YesWiki Reflected XSS via File Upload

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been...

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

Timesheet Next Gen <=1.5.3 - Cross-Site Scripting

Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the...

WP DeskLite - Reflected XSS

WP DeskLite WordPress plugin through 1.0.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12724 info: name: WP DeskLite - Reflected XSS...

ECT Home Page Products - Reflected XSS

ECT Home Page Products WordPress plugin through 1.9 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit...

SlideDeck 1 Lite Content Slider - Cross-Site Scripting

SlideDeck 1 Lite Content Slider WordPress plugin = 1.4.8 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13224 inf...

Shield Security <= 21.0.8 - Unauthenticated Reflected XSS

Shield Security WordPress plugin = 21.0.8 contains a reflected cross-site scripting caused by insufficient input sanitization and output escaping in the 'message' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction. id: CVE-2026-0561 info: name: Shield...

YesWiki Bazar Widget - Reflected XSS via 'id' Parameter

YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. striptags does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers. id: CVE-2026-52774 info: name: YesWiki Bazar Widget ...

Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting

The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraphaccelprep parameter. CacheExtractPreparePageParams compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON...

Zarinpal Paid Download - Reflected XSS

Zarinpal Paid Download WordPress plugin v2.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit requires...

CVE-2021-40906

CVE-2021-40906 - Reflected XSS in an unauthenticated zone Application: CheckMK Management Web Console Software Revision: From 1.5.0 to 1.5.0p25 Author: Edgar Augusto Loyola Torres. Attack type: Reflected XSS Solution: Update to Software Revision 1.6.0p26 or later Summary: CheckMK Raw Edition...

CVE-2023-08-21-exploit

Exploit Title: Axigen if xhr1.readyState === XMLHttpRequest.DONE hcookie = new URLxhr1.responseURL.search.split"="1...

CVE-2019-10685

CVE-2019-10685 La entrada proporcionada por el usuario que contiene JavaScript se refleja en código JavaScript en una respuesta HTML a través del parámetro "TextField". Publicación de Exploit-DB en https://www.exploit-db.com/exploits/46804 Publicación de PacketStorm en...

Cross-Site-Scripting-Reflected-XSS-Vulnerability-in-blackcatcms_v1.3

Cross-Site-Scripting-Reflejado-XSS-Vulnerabilidad-en-blackcatcmsv1.3 BlackCat-CMS-Bundle-v1.3 Cross Site ScriptingXSS Número CVE asignado: CVE-2018-10821 https://github.com/BlackCatDevelopment/BlackCatCMS/issues/384...

CVE-2025-51864

CVE-2025-51864 Vulnerability description AIBOX is a web application for exploring AI consulting and trying out multiple LLMs. It allows users to chat with various LLMs. A reflected cross-site scripting XSS vulnerability exists in the chat component, which could lead to JWT token theft and remote...

CVE-2020-28414

CVE-2020-28414 Suggested description A reflected cross-site scripting XSS vulnerability exists in the TranzWare Payment Gateway 3.1.12.3.2. A remote unauthenticated attacker is able to execute arbitrary HTML code via crafted url. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

NoXss

NoXss NoXss es un escáner de vulnerabilidades de cross-site scripting que soporta XSS reflejado y XSS basado en DOM. Es muy rápido y adecuado para probar millones de URLs. Ha encontrado algunas vulnerabilidades XSS en programas de Bug Bounty. Características Rápido y adecuado para probar millones...

CVE-2025-25747-HotelDruid-3-0-7-Reflected-XSS

CVE-2025-25747 - Vulnerabilidad XSS Reflejado en HotelDruid 3.0.7 Descripción Vulnerabilidad de Cross Site Scripting en DigitalDruid HotelDruid v.3.0.7 permite a un atacante ejecutar código arbitrario y obtener información sensible a través del parámetro ripristinabackup en el endpoint...

CVE-2022-45436

CVE-2022-45436 Reflected Cross Site Scripting leading to session hijacking in pandorafms Exploit Title: Reflected Cross Site Scripting Date: 15/02/2023 Exploit Author: Damodar Naik Vendor Homepage: https://pandorafms.com/en/ Software Link: https://github.com/pandorafms/pandorafms Version: = v765 ...

CVE-2024-1304---Badgermeter-moni-tool-Reflected-Cross-Site-Scripting-XSS

CVE-2024-1304 --- Badgermeter moni tool - Reflected Cross Site Scripting XSS https://www.incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-badger-meters-monitool CVE-2024-1304: 6.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L | CWE-79. Software link :...