CVE-2022-29418

CVE-2022-29418 affects the WordPress plugin Night Mode (Mark Daniels Night Mode) at versions

WordPress Videos Sync PDF 1.7.4 Cross Site Scripting

Exploit Title: WordPress Plugin Videos sync PDF 1.7.4 - Stored Cross Site Scripting XSS Google Dork: inurl:/wp-content/plugins/video-synchro-pdf/ Date: 2022-04-13 Exploit Author: UnD3sc0n0c1d0 Vendor Homepage: http://www.a-j-evolution.com/ Software Link:...

CVE-2021-45227

COINS Construction Cloud 11.12 contains a persistent Cross-Site Scripting (XSS) flaw in the file upload flow due to inappropriate handling of HTML IFRAME elements. Root cause: improper IFRAME usage during uploads enables script persistence. Impact is documented as client-side compromise; CVSS sco...

CVE-2021-45227: Improper Neutralization of Input During Web Page Generation

An issue was discovered in COINS Construction Cloud 11.12. Due to an inappropriate use of HTML IFRAME elements, the file upload functionality is vulnerable to a persistent Cross-Site Scripting XSS attack...

CVE-2022-25613: Improper Neutralization of Input During Web Page Generation

Authenticated Persistent Cross-Site Scripting XSS vulnerability in FV Flowplayer Video Player WordPress plugin versions = 7.5.18.727 via &fvwpflowplayerfieldsplash parameter...

PT-2022-17408

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player WordPress plugin versions = 7.5.18.727 Description The issue is related to an Authenticated Persistent Cross-Site Scripting XSS vulnerability. It can be exploited via the &fv wp flowplayer field splash parameter...

CVE-2022-24957

DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit the vulnerability, the attacker has to create or edit a new information object and use the XSS payload as the name. Any user that opens the object's version or history tab will ...

CVE-2022-24957

DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit the vulnerability, the attacker has to create or edit a new information object and use the XSS payload as the name. Any user that opens the object's version or history tab will ...

Input validation

DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit the vulnerability, the attacker has to create or edit a new information object and use the XSS payload as the name. Any user that opens the object's version or history tab will ...

CVE-2022-24957

DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit the vulnerability, the attacker has to create or edit a new information object and use the XSS payload as the name. Any user that opens the object's version or history tab will ...

CVE-2022-24957

DHC Vision eQMS (v5.4.8.322 and earlier) is affected by a Persistent XSS due to insufficient encoding of untrusted input/output. An attacker must create/edit an information object and use the XSS payload as the name; any user opening the object’s version or history tab can be attacked. No remedia...

PT-2022-13649

Name of the Vulnerable Software and Affected Versions htmly version 5.3 Description A problematic issue has been found in the Edit Profile Module component. The manipulation of the Title field with script tags leads to persistent cross-site scripting. The attack can be initiated remotely and...

PT-2022-13637

Name of the Vulnerable Software and Affected Versions College Website Management System version 1.0 Description A vulnerability was found in the College Website Management System, affecting the file "/cwms/classes/Master.php?f=save contact" of the component Contact Handler. This issue leads to...

PT-2022-17014

Name of the Vulnerable Software and Affected Versions DHC Vision eQMS versions 5.4.8.322 and earlier Description The issue is related to insufficient encoding of untrusted input/output, leading to Persistent XSS. To exploit this, an attacker must create or edit a new information object, using the...

CVE-2022-1087: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profile Module. The manipulation of the field Title with script tags leads to persistent cross site scripting. The attack may be initiated remotely and requires an authentication. A...

CVE-2022-1075: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in College Website Management System 1.0 and classified as problematic. Affected by this issue is the file /cwms/classes/Master.php?f=savecontact of the component Contact Handler. The manipulation leads to persistent cross site scripting. The attack may be launched...

CVE-2022-24957: Improper Neutralization of Input During Web Page Generation

DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit the vulnerability, the attacker has to create or edit a new information object and use the XSS payload as the name. Any user that opens the object's version or history tab will ...

CVE-2022-25612

CVE-2022-25612 affects WordPress WordPress Simple Event Planner plugin ≤ 1.5.4. The vulnerability is a stored/authenticated Cross-Site Scripting (XSS) resulting from insufficient sanitization of Event Options (e.g., event_organiser, organiser_email, organiser_contact) when a user with author or h...

CVE-2022-25612: Improper Neutralization of Input During Web Page Generation

Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities in Simple Event Planner WordPress plugin = 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: &customeventorganiser, &customorganiseremail, &customorganisercontact...

CVE-2021-23209: Improper Neutralization of Input During Web Page Generation

Multiple Authenticated admin user role Persistent Cross-Site Scripting XSS vulnerabilities discovered in AMP for WP – Accelerated Mobile Pages WordPress plugin versions = 1.0.77.32...