PT-2024-34314

Name of the Vulnerable Software and Affected Versions: Intuitive Design GDReseller versions n/a through 1.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This means that an attacker cou...

PT-2024-35007

Name of the Vulnerable Software and Affected Versions SV Forms versions n/a through 2.0.05 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This enables potential attackers to inject...

PT-2024-34297

Name of the Vulnerable Software and Affected Versions: Ancient World Linked Data versions 0.2.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This means that the software do...

PT-2024-35048

Name of the Vulnerable Software and Affected Versions Multifox Plus versions 1.1.6 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This enables potential attackers to execute...

PT-2024-34940

Name of the Vulnerable Software and Affected Versions Anant Addons for Elementor versions 1.0.0 through 1.0.5 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for DOM-Based XSS, which can be exploited ...

PT-2024-34292

Name of the Vulnerable Software and Affected Versions: Adam Skaat Countdown & Clock versions through 2.8.0.9 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-34976

Name of the Vulnerable Software and Affected Versions Digital Zoom Studio Parallaxer versions n/a through 1.00 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can...

PT-2024-34928

Name of the Vulnerable Software and Affected Versions Bread & Butter versions n/a through 7.4.857 Description The issue is related to improper neutralization of input during web page generation, which allows DOM-Based XSS. This means that an attacker could potentially inject malicious scripts int...

PT-2024-35060

Name of the Vulnerable Software and Affected Versions Jakir Hasan Blocks Post Grid versions 1.0.3 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject...

PT-2024-34930

Name of the Vulnerable Software and Affected Versions Moka Get Posts Shortcode versions 1.0 and earlier Description The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting'. This is a DOM-Based XSS vulnerability, which can be...

Cross-Site Scripting (XSS)

studio-42/elfinder is vulnerable to persistent Cross-site Scripting XSS. The vulnerability is due to a filename restriction bypass, allowing attackers to inject malicious scripts...

PT-2024-35188

Name of the Vulnerable Software and Affected Versions Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera versions through 4.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows f...

CVE-2024-1097

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-1097 Stored XSS in craigk5n/webcalendar

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2024-1097

CVE-2024-1097: A stored XSS in craigk5n/webcalendar 1.3.0 occurs in the Report Name input during report creation. Malicious scripts can run in other users’ context, potentially enabling theft of user accounts and cookies. Public details about a fix are not provided in the connected sources; no pa...

CVE-2024-1097 Stored XSS in craigk5n/webcalendar

A stored cross-site scripting XSS vulnerability exists in craigk5n/webcalendar version 1.3.0. The vulnerability occurs in the 'Report Name' input field while creating a new report. An attacker can inject malicious scripts, which are then executed in the context of other users who view the report,...

CVE-2021-3841

CVE-2021-3841 affects sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2, where stored XSS can be triggered via SVG files uploaded or rendered by the application. The root cause is an SVG handling vulnerability that allows injection of malicious scripts executed in the user’s browser. Im...

CVE-2021-3841 Stored Cross-site Scripting (XSS) in sylius/sylius

sylius/sylius versions prior to 1.9.10, 1.10.11, and 1.11.2 are vulnerable to stored cross-site scripting XSS through SVG files. This vulnerability allows attackers to inject malicious scripts that can be executed in the context of the user's browser...

Cross-Site Scripting (XSS)

github.com/j3ssie/osmedeus is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper filtering of file contents when generating reports. The contents of the report files HTML and Markdown are read and used to generate the report, but they are not adequately sanitized, allowi...

Cross-Site Scripting (XSS)

github.com/mudler/localai is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper input validation and inadequate sanitization of user inputs when passing parameters to the delete model API, allows malicious scripts to be stored and executed in the application...