CVE-2022-24181

CVE-2022-24181 and CVE-2022-26616. both are probably same Open-journal-system-Vulnerability XSS via Host Header injection and Steal Password Reset Token of another user Step to reproduce: 1. Go to this site: https://who's-using-ojs-software.com 2. And capture this request in burp , and send to...

CVE-2023-43325

mooSocial: XSS CVE-2023-43325 A reflected cross-site scripting XSS vulnerability exisits in the dataredirecturl parameter on user login function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter:...

CVE-2025-55887

CVE-2025-55887 Description Cross-Site Scripting XSS vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject...

CVE-2023-31705

CVE-2023-31705 description A Reflected Cross-site scripting XSS vulnerability in Sourcecodester Task Reminder System 1.0 allows an authenticated user to inject malicious javascript into the page parameter. Vulnerability Type Cross Site Scripting XSS Vendor of Product Sourcecodster Affected Produc...

CVE-2023-36163

Exploit Title: BuildaGate5library - Reflected Cross-Site Scripting XSS Date: 06/07/2023 Exploit Author: Idan Malihi Vendor Homepage: None Version: 5 Tested on: Microsoft Windows 10 Pro CVE: CVE-2023-36163 PoC: An attacker needs to find the vulnerable parameter mc= and inject the JS code like: 'di...

CVE-2026-116217

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...

CVE-2026-37272

CVE-2026-37272 CVE-2026-37272 Description A reflected cross-site scripting XSS vulnerability exists in /dashboard/settings.php in Bank Management System in Web 1.0. The vulnerability occurs due to improper sanitization of user-supplied input in the msg GET parameter. An attacker can craft a...

CVE-2023-29808

Exploit Title: Reflected Cross Site Scripting Google Dork: Date: 27.04.2023 Exploit Author: Lucas Noki 0xPrototype Vendor Homepage: https://github.com/vogtmh Software Link: https://github.com/vogtmh/cmaps Version: 8.0 Tested on: Mac, Windows, Linux CVE : CVE-2023-29808 Description: The...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

CVE-2025-56243

CVE-2025-56243 - Reflected XSS in PuneethReddyHC / Event Management System v1.0 Title: Reflected Cross-Site Scripting XSS via eventid parameter in register.php Vendor / Repository: PuneethReddyHC / event-management Affected Version: 1.0 branch/tag master at the time of testing Reporter: Hafiz...

Tiny-XSS-Payloads

Tiny-XSS-Payloads A collection of short XSS payloads that can be used in different contexts. The DEMO available here: https://tinyxss.terjanq.me Current Payloads ... -- " !-- If number of iframes on the pa...

CVE-2020-5398

CVE-2020-5398 - RFDReflected File Download Attack for Spring MVC In Spring Framework, versions 5.2.x prior to 5.2.3, versions 5.1.x prior to 5.1.13, and versions 5.0.x prior to 5.0.16, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header...

CVE-2026-116217 RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...

CVE-2026-116217

RosarioSIS versions prior to 12.9.2 are vulnerable to a reflected cross-site scripting (XSS) flaw in the modules/Food_Service/MenuReports.php component. The root cause is the failure to properly escape the menu_id and modname parameters. An unauthenticated attacker can craft a malicious Modules.p...

EUVD-2026-109809

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...

CVE-2025-44148

CVE-2025-44148 - Reflected Cross-Site Scripting Reflected XSS Reflected Cross-Site Scripting XSS in MailEnable Vendor: MailEnable Pty. Ltd. Affected Versions: 10 Description A reflected cross-site scripting XSS vulnerability exists in MailEnable Webmail due to improper user input sanitization in...

MDaemon-Advisories

MDaemon-Advisories MDaemon Advisories: CVE-2021-27180 Reflected XSS CVE-2021-27181 CSRF Token Fixation CVE-2021-27182 Iframe injection CVE-2021-27183 Remote Code Execution Those vulnerabilities were already patched on January 2021 and are published for CVE purposes. They can be chained to achieve...

CVE-2019-10685

CVE-2019-10685 The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the "TextField" parameter. Exploit-DB publication at https://www.exploit-db.com/exploits/46804 PacketStorm publication at...

CVE-2026-76565

Reflected XSS via pricefrom / priceto Filter Parameters in PhocaCart PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Injects Arbitrary JavaScript via Crafted Price Filter URL SUMMARY PhocaCart 6.1.7 for Joomla is vulnerable to Reflected Cross-Site Scripting XSS via the pricefrom and priceto GET...

CVE-2025-41089

CVE-2025-41089: Reflected XSS in Xibo CMS I have discovered a Reflected Cross-Site Scripting XSS vulnerability in Xibo CMS v4.1.2. This issue stems from the application's failure to properly sanitize user-supplied input in the 'Configuration Name' field of certain widgets within the template...