Design/Logic Flaw

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/boardformupdate.php bomobilecontenthead parameter...

CVE-2018-18672

GNUBOARD5 5.3.1.9 contains an XSS vulnerability in the adm/board_form_update.php endpoint via the board head contents (bo_content_head) parameter, allowing remote script execution in a victim’s browser. The issue is confirmed across multiple sources (Red Hat, CNVD, NVD, osv) and is tied to GNUBOA...

CVE-2018-18670

CVE-2018-18670 affects GNUBOARD5 version 5.3.1.9, where an XSS vulnerability exists allowing remote attackers to inject arbitrary web script or HTML via the "Extra Contents" parameter (also identified as the adm/config_form_update.php cf_1~10 parameter). The issue stems from insufficient validati...

CVE-2018-18671

GNUBOARD5 5.3.1.9 has XSS that allows remote attackers to inject arbitrary web script or HTML via the "mobile board head contents" parameter, aka the adm/boardformupdate.php bomobilecontenthead parameter...

XSS Vulnerability in UQCMS Single Merchant System

UQCMS Single Merchant System is an external display and shopping system suitable for running your own products. UQCMS Single Merchant System suffers from an XSS vulnerability, which can be exploited by attackers to inject arbitrary Web script or HTML...

CVE-2019-1010113: Improper Neutralization of Input During Web Page Generation

Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting XSS. The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a lin...

CVE-2019-12834

In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATHINFO to the dashboards/ URI...

CVE-2019-12834

In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATHINFO to the dashboards/ URI...

CVE-2019-12834: Improper Neutralization of Input During Web Page Generation

In HT2 Labs Learning Locker 3.15.1, it's possible to inject malicious HTML and JavaScript code into the DOM of the website via the PATHINFO to the dashboards/ URI...

PT-2019-12974

Name of the Vulnerable Software and Affected Versions HT2 Labs Learning Locker version 3.15.1 Description The issue allows for the injection of malicious HTML and JavaScript code into the website's DOM via the PATH INFO to the "dashboards/" URI. Recommendations For HT2 Labs Learning Locker versio...

CVE-2019-10346

A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin...

CVE-2019-10349

A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins...

CVE-2019-10346: Improper Neutralization of Input During Web Page Generation

A reflected cross site scripting vulnerability in Jenkins Embeddable Build Status Plugin 2.0.1 and earlier allowed attackers inject arbitrary HTML and JavaScript into the response of this plugin...

CVE-2019-10349: Improper Neutralization of Input During Web Page Generation

A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins...

Cross site scripting

A Cross Site Scripting XSS vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msg...

Cross-Site Scripting (XSS)

GROWI are vulnerable to cross-site scripting attacks. A remote, authenticated attacker could exploit the flawed New Page Handler component to inject and execute arbitrary web script or HTML into victim's browser...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2019-22260)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2019-13478

The Yoast SEO plugin before 11.6-RC5 for WordPress does not properly restrict unfiltered HTML in term descriptions...

CVE-2019-12930

A cross-site scripting XSS vulnerability in noMenu and noSubMenu in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows remote attackers to inject arbitrary web script or HTML via the method parameter...

CVE-2019-5970

The CVE-2019-5970 entry applies to WordPress Plugin Attendance Manager (versions ≤ 0.5.6). The vulnerability is a Self-reported Stored Cross-Site Scripting (CWE-79) in which an attacker can inject arbitrary script/HTML via unspecified vectors, potentially executing code in the administrator’s bro...