CVE-2021-4046

The mtxtNom y mtxtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XSS attacks. This vulnerability could be used to carry out a number of browser-based attacks including browser hijacking or theft of sensitive data...

GHSA-PRFF-6J8Q-VRV7 Cross-site Scripting in microweber

There is a persistent XSS Vulnerability exsists in the checkout page where we can able to execute any javascription in the last name field...

Win32.MarsStealer Web Panel Cross Site Scripting

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/8abb41f6e7010d70c90f65fd9a740faaB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Win32.MarsStealer Web Panel Vulnerability: Unauthenticated Remote Persistent XSS Description: The...

CVE-2021-23824

This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting XSS vulnerability, assuming an attacker can influence the...

Cross site scripting

This affects the package Crow before 0.3+4. When using attributes without quotes in the template, an attacker can manipulate the input to introduce additional attributes, potentially executing code. This may lead to a Cross-site Scripting XSS vulnerability, assuming an attacker can influence the...

Rocket LMS v1.1 - (History) Persistent XSS Vulnerability

Document Title: =============== Rocket LMS v1.1 - History Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2305 Release Date: ============= 2021-12-29 Vulnerability Laboratory ID VL-ID: ==================================== 23...

Cross site scripting

An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempting to create new Apps. An attacker with minimal privileges in the application can build their own App and upload a malicious file containi...

CVE-2021-44043

An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempting to create new Apps. An attacker with minimal privileges in the application can build their own App and upload a malicious file containi...

CVE-2021-44043

UiPath App Studio 21.4.4 is affected by a persistent cross-site scripting (XSS) vulnerability in the file-upload functionality used for app icon uploads. An attacker with minimal privileges can upload a malicious file and, by altering the MIME type in a subsequent request, cause the payload to be...

Cross site scripting

The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous...

CVE-2021-43991 Persistent XSS via Avatar Upload in Kentico Xperience CMS

The Kentico Xperience CMS version 13.0 – 13.0.43 is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data without proper handling of dangerous...

CVE-2021-43991

CVE-2021-43991 affects Kentico Xperience CMS, version 13.0–13.0.43, with a persistent (stored/second‑order) XSS vulnerability. The public description notes that attacker‑supplied script content stored by the app can be retrieved and executed by other users, enabling attacks such as session hijack...

CVE-2021-42119

CVE-2021-42119 describes a persistent cross-site scripting vulnerability in Business-DNA Solutions GmbH TopEase platform (version ≤ 7.1.27) exposed through the Search Functionality. The issue arises when authenticated users with Object Modification privileges can inject arbitrary HTML/JavaScript ...

CVE-2021-43409 WPO365 | LOGIN - Wordpress Plugin Persistent Cross-Site Scripting

The “WPO365 | LOGIN” WordPress plugin up to and including version 15.3 by wpo365.com is vulnerable to a persistent Cross-Site Scripting XSS vulnerability also known as Stored or Second-Order XSS. Persistent XSS vulnerabilities occur when the application stores and retrieves client supplied data...

Hotel Listing (WP Plugin) v3.x - MyAccount XSS Vulnerability

Document Title: =============== Hotel Listing WP Plugin v3.x - MyAccount XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2277 Release Date: ============= 2021-10-27 Vulnerability Laboratory ID VL-ID: ===================================...

CVE-2020-23048

SeedDMS Content Management System v6.0.7 contains a persistent cross-site scripting (XSS) vulnerability in the AddEvent.php component, exploitable via the name and comment parameters. The issue is confirmed in multiple sources (CVE-2020-23048; RH, NVD, CNVD, CVE lists) and affects the AddEvent.ph...

PHP Melody v3.0 - (Editor) Persistent XSS Vulnerability

Document Title: =============== PHP Melody v3.0 - Editor Persistent XSS Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2291 Bulletin: https://www.phpsugar.com/blog/2021/09/php-melody-3-0-vulnerability-report-fix/ Release Date: ===========...

CVE-2021-31373

A persistent Cross-Site Scripting XSS vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web...

CVE-2021-31373

A persistent Cross-Site Scripting XSS vulnerability in Juniper Networks Junos OS on SRX Series, J-Web interface may allow a remote authenticated user to inject persistent and malicious scripts. An attacker can exploit this vulnerability to steal sensitive data and credentials from a web...

CVE-2021-36871 WordPress WP Google Maps Pro premium plugin <= 8.1.11 - Multiple Authenticated Persistent XSS vulnerabilities

Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities in WordPress WP Google Maps Pro premium plugin versions &attributes, Name &attributes, &icons, &names, &description, &link, &title...