CVE-2025-5983: Undefined Security Weakness

The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags...

PT-2025-43021

Name of the Vulnerable Software and Affected Versions Meta Tag Manager WordPress plugin versions prior to 3.3 Description The Meta Tag Manager WordPress plugin does not properly limit which user roles are permitted to create http-equiv refresh meta tags. This could allow unauthorized users to...

CVE-2018-18499

A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries. This is a same-origin policy violation and could allow for data theft. This vulnerability affects...

CVE-2018-19516

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

CVE-2018-19516

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

CVE-2018-19516

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

CVE-2018-19516: Improper Input Validation

messagepartthemes/default/defaultrenderer.cpp in messagelib in KDE Applications before 18.12.0 does not properly restrict the handling of an http-equiv="REFRESH" value...

CVE-2018-18499

A same-origin policy violation allowing the theft of cross-origin URL entries when using a meta http-equiv="refresh" on a page to cause a redirection to another site using performance.getEntries. This is a same-origin policy violation and could allow for data theft. This vulnerability affects...

PT-2020-8646

Name of the Vulnerable Software and Affected Versions: KDE Applications versions prior to 18.12.0 Description: The issue arises from the improper restriction of handling an http-equiv="REFRESH" value in the messagepartthemes/default/defaultrenderer.cpp file within messagelib in KDE Applications...

CVE-2014-4908

Multiple cross-site scripting XSS vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching 1 share/pnp/application/views/kohanaerrorpage.php or 2 share/pnp/application/views/template.php, leading to improper handling...

CVE-2014-4908

CVE-2014-4908 is a cross-site scripting vulnerability in PNP4Nagios up to version 0.6.22. The issue enables an attacker to inject script/HTML via URI handling for two PHP views, due to improper handling of an http-equiv="refresh" META element. Connected documents confirm related CVE-2014-4907 and...

PT-2014-6209

Name of the Vulnerable Software and Affected Versions PNP4Nagios versions prior to 0.6.23 Description The issue allows remote attackers to inject arbitrary web script or HTML via specific URI paths, including "share/pnp/application/views/kohana error page.php" and...

CVE-2014-4908: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in PNP4Nagios through 0.6.22 allow remote attackers to inject arbitrary web script or HTML via the URI used for reaching 1 share/pnp/application/views/kohanaerrorpage.php or 2 share/pnp/application/views/template.php, leading to improper handling...

CVE-2012-2585

Multiple cross-site scripting XSS vulnerabilities in ManageEngine ServiceDesk Plus 8.1 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with 1 a SCRIPT element, 2 a crafted Cascading Style Sheets CSS expression property, 3 a CSS expression property in the...

Code injection

Google Desktop allows user-assisted remote attackers to execute arbitrary programs via a man-in-the-middle attack that injects JavaScript, a www.google.com search IFRAME, and a META HTTP-EQUIV="refresh" that targets a www.google.com search for a local .exe file, which is displayed in the "results...

CVE-2007-3150: Undefined Security Weakness

Google Desktop allows user-assisted remote attackers to execute arbitrary programs via a man-in-the-middle attack that injects JavaScript, a www.google.com search IFRAME, and a META HTTP-EQUIV="refresh" that targets a www.google.com search for a local .exe file, which is displayed in the "results...

CVE-2002-2169: Undefined Security Weakness

Cross-site scripting vulnerability AOL Instant Messenger AIM 4.5 and 4.7 for MacOS and Windows allows remote attackers to conduct unauthorized activities, such as adding buddies and groups to a user's buddy list, via a URL with a META HTTP-EQUIV="refresh" tag to an aim: URL...