CVE-2020-28919

A stored cross site scripting XSS vulnerability in Checkmk 1.6.0x prior to 1.6.0p19 allows an authenticated remote attacker to inject arbitrary JavaScript via a javascript: URL in a view title...

PT-2022-1620

Name of the Vulnerable Software and Affected Versions FUDforum affected versions not specified Description The issue is related to the lack of protection of the web page structure in FUDforum. It allows a remote attacker to execute arbitrary code when an administrator reads a message, and inject...

CVE-2022-22125

In Halo, versions v1.0.0 to v1.4.17 latest are vulnerable to Stored Cross-Site Scripting XSS in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server...

CVE-2022-22125: Improper Neutralization of Input During Web Page Generation

In Halo, versions v1.0.0 to v1.4.17 latest are vulnerable to Stored Cross-Site Scripting XSS in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server...

Hospitals Patient Records Management System 1.0 - (room_list) Stored XSS Vulnerability

Exploit Title: Hospitals Patient Records Management System 1.0 - 'roomlist' Stored Cross Site Scripting XSS Exploit Author: Sant268 Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Hospitals Patient Records Management System 1.0 Cross Site Scripting

Exploit Title: Hospitals Patient Records Management System 1.0 - 'doctors' Stored Cross Site Scripting XSS Exploit Author: Sant268 Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

WordPress 5.8.2 Stored XSS Vulnerability

WordPress is the world’s most popular content management system that, according to w3techs, is used by over 40% of all websites. This wide adoption makes it a top target for cyber criminals who seek to compromise high-traffic websites or infect as many web servers as possible. Its code is heavily...

Cross-site Scripting (XSS)

mvcbean-jsp-portlet-archetype is vulnerable to cross-site scripting. The library does not properly escape the user input firstName and lastName parameters in greeting.jspx, allowing an attacker to inject and execute malicious javascript...

PT-2022-15253

Name of the Vulnerable Software and Affected Versions Directus versions 9.0.0-alpha.4 through 9.4.1 Description The issue is related to a stored Cross-Site Scripting XSS vulnerability via SVG file upload in the media upload functionality. A low-privileged attacker can inject arbitrary JavaScript...

CVE-2022-22116: Improper Neutralization of Input During Web Page Generation

In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting XSS vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image...

CVE-2021-43942

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting XSS vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting...

CVE-2021-43942: Improper Neutralization of Input During Web Page Generation

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting XSS vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting...

OroPlatform 注入漏洞

OroPlatform is a PHP Business Application Platform BAP designed to make the development of custom business applications easier and faster. OroPlatform suffers from a security vulnerability that stems from the software's lack of effective filtering and escaping of JavaScript attributes. By sending...

PT-2022-12419

Name of the Vulnerable Software and Affected Versions Web Viewer for Hanwha DVR version 2.17 Description The issue allows an attacker to inject malicious JavaScript codes due to a Cross Site Scripting XSS vulnerability. Recommendations For Web Viewer for Hanwha DVR version 2.17, consider disablin...

Cross-site Scripting (XSS) - Stored in zikula/core

Description When inputting a name for a module category whether editing an existing one or adding a new one, you're able to inject your own Javascript, leading to it being executed. An example payload that you can enter is: xss and then each time that you click the category to expand it, your...

PT-2021-22304

Name of the Vulnerable Software and Affected Versions IBM i versions 7.2 through 7.4 Description This issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session. Recommendation...

CVE-2021-45812

NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting XSS vulnerability. An attacker can steal the user's session by injecting malicious JavaScript codes which leads to session hijacking...

Cross site scripting

A persistent cross-site scripting XSS issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268...

PT-2021-22335

Name of the Vulnerable Software and Affected Versions IBM OPENBMC OP910 affected versions not specified Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

CVE-2021-38966

IBM Cloud Pak for Automation 21.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212357...