PT-2025-6854

Name of the Vulnerable Software and Affected Versions pihome-shc PiHome version 1.77 Description A problem has been found in the /index.php file, affecting some unknown functionality. The issue is related to the manipulation of the $ SERVER'PHP SELF' argument, which leads to cross site scripting...

ZoneMinder security vulnerabilities

ZoneMinder is an open source video surveillance software system. The system supports IP, USB and analog cameras, among others. A security vulnerability exists in ZoneMinder versions prior to 1.34.21. A remote attacker can exploit this vulnerability to execute arbitrary code, elevate privileges, a...

CVE-2023-4290

The WP Matterport Shortcode WordPress plugin before 2.1.7 does not escape the PHPSELF server variable when outputting it in attributes, leading to Reflected Cross-Site Scripting issues which could be used against high privilege users such as admin...

PT-2023-28634

Name of the Vulnerable Software and Affected Versions WP Matterport Shortcode WordPress plugin versions prior to 2.1.7 Description The issue is related to Reflected Cross-Site Scripting, which could be used against high privilege users such as admin. This occurs because the PHP SELF server variab...

SUSE CVE-2006-0806

Multiple cross-site scripting XSS vulnerabilities in ADOdb 4.71, as used in multiple packages such as phpESP, allow remote attackers to inject arbitrary web script or HTML via 1 the nextpage parameter in adodb-pager.inc.php and 2 other unspecified vectors related to PHPSELF...

SUSE CVE-2007-5589

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin before 2.11.1.2 allow remote attackers to inject arbitrary web script or HTML via certain input available in 1 PHPSELF in a serverstatus.php, and b grabglobals.lib.php, c displaychangepassword.lib.php, and d common.lib.php in...

PT-2023-9940 · Unknown · Ahmyi Rivettracker

Name of the Vulnerable Software and Affected Versions: ahmyi RivetTracker affected versions not specified Description: A problematic issue has been found in ahmyi RivetTracker, affecting some unknown processing. The manipulation of the argument $ SERVER'PHP SELF' leads to cross site scripting. Th...

CVE-2022-1216

The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHPSELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting...

CVE-2022-1217

The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHPSELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting...

PT-2022-13719

Name of the Vulnerable Software and Affected Versions Advanced Image Sitemap WordPress plugin versions 1.2 and earlier Description The issue is related to Reflected Cross-Site Scripting. It occurs because the PHP SELF PHP variable is not properly sanitised and escaped before being outputted in an...

PT-2022-13720

Name of the Vulnerable Software and Affected Versions Custom TinyMCE Shortcode Button WordPress plugin versions 1.1 and earlier Description The issue arises from the lack of sanitization and escaping of the PHP SELF variable before it is outputted in an attribute on an admin page, leading to...

CVE-2022-0380

The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $SERVER'PHPSELF' found in the /options-fotobook.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 3.2.3...

WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the...

CVE-2021-39412

Multiple Cross Site Scripting XSS vulnerabilities exists in PHPGurukul Shopping v3.1 via the 1 callback parameter in a serverside/scripts/idjsonp.php, b serverside/scripts/jsonp.php, and c scripts/objectsjsonp.php, the 2 value parameter in examplessupport/editableajax.php, and the 3 PHPSELF...

CVE-2021-39412

Multiple Cross Site Scripting XSS vulnerabilities exists in PHPGurukul Shopping v3.1 via the 1 callback parameter in a serverside/scripts/idjsonp.php, b serverside/scripts/jsonp.php, and c scripts/objectsjsonp.php, the 2 value parameter in examplessupport/editableajax.php, and the 3 PHPSELF...

PT-2021-22581

Name of the Vulnerable Software and Affected Versions: PHPGurukul Shopping version 3.1 Description: Multiple Cross Site Scripting XSS vulnerabilities exist in the software. The issues are found in the callback parameter in several API endpoints: "server side/scripts/id jsonp.php", "server...

CVE-2021-40925

Cross-site scripting XSS vulnerability in dompdf/dompdf/www/demo.php infaveo-helpdesk v1.11.0 and below allow remote attackers to inject arbitrary web script or HTML via the $SERVER"PHPSELF" parameter...

PT-2021-23016

Name of the Vulnerable Software and Affected Versions FlexTV beta development version Description The issue is related to a cross-site scripting XSS vulnerability in the index.php file of FlexTV. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the PHP SELF...

Faveo Helpdesk cross-site scripting vulnerability

Faveo Helpdesk is an open source ticketing system built by Faveo based on Laravel framework. A cross-site scripting vulnerability in Faveo Helpdesk v1.11.0 and below allows remote attackers to inject arbitrary web script or HTML via the $SERVER"PHPSELF" parameter...

PT-2021-23013

Name of the Vulnerable Software and Affected Versions infaveo-helpdesk versions 1.11.0 and below Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the $ SERVER"PHP SELF" parameter in the dompdf/dompdf/www/demo.php file. This enables...