CVE-2024-56377

A stored cross-site scripting XSS vulnerability in survey titles of REDCap 14.9.6 allows authenticated users to inject malicious scripts into the Survey Title field or Survey Instructions. When a user receives a survey and clicks anywhere on the survey page to enter data, the crafted payload whic...

CVE-2024-56376

CVE-2024-56376 is a stored XSS in REDCap 14.9.6’s built-in messenger. Authenticated users can inject malicious scripts into the message field, and the payload executes when the recipient clicks the message, enabling potential arbitrary web-script execution. No fix details are provided in the init...

Cross-Site Scripting (XSS)

@marp-team/marp-core is vulnerable to Cross-site scripting XSS. The vulnerability is due to improper neutralization of HTML during sanitization, allowing malicious scripts to bypass defenses and execute...

Malicious code in walletcore-gen (npm)

The package contains several malicious PowerShell and VBS scripts used to harvest browser data, take screenshots, log keystrokes, and establish startup persistence. It also bundles a password stealer and exfiltrates stolen data via Slack and Discord webhooks. --- -= Per source details. Do not edi...

GHSA-J77F-79W9-RGHC The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded

The wp-enable-svg WordPress plugin through 0.2 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

The wp-enable-svg WordPress plugin does not sanitize SVG files when uploaded

The wp-enable-svg WordPress plugin through 0.2 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

CVE-2024-11184

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

CVE-2024-11184

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

CVE-2024-11184

The wp-enable-svg WordPress plugin (versions through 0.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitize uploaded SVG files. An attacker with author-level access or higher can upload a specially crafted SVG file containing malicious scripts. When other u...

CVE-2024-11184 WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVG

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

CVE-2024-11184: Undefined Security Weakness

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts...

WordPress plugin WP Enabled SVG 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-12814

CVE-2024-12814 affects the WordPress plugin Loan Comparison (shortcode loancomparison) up to version 2.0, enablingStored XSS by authenticated attackers (Contributor+) via user-supplied shortcode attributes. Exploitation could inject scripts on pages viewed by other users. Remediation: update to L...

CVE-2024-56313

A stored cross-site scripting (XSS) vulnerability exists in the Calendar feature of REDCap versions through 14.9.6 . The root cause is a failure to effectively secure input content in the Notes field of a calendar event, allowing authenticated users to inject malicious scripts. When a user views ...

CVE-2021-40959

A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall AIWAF = 4.1.6 and =5.0 was identified on the subpage /processmanagement/processstatus.xhr.php. This vulnerability allows an attacker to inject malicious scripts that execute in the context of...

CVE-2021-40959: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall AIWAF = 4.1.6 and =5.0 was identified on the subpage /processmanagement/processstatus.xhr.php. This vulnerability allows an attacker to inject malicious scripts that execute in the context of...

CVE-2021-40959

A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall AIWAF = 4.1.6 and =5.0 was identified on the subpage /processmanagement/processstatus.xhr.php. This vulnerability allows an attacker to inject malicious scripts that execute in the context of...

CVE-2021-40959

A reflected cross-site scripting vulnerability in MONITORAPP Application Insight Web Application Firewall AIWAF = 4.1.6 and =5.0 was identified on the subpage /processmanagement/processstatus.xhr.php. This vulnerability allows an attacker to inject malicious scripts that execute in the context of...

PT-2024-36499 · Portabilis · Portabilis I-Educar

Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9 Description: A reflected Cross-Site Scripting issue exists in the standard documentation upload functionality, allowing an attacker to craft malicious URLs with arbitrary javascript in the titulo documento...

Adobe Connect Cross-Site Scripting Vulnerability (CNVD-2025-01832)

Adobe Connect is a software for creating meeting environments from the American company Audobee Adobe. A security vulnerability exists in Adobe Connect that can be exploited by an attacker to inject malicious scripts into vulnerable form fields...