMS - Stored XSS
Exploit Title: SPA-CART CMS - Stored XSS Date: 2024-01-03 Exploit Author: Eren Sen Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/ Version: 1.9.0.3 CVE-ID: N/A Tested on: Kali Linux / Windows 10 Vulnerabilities Discovered Date : 2024/01/03...
CVE-2021-31558
DIAEnergie Version 1.7.5 and prior is vulnerable to stored cross-site scripting when an unauthenticated user injects arbitrary code into the parameter “descr” of the script “DIAEhierarchyHandler.ashx”...
Delta Electronics DIAEnergie 跨站脚本漏洞
Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.A cross-site...
CVE-2020-19203: Improper Neutralization of Input During Web Page Generation
An authenticated Cross-Site Scripting XSS vulnerability was found in widgets/widgets/wakeonlanwidget.php, a component of the pfSense software WebGUI, on version 2.4.4-p2 and earlier. The widget did not encode the descr description parameter of wake-on-LAN entries in its output, leading to a...
