CVE-2024-41640

Description AML Surety Eco up to version 3.5 is affected by an un-authenticated reflected cross-site scripting. The target web application handles error in a dedicated error page accessible without any authentication containing a URL parameter that is not sanitizing user input. The provided...

CVE-2026-50096

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

CVE-2026-33520

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

poc-cve-xss-encoded-wp-inventory-manager-plugin

Update - 5/10/2023 The CVE-2023-2123 ID was reserved and the PoC was published in the WPScan website: https://wpscan.com/vulnerability/44448888-cd5d-482e-859e-123e442ce5c1 Details Title: Unauthenticated Reflected Cross-Site Scripting in WP Inventory Manager Plugin for WordPress CMS Date: 2023-04-...

CVE-2021-45416

CVE-2021-45416 Reflected Cross-site scripting XSS vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the searchterm parameter in the modules/Scheduling/Courses.php script. Vendor: francoisjacquet Vendor Website: https://www.rosariosis.org/ Affected Product: RosarioSIS...

CVE-2026-50096 BUG-000187164 - ArcGIS Server has a security vulnerability.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

EUVD-2026-110062

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

CVE-2026-50096

A reflected cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 12.1 and prior. This flaw allows a remote, unauthenticated attacker to craft a malicious link that, when clicked, can execute arbitrary JavaScript code in the victim's browser. Remediation is available ...

CVE-2026-33520

A reflected cross-site scripting (XSS) vulnerability exists in Esri Portal for ArcGIS versions 12.1 and prior. A remote, unauthenticated attacker can craft a malicious link that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser. A patch is available for ArcGIS Serve...

EUVD-2026-110058

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

CVE-2026-33520 BUG-000185167 - ArcGIS Server has a security vulnerability.

There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided...

CVE-2024-53255

CVE-2024-53255 boid CMS 2.1.1 - reflected Cross-Site Scripting XSS Description: A reflected XSS vulnerability exists in the /admin?page=media endpoint in the file parameter, allowing an attacker to inject arbitrary JavaScript code Steps to exploit: 1- Login to the CMS and Navigate to the delete...

CVE-2025-66850

Finding Within the ‘LibreNMS’ application, we discovered a reflected Cross-Site Scripting vulnerability; this vulnerability exists in the routing module’s protocol parameter, allowing an attacker to render malicious JavaScript in a victim’s browser. This vulnerability affects all versions from...

CVE-2020-23839

CVE-2020-23839 | GetSimple CMS v3.3.16 - Reflected XSS to RCE Exploit Author: Bobby Cooke boku Vulnerability Statistics OWASP Top Ten 2017: A7:2017-Cross-Site Scripting XSS CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' - Type 1: Reflected XSS CVSS Base...

CVE-2024-2387

CVE-2024-2387 Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms = 1.82.0 - SQL Injection to Reflected Cross-Site Scripting via integrationid Description The Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets an...

CVE-2023-0099-exploit

CVE-2023-0099-exploit Exploit Title: simple urls 115 - Reflected XSS Google Dork: Exploit Author: AmirZargham Vendor Homepage: https://getlasso.co/ Software Link: https://wordpress.org/plugins/simple-urls/ Version: 115 Tested on: firefox,chrome CVE: CVE-2023-0099 CWE: CWE-79 Platform: MULTIPLE...

WebGoat.NET

Webgoat.NET Source Code: https://github.com/jerryhoff/WebGoat.NET Download zip: https://github.com/jerryhoff/WebGoat.NET/zipball/master This web application is a learning platform that attempts to teach about common web security flaws. It contains generic security flaws that apply to most web...

CVE-2021-32158

..| XSStoCommandInjection1 |.. Description : Exploiting a Reflected Cross-Site Scripting XSS attack to get a Command Injection through the Webmin's Upload and Download feature Tested Version : Webmin 1.973 GitHub's latest version 07/03/2021 Attack Type: Remote Impact : Command Execution eXploit's...

CVE-2026-4406

Gravity Forms = 2.9.28 — Unauthenticated Reflected Cross-Site Scripting via gformgetconfig formids Parameter Vulnerability Summary Field| Value ---|--- Affected Software| Gravity Forms WordPress Plugin Vendor| Rocketgenius, Inc. Vulnerability Type| CWE-79: Improper Neutralization of Input During...

CVE-2023-34537---XSS-reflected--found-in-HotelDruid-3.0.5

CVE-2023-34537--- Reflected XSS found in HotelDruid V3.0.5 HotelDruid v3.0.5 are vulnerable to multipe XSS vulnerabilities. These vulnerabilities could allows remote authenticated attackers to inject arbitrary web script or HTML. This is my third repo. Don't beat me if i didn't explain well...