280 matches found
Barracuda Message Archiver security vulnerability
Barracuda Message Archiver is an email archiving platform from Barracuda USA. A security vulnerability exists in Barracuda Message Archiver that stems from the error parameter allowing direct writing to JavaScript or HTML, which could lead to a cross-site scripting attack...
CVE-2025-52358
A cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 and below. This issue allows attackers to inject JavaScript payloads within the error or edit-menu-item parameters which are then executed in the victim's brows...
WeGIA Cross-Site Scripting Vulnerability
WeGIA is a web manager for welfare organizations. WeGIA suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the parameter err in the file personalizacao.php, for which no detailed vulnerability details are availab...
CVE-2025-6588 FunnelCockpit <= 1.4.3 - Reflected Cross-Site Scripting via `error` Parameter
The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-6588: Improper Neutralization of Input During Web Page Generation
The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-54078
WeGIA is an open source web manager. A Reflected Cross‑Site Scripting (XSS) vulnerability exists in the personalizacao_imagem.php endpoint, caused by insufficient input filtering/escaping of the err parameter. Affected versions are prior to 3.4.6; version 3.4.6 contains the fix. Impact is XSS exp...
CVE-2025-53820
WeGIA is an open-source web manager for welfare organizations. A reflected Cross‑Site Scripting (XSS) vulnerability exists in the index.php endpoint before version 3.4.5, exploitable via the erro parameter due to insufficient input escaping/validation. Impact is described as user-injected script ...
CVE-2023-44915
A cross-site scripting XSS vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the loginerror parameter...
CVE-2024-44794
A cross-site scripting XSS vulnerability in the component /master/auth/OnedriveRedirect.php of PicUploader commit fcf82ea allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the errordescription parameter...
CVE-2023-46019
Cross Site Scripting XSS vulnerability in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'error' parameter...
CVE-2022-30776
atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter...
CVE-2021-25112
The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting...
CVE-2021-42566
myfactory.FMS before 7.1-912 allows XSS via the Error parameter...
CVE-2021-24196
The Social Slider Widget WordPress plugin before 1.8.5 allowed Authenticated Reflected XSS in the plugin settings page as the ‘tokenerror’ parameter can be controlled by users and it is directly echoed without being sanitized...
CVE-2005-3397
Cross-site scripting XSS vulnerability in Comersus BackOffice allows remote attackers to inject arbitrary web script or HTML via the error parameter to comersusbackofficesupportError.asp. NOTE: the comersusbackofficemessage.asp/message vector is already covered by CVE-2005-2191 item 2...
CVE-2009-1785
Cross-site scripting XSS vulnerability in Ulteo Open Virtual Desktop 1.0 allows remote attackers to inject arbitrary web script or HTML via the error parameter to header.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information...
Better Auth XSS
The vulnerability of the TypeScript-based authentication library Better Auth relates to the lack of measures taken to protect the website structure when processing the error parameter. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
PT-2025-5821
Name of the Vulnerable Software and Affected Versions: better-auth affected versions not specified Description: The better-auth /api/auth/error page is vulnerable to HTML injection, resulting in a reflected cross-site scripting XSS issue. The error URL parameter's value is reflected as HTML on th...
PT-2025-30556
Уязвимость библиотеки аутентификации на языке TypeScript Better Auth связана с непринятием мер по защите структуры веб-страницы при обработке параметра error. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, проводить межсайтовые сценарные атаки...