75409 matches found
CVE-2020-37284
The Sickbeard software, versions through build-507 , is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is the testNaming handler failing to escape the pattern parameter of the /config/postProcessing/testNaming endpoint. Unauthenticated attackers can craft GET r...
EUVD-2020-31287
Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...
CVE-2020-37284 Sickbeard build-507 Reflected XSS via testNaming pattern Parameter
Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...
CVE-2020-37284 Sickbeard build-507 Reflected XSS via testNaming pattern Parameter
Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...
CVE-2017-20288
QCubed versions 2.2.0 through 3.1.1 are vulnerable to a reflected cross-site scripting (XSS) flaw. An unauthenticated attacker can inject malicious scripts by crafting GET requests to the /assets/php/_devtools/installer/step_2.php endpoint, specifically by providing malicious values in the instal...
CVE-2017-20288 QCubed 3.1.1 Reflected XSS via installer step_2.php
QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the installationpath parameter. Attackers can craft GET requests to /assets/php/devtools/installer/step2.php with malicious installationpath values...
CVE-2026-84919
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9...
CVE-2026-84919 PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9...
CVE-2026-84919 PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9...
EUVD-2026-107868
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9...
CVE-2026-84919 PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131
Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Stored XSS. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 5.0.9...
CVE-2026-84919
The Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery module (versions 0.0.0 to 5.0.9 ) is vulnerable to Stored Cross-site Scripting (XSS) . The root cause is the insufficient sanitization of user-supplied input, specifically image alt tags , within the module's dynamic caption script...
CLEANSTART-2026-XC42294 When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression
CVE-2026-94448 affects multiple packages. When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. See references for individual vulnerability details...
EUVD-2026-107663
In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web JavaScript logger endpoint and cause Splunk Web to stop responding to requests. Splunk Web remains unavailable until Splunk Enterprise is restarte...
EUVD-2025-211173
A reflected cross-site scripting XSS vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL...
midgetspy Sickbeard cross-site scripting vulnerability
The midgetspy Sickbeard vulnerability stems from a cross-site scripting flaw. This arises due to improper handling of the “pattern” parameter in /config/postProcessing/testNaming; the testNaming handler fails to escape returned content. As a result, unauthenticated attackers can craft GET request...
PT-2026-121341
Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the pattern parameter of /config/postProcessing/testNaming. Attackers can craft GET requests with malicious SVG onload payloads that the testNaming...
CVE-2025-69723
A reflected cross-site scripting XSS vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL...