CVE-2020-13644

The WordPress Accordion plugin (versions

Page Builder: PageLayer - Drag and Drop website builder < 1.1.2 - CSRF leading to XSS

A flaw allowed attackers to forge a request on behalf of a site’s administrator to modify the settings of the plugin which could allow for malicious Javascript injection. PoC...

PT-2020-13634

Name of the Vulnerable Software and Affected Versions Accordion plugin versions prior to 2.2.9 Description An issue in the Accordion plugin for WordPress allows any authenticated user with Subscriber or higher permissions to import a new accordion and inject malicious JavaScript. This is due to t...

Cross site scripting

rConfig 3.9.4 is vulnerable to reflected XSS. The configDevice.php file improperly validates user input. An attacker can exploit this vulnerability by crafting arbitrary JavaScript in the rid GET parameter of devicemgmnt.php...

PT-2020-10414

Name of the Vulnerable Software and Affected Versions Subrion CMS version 4.2.1 Description A remote attacker can inject arbitrary JavaScript code in the vlanguage switch parameter within the "/panel/configuration/general" settings page, which is reflected back within a user's browser without...

cxf: reflected XSS in the services listing page

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploit...

cxf: reflected XSS in the services listing page

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploit...

cxf: reflected XSS in the services listing page

By default, Apache CXF creates a /services page containing a listing of the available endpoint names and addresses. This webpage is vulnerable to a reflected Cross-Site Scripting XSS attack, which allows a malicious actor to inject javascript into the web page. Please note that the attack exploit...

Tecnick.com TCExam Cross-Site Scripting Vulnerability (CNVD-2020-32377)

Tecnick.com TCExam is a Web-based open source e-exam system from Tecnick.com, UK. The system is mainly used for online exams and more. A cross-site scripting vulnerability exists in Tecnick.com TCExam version 14.2.2, which can be exploited by remote attackers to inject malicious JavaScript code...

Cross site scripting

A reflected cross-site scripting XSS vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATHINFO to home.php...

CVE-2020-12679

A reflected cross-site scripting XSS vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remote attackers to inject arbitrary JavaScript and HTML via the PATHINFO to home.php...

CVE-2020-11055: Improper Neutralization of Input During Web Page Generation

In BookStack greater than or equal to 0.18.0 and less than 0.29.2, there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the...

PT-2020-12516

Name of the Vulnerable Software and Affected Versions BookStack versions 0.18.0 through 0.29.1 Description The issue allows a user with permission to create comments to inject custom JavaScript code, which could be executed on other users' machines. This is particularly impactful in scenarios whe...

WordPress data-tables-generator-by-supsystic cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. data-tables-generator-by-supsystic is a data table generator plugin used in it. A security vulnerability exists in WordPress...

Design/Logic Flaw

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

PT-2020-19677

Name of the Vulnerable Software and Affected Versions lazysizes versions through 5.2.0 Description The issue allows execution of malicious JavaScript. The video-embed plugin does not sanitize the following attributes: data-vimeo, data-vimeoparams, data-youtube, and data-ytparams, which can be...

CVE-2020-7642: Improper Neutralization of Input During Web Page Generation

lazysizes through 5.2.0 allows execution of malicious JavaScript. The following attributes are not sanitized by the video-embed plugin: data-vimeo, data-vimeoparams, data-youtube and data-ytparams which can be abused to inject malicious JavaScript...

IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2020-25565)

IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. A cross-site scripting vulnerability exists in IBM Maximo Asset Management versions 7.6.1.0, 7.6.0.10, and 7.6.1.1. A remote attacker can exploit the vulnerability to inject arbitrary...

PT-2020-11057

Name of the Vulnerable Software and Affected Versions IBM Maximo Asset Management version 7.6 Description The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted session...

Siemens Climatix POL908 and POL909 Cross-Site Scripting Vulnerabilities

Siemens Climatix is a standardized and programmable control solution for air conditioning, refrigeration and district heating OEMs from Siemens, Germany, offering a comprehensive HVAC portfolio that can be expanded to meet specific needs.BACnet IP - POL908 is one of the BACnet IP communication...