WordPress AdRotate plugin cross-site scripting vulnerability (CNVD-2022-59803)

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plug-in. Cross-site scripting vulnerabilities exist in versions of WordPress AdRotate plugin prior to 5.8.23. The...

Shopizer Cross-Site Scripting Vulnerability (CNVD-2022-70092)

Shopizer is a Java-based e-commerce solution from the Shopizer team. 2.0 to 2.17.0 versions of Shopizer are vulnerable to a cross-site scripting vulnerability in which the file name under the "Manage Files" tab lacks validation filters for user-supplied and output data. An attacker could use this...

Remote code execution

An issue was discovered in the Sametime chat feature in the Notes 11.0 - 11.0.1 FP4 clients. An authenticated Sametime chat user could cause Remote Code Execution on another chat client by sending a specially formatted message through chat containing Javascript code...

CVE-2022-1464

Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...

JetBrains IntelliJ IDEA Cross-Site Scripting Vulnerability

JetBrains IntelliJ IDEA is a set of integrated development environments for the Java language from Jetbrains Czech Republic.A cross-site scripting vulnerability exists in versions prior to JetBrains IntelliJ IDEA 2022.1, which stems from an error message in the internal web server that lacks a...

IBM InfoSphere Information Server Cross-Site Scripting Vulnerability (CNVD-2022-66262)

IBM InfoSphere Information Server is a set of data integration platforms from IBM in the United States. The platform can be used to integrate data information obtained from various sources. A cross-site scripting vulnerability exists in IBM InfoSphere Information Server version 11.7, which can be...

IBM InfoSphere Information Server Cross-Site Scripting Vulnerability (CNVD-2022-38556)

IBM InfoSphere Information Server is a data integration platform from IBM in the United States. IBM InfoSphere Information Server version 11.7 contains a cross-site scripting vulnerability. The vulnerability stems from the program's lack of data validation filtering of user-supplied data and...

CVE-2022-1464: Improper Neutralization of Input During Web Page Generation

Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...

PT-2022-13955

Name of the Vulnerable Software and Affected Versions microweber versions prior to 1.2.16 Description The issue allows for DOM XSS, enabling the injection of arbitrary JavaScript code, which can lead to defacement of a website or stealing cookies. The software in question is a drag and drop websi...

WordPress Stafflist 3.1.2 Cross Site Scripting Vulnerability

Exploit Title: WordPress Plugin stafflist 3.1.2 - Reflected XSS Authenticated Exploit Author: Hassan Khan Yusufzai - Splint3r7 Vendor Homepage: https://wordpress.org/plugins/stafflist/ Version: 3.1.2 Tested on: Firefox Contact me: h at spidersilk.com Summary: A cross site scripting reflected...

PT-2022-13983

Name of the Vulnerable Software and Affected Versions microweber versions prior to 1.2.16 Description The issue is related to a reflected cross-site scripting XSS flaw. This flaw allows an attacker to execute JavaScript code as the victim, potentially leading to unauthorized actions on the victim...

CVE-2021-31674

Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant...

Input validation

Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant...

CVE-2021-31674

Cyclos 4 PRO 4.14.7 and before does not validate user input at error inform, which allows remote unauthenticated attacker to execute javascript code via undefine enum constant...

OWASP ESAPI Cross-Site Scripting Vulnerability

OWASP ESAPI is a free, open source, web application security control library that makes it easier for programmers to write lower-risk applications. cross-site scripting vulnerabilities exist in versions of OWASP ESAPI prior to 2.3.0.0, which originate from the " onsiteURL" regular expression erro...

CVE-2022-22427

IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 223720...

CVE-2021-43932

Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page...

CVE-2021-43932 Elcomplus SmartPtt Cross-site Scripting

Elcomplus SmartPTT is vulnerable when an attacker injects JavaScript code into a specific parameter that can executed upon accessing the dashboard or the main page...

CVE-2021-43932

CVE-2021-43932 affects Elcomplus SmartPTT SCADA Server (notably SmartPTT SCADA Server v1.4) where an attacker can inject JavaScript into a parameter that executes when accessing the dashboard or main page. Root cause: CWE-79 (Cross‑Site Scripting) due to improper input neutralization. Impact per ...

Cross-site scripting - Stored via upload ".msg" file

Description When user upload file with .msg extension in white-list, but when access this file, server not reponse with Content-type header, so this file can execute javascript code as Content-type: text/html Proof of Concept POST /microweber/plupload HTTP/1.1 Host: localhost User-Agent:...