CVE-2023-24278

CVE-2023-24278 - Squidex 中的反射型 XSS 漏洞 概述 CVE ID: CVE-2023-24278 受影响产品: Squidex 7.4.0 之前的所有版本 报告者: Ioannis Christodoulakos 本仓库提供了关于 Squidex 开源无头 CMS 软件中发现的两个反射型跨站脚本（XSS）漏洞的信息及利用方式。这些漏洞影响 7.4.0 之前的所有版本，攻击者可通过向 /squid.svg 端点的特定查询参数中注入代码，在受害者浏览器中执行恶意 JavaScript 代码。 漏洞详情 漏洞是由于 /squid.svg 端点的 text 和...

CVE-2021-43141

CVE-2021-43141 关于CVE-2021-43141的信息，这是planapplication部分中的一个反射型XSS漏洞。...

CVE-2022-32132

CVE-2022-32132 para osTicket | Sistema de tickets de soporte XSS reflejado: root@kitploit: Payload: " onmouseover="alert1 http://localhost/scp/directory.php?&&order=DESCE%22%20onmouseover=%22alert1%22%20style=%22position:fixed;top:0px;right:0;bottom:0px;left:0px;&sort=name...

CVE-2021-32158

..| XSStoCommandInjection1 |.. Descripción : Aprovechando un ataque de Cross-Site Scripting XSS Reflejado para obtener una Inyección de Comandos a través de la función de Carga y Descarga de Webmin Versión Probada : Webmin 1.973 versión más reciente de GitHub 07/03/2021 Tipo de Ataque: Remoto...

CVE-2024-27914

CVE-2024-27914: GLPI 调试模式中的反射型 XSS 未认证用户可向 GLPI 管理员提供恶意链接以利用反射型 XSS 漏洞。仅当管理员通过调试栏导航时，该 XSS 才会触发。 软件包 - GLPI https://github.com/glpi-project/glpi 受影响版本 - = 10.0.8 已修补版本 - 10.0.13 PoC - http:///glpi/front/search.php?globalsearch=%3Cscript%3Ealert%281%29%3C%2Fscript%3E 参考：...

CVE-2025-28074

CVE-2025-28074 建议描述 phpList 3.6.3 之前的版本存在跨站脚本（XSS）漏洞，原因是 lt.php 中对输入进行了不恰当的净化处理。当应用程序动态引用内部路径并处理未转义的不可信输入时，该漏洞可被利用，允许攻击者注入恶意 JavaScript。 附加信息 此漏洞仅在应用程序动态引用内部路径时可被利用。如果攻击者能够影响路径参数或类似的引用机制，他们可以注入恶意输入，导致反射型 XSS。问题源于 lt.php 缺乏适当的输入净化处理，未能在响应中渲染前转义用户提供的参数。需要适当的输入验证和输出编码来缓解此问题。 漏洞类型 跨站脚本（XSS） 产品供应商...

CVE-2026-76579

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2022-35416

CVE-2022-35416 H3CSSLVPNXSS（反射型XSS） CVE-2022-35416 来自 https://www.cloudwaf.cc/cve/cve-2022-35416 载荷: Shodan: http.htmlhash:510586239 访问地址：https://IP:PORT/wnm/login/login.json. 载荷: Cookie: svpnlang=XSSPAYLOAD 描述 H3C SSL VPN（截至 2022-07-10）允许 wnm/login/login.json 的 svpnlang cookie 存在 XSS 漏洞。 祝你好运！...

CVE-2026-76579

LiteSpeed Cache for WordPress (all versions up to and including 7.9 ) contains a Reflected Cross-Site Scripting vulnerability in the ESI (esi) parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts by supplying a validly sign...

EUVD-2026-83568

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-76579 LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-87917

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-15463

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

EUVD-2026-83559

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-87917

The MC4WP: Mailchimp for WordPress plugin (versions up to and including 4.14.0 ) is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'data' Dynamic Content Tag , caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts i...

CVE-2026-15463 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

EUVD-2026-83546

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-15463

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress (versions up to and including 4.7.42 ) is vulnerable to Reflected Cross-Site Scripting via the host parameter (the CVELIST title also references a uri parameter). The root cause is insufficient input sanitization and o...

CVE-2026-11608

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the wpcr3_fname parameter in all versions up to and including 3.7.8 , caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that exe...

CVE-2026-11608 WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...