Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting

The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraphaccelprep parameter. CacheExtractPreparePageParams compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON...

SlideDeck 1 Lite Content Slider - Cross-Site Scripting

SlideDeck 1 Lite Content Slider WordPress plugin = 1.4.8 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a malicious URL. id: CVE-2024-13224 inf...

WP DeskLite - Reflected XSS

WP DeskLite WordPress plugin through 1.0.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12724 info: name: WP DeskLite - Reflected XSS...

ECT Home Page Products - Reflected XSS

ECT Home Page Products WordPress plugin through 1.9 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit...

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

Glossy WordPress - Reflected XSS

Glossy WordPress plugin v2.3.5 contains a reflected cross-site scripting caused by unsanitized parameter output, letting attackers execute malicious scripts in high privilege users' browsers, exploit requires victim to click a malicious link. id: CVE-2024-13325 info: name: Glossy WordPress -...

Timesheet Next Gen <=1.5.3 - Cross-Site Scripting

Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the...

YesWiki Reflected XSS via File Upload

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been...

Zarinpal Paid Download - Reflected XSS

Zarinpal Paid Download WordPress plugin v2.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit requires...

CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 Vulnerabilità di Cross Site Scripting Riflessa Esiste una vulnerabilità di Cross Site Scripting riflessa in più pagine della versione 3.0.2 dell'applicazione Hotel Druid che consente l'esecuzione arbitraria di comandi JavaScript...

CVE-2023-37979

CVE-2023-37979 Unauthentifizierte Reflected Cross-Site Scripting XSS Schwachstelle im Saturday Drive Ninja Forms Contact Form Plugin = 3.6.25 Versionen. PoC und Checker , nur zu Bildungszwecken 'python3 exploit.py https://target.com'...

CVE-2019-19651

CVE-2019-19651 Chevereto XSS riflesso in Nome sito, titolo documento e descrizione - 1.0.0 - 1.1.4 Free, Impostazioni - Nome sito, Titolo documento sito, Descrizione sito Inserendolo, verrà riflesso su tutto il sito per tutti gli utenti root@kitploit: "ChevtChevt...

CVE-2023-36163

Exploit Title: BuildaGate5library - Cross-Site Scripting riflesso XSS Data: 06/07/2023 Autore Exploit: Idan Malihi Homepage del fornitore: Nessuna Versione: 5 Testato su: Microsoft Windows 10 Pro CVE: CVE-2023-36163 PoC: Un attaccante deve trovare il parametro vulnerabile mc= e iniettare il codic...

CVE-2025-44148

CVE-2025-44148 - Cross-Site Scripting riflesso XSS riflesso Cross-Site Scripting riflesso XSS in MailEnable Fornitore: MailEnable Pty. Ltd. Versioni interessate: 10 Descrizione Esiste una vulnerabilità di cross-site scripting riflesso XSS in MailEnable Webmail dovuta a una scorretta sanitizzazion...

CVE-2026-29519-Lucee-Reflected-XSS

CVE-2026-29519-Lucee-Reflected-XSS Proof of Concept per XSS riflesso in Lucee CFML CVE-2026-29519 Framework 0-Day: XSS riflesso nel parsing degli URL di Lucee CFML colpisce le distribuzioni enterprise versioni 5.3.1.95 - 7.x Scopritore: Fouad Milat lavado Data della scoperta: 6 dicembre 2025 CVE:...

CVE-2023-0099-exploit

CVE-2023-0099-exploit Titolo Exploit: simple urls 115 - Reflected XSS Google Dork: Autore Exploit: AmirZargham Homepage del fornitore: https://getlasso.co/ Link del software: https://wordpress.org/plugins/simple-urls/ Versione: 115...

CVE-2019-10685

CVE-2019-10685 Die vom Benutzer bereitgestellte Eingabe, die JavaScript enthält, wird über den Parameter "TextField" als JavaScript-Code in einer HTML-Antwort zurückgespiegelt. Exploit-DB-Veröffentlichung unter https://www.exploit-db.com/exploits/46804 PacketStorm-Veröffentlichung unter...

CVE-2020-23839

CVE-2020-23839 | GetSimple CMS v3.3.16 - XSS riflesso a RCE Autore dell'exploit: Bobby Cooke boku Statistiche della vulnerabilità OWASP Top Ten 2017: A7:2017-Cross-Site Scripting XSS CWE-79: Neutralizzazione impropria dell'input durante la generazione della pagina web 'Cross-site Scripting' - Tip...

MDaemon-Advisories

MDaemon-Advisories Avvisi MDaemon: CVE-2021-27180 XSS riflesso CVE-2021-27181 Fissazione del token CSRF CVE-2021-27182 Iniezione iframe CVE-2021-27183 Esecuzione remota di codice Queste vulnerabilità sono già state corrette a gennaio 2021 e sono pubblicate per scopi CVE. Possono essere concatenat...

cve-2025-0133

Strumento di rilevamento XSS riflesso CVE-2025-0133 Autore : Derek Odiorne Data : 2025-05-23 Gravità : Media Testato su : Palo Alto Networks GlobalProtect Portal PAN-OS 📌 Riepilogo Questo script esegue test sicuri e autorizzati per la vulnerabilità CVE-2025-0133 , un problema di Cross-Site...