PT-2022-13002

Name of the Vulnerable Software and Affected Versions ARI Fancy Lightbox WordPress plugin versions prior to 1.3.9 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the msg parameter is not properly sanitised and escaped before being outputted back in ...

CVE-2021-39319 duoFAQ - Responsive, Flat, Simple FAQ <= 1.4.8 Reflected Cross-Site Scripting

The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the /duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8...

CVE-2021-39313: Improper Neutralization of Input During Web Page Generation

The Simple Image Gallery WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the /simple-image-gallery.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.6...

CVE-2021-39319: Improper Neutralization of Input During Web Page Generation

The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the /duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8...

PT-2021-22528

Name of the Vulnerable Software and Affected Versions: duoFAQ versions up to and including 1.4.8 Description: The issue allows attackers to inject arbitrary web scripts via the msg parameter found in the /duogeek/duogeek-panel.php file, enabling Reflected Cross-Site Scripting attacks...

PT-2021-22522

Name of the Vulnerable Software and Affected Versions: Simple Image Gallery WordPress plugin versions up to and including 1.0.6 Description: The issue allows attackers to inject arbitrary web scripts via the msg parameter found in the /simple-image-gallery.php file, enabling Reflected Cross-Site...

WordPress plugin cross-site scripting vulnerabilities

duoFAQ - Responsive, Flat, Simple FAQ plugin is a WordPress open source application plugin. duoFAQ - Responsive, Flat, Simple FAQ plugin for WordPress suffers from a cross-site scripting vulnerability. The vulnerability stems from a lack of data validation filtering of user-supplied data and...

WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. simple Image Gallery plugin is a WordPress open source application plugin. the WordPress Simple Image Gallery plugin ha...

CVE-2021-39420

Multiple Cross Site Scripting XSS vulnerabilities exist in VFront 0.99.5 via the 1 s parameter in searchall.php and the 2 msg parameter in add.attach.php...

CVE-2021-39420: Improper Neutralization of Input During Web Page Generation

Multiple Cross Site Scripting XSS vulnerabilities exist in VFront 0.99.5 via the 1 s parameter in searchall.php and the 2 msg parameter in add.attach.php...

PT-2021-22584

Name of the Vulnerable Software and Affected Versions: VFront version 0.99.5 Description: Multiple Cross Site Scripting XSS vulnerabilities exist in the software via the s parameter in "search all.php" and the msg parameter in "add.attach.php". Recommendations: For VFront version 0.99.5, consider...

VFront Cross-Site Script Vulnerabilities

vfront is a free open source front-end for MySQL or PostgreSQL databases written in PHP and Javascript. vfront version 0.99.5 is vulnerable to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to conduct cross-site scripting attacks via the s parameter in...

CVE-2021-42663

An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a...

CVE-2021-42663: Improper Neutralization of Input During Web Page Generation

An HTML injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the msg parameter to /event-management/index.php. An attacker can leverage this vulnerability in order to change the visibility of the website. Once the target user clicks on a...

PT-2021-5308

Name of the Vulnerable Software and Affected Versions Sourcecodester Online Event Booking and Reservation System affected versions not specified Description The issue exists due to the lack of measures to neutralize special elements, allowing a remote attacker to exploit it and potentially disclo...

CVE-2021-27940

resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter...

Cross site scripting

resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter...

CVE-2020-35725

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2020-35725

Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2020-35203

Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported b...