Tube Video Ads Lite - Reflected XSS

Tube Video Ads Lite WordPress plugin = 1.5.7 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute arbitrary scripts in the context of high privilege users, exploit requires attacker to craf...

Glossy WordPress - Reflected XSS

Glossy WordPress plugin v2.3.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click a malicious link. id: CVE-2024-13325 info: name: Glossy WordPress -...

Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting

The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraphaccelprep parameter. CacheExtractPreparePageParams compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON...

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

YesWiki Reflected XSS via File Upload

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been...

Timesheet Next Gen <=1.5.3 - Cross-Site Scripting

Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the...

CVE-2022-27665

CVE-2022-27665 Esiste una vulnerabilità di XSS riflesso tramite espressioni di escape della sandbox AngularJS in Progress/IPSwitch WSFTP Server 8.6.0 che può portare all'esecuzione di codice e comandi malevoli sul client a causa di una gestione impropria dell'input fornito dall'utente. Inserendo...

CVE-2022-24181

CVE-2022-24181 e CVE-2022-26616. Ambos são provavelmente iguais. Open-journal-system-Vulnerability XSS via injeção de Host Header e roubo do token de redefinição de senha de outro usuário Passos para reproduzir: 1. Acesse este site: https://who's-using-ojs-software.com 2. Capture esta solicitação...

WebGoat.NET

Webgoat.NET الكود المصدري: https://github.com/jerryhoff/WebGoat.NET تحميل zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master تطبيق الويب هذا هو منصة تعليمية تحاول التعليم عن عيوب أمن الويب الشائعة. يحتوي على عيوب أمنية عامة تنطبق على معظم تطبيقات الويب. كما يحتوي على دروس تتعلق تحديدًا ...

CVE-2025-57389

CVE-2025-57389 - XSS منعكسة في OpenWRT 18.06.2 الوصف تم تحديد ثغرة أمنية من نوع XSS البرمجة النصية عبر المواقع المنعكسة في الإصدار EOL Luci OpenWRT v18.06.2 على نقطة النهاية /cgi-bin/luci/admin/system/packages. إثبات المفهوم 1. أثناء تمرير حركة المرور عبر Burp، انتقل إلى...

CVE-2024-3867

CVE-2024-3867 Questa repository ti mostra alcune informazioni su questa vulnerabilità, che è stata trovata da me. Ecco la descrizione ufficiale fornita: Il tema archive-tainacan-collection per WordPress è vulnerabile a Cross-Site Scripting riflesso a causa dell'uso di addqueryarg senza un adeguat...

CVE-2025-7840

Exploit XSS per CVE-2025-7840 Autore : Byte Reaper @ByteReaper0 Descrizione Exploit proof‑of‑concept per CVE-2025-7840 , che prende di mira un endpoint di un'applicazione web vulnerabile che non sanifica l'input utente sul parametro Firstname di un modulo di prenotazione. Creando una richiesta GE...

CVE-2026-64638

CVE-2026-64638 XSS riflesso sulla schermata di login che porta all'esecuzione di codice PHP — WordPress Core Software: WordPress Core ≤ 7.0.2 tutte le versioni precedenti alla 7.0.3 CVSS: 8.9 Alto CWE: CWE-79 — Neutralizzazione impropria dell'input durante la generazione di pagine web...

CVE-2025-30374

CVE-2025-30374 Vulnerabilità di Class Pollution in Taipy che porta a RCE, XSS, DoS e perdita di credenziali Sintesi Una vulnerabilità di class pollution è stata identificata in Taipy v4.0.3 l'ultima versione al momento della scoperta. Questa vulnerabilità consente ad attaccanti non autorizzati di...

cve-2026-41200-stig-manager-oidc-reflected-xss

CVE-2026-41200 — STIG Manager OIDC Reflected XSS PoC Konzeptioneller Proof of Concept für die reflektierte Cross-Site Scripting XSS Schwachstelle in STIG Manager Versionen 1.5.10 bis 1.6.7. Zusammenfassung der Schwachstelle Eine reflektierte XSS-Schwachstelle existiert im STIG Manager Web App...

CVE-2021-40906

CVE-2021-40906 - Reflected XSS in einer nicht authentifizierten Zone Anwendung: CheckMK Management Web Console Software-Version: Von 1.5.0 bis 1.5.0p25 Autor: Edgar Augusto Loyola Torres. Angriffstyp: Reflected XSS Lösung: Update auf Software-Version 1.6.0p26 oder höher Zusammenfassung: Die Check...

CVE-2024-48589

phpAbook 9.0i - Cross-Site Scripting XSS Schwachstelle CVE-2024-48589 Zusammenfassung: Eine Cross-Site Scripting XSS Schwachstelle wurde im rol-Parameter von index.php oder im Pfadabschnitt der phpAbook-Anwendung entdeckt. Diese Schwachstelle ermöglicht es einem Angreifer, beliebigen...

CVE-2021-36563

CVE-2021-36563 – Multiple XSS Memorizzato e Riflesso Applicazione: CheckMK Management Web Console Revisione Software: Dalla 1.5.0 alla 2.0.0p9 Tipo di attacco: XSS Memorizzato e Riflesso Soluzione: Aggiornare alla Revisione Software 2.0.0p10 o successiva Sommario: La console web di gestione Check...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 Una vulnerabilità di cross-site scripting XSS riflesso è presente in più URL di mooSocial v3.1.8 e consente agli aggressori di rubare i cookie di sessione degli utenti e di impersonare il loro account tramite un URL appositamente predisposto. Nota: XXS funziona anche...

CVE-2025-46181-XSS

CVE-2025-46181 - Reflektiertes XSS in einem Online-Terminbuchungssystem CVE-ID : CVE-2025-46181 Entdeckt von : Shemkumar P shemkumar.github.io Schwachstellentyp : Reflected Cross-Site Scripting XSS Schweregrad : Mittel Status : Offengelegt, CVE von MITRE zugewiesen ✨ Beschreibung Eine Reflected...