KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS)

Reflective Cross Site Scripting XSS vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APPHOST parameter at config/i18n/en/main.php. id: CVE-2023-49489 info: name: KodeExplorer 4.51 - Reflective Cross Site Scripting XSS...

WordPress Echo Knowledge Base cross-site scripting vulnerability

WordPress Echo Knowledge Base versions 17.214.0 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and inadequate output escaping for the newkbconfig parameter, particularly related to the article-mobile-break-point-v2 key. It may allow...

Semantic MediaWiki cross-site scripting vulnerability

Versions 4.2.0 through 7.2.1 of Semantic MediaWiki contain a cross-site scripting vulnerability. This flaw arises because the cstate parameter in Special:FacetedSearch is not escaped. Attackers can craft URLs containing q, matching crc32 csum or filtered=1, along with the value of cstate. This...

Adobe Campaign Classic cross-site scripting vulnerability

Adobe Campaign Classic versions 7.4.4 build 9402 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from a reflective XSS issue, which may allow attackers to inject malicious scripts into web pages. This can be achieved by having victims access specially crafted UR...

YesWiki cross-site scripting vulnerability

Versions of YesWiki prior to 4.7.0 contain a cross-site scripting vulnerability. This vulnerability stems from a reflective XSS issue: attackers can inject JavaScript by providing query parameters matching the missing Bazar field name. The BazarField::getValue method then falls back to using the...

Astro cross-site scripting vulnerability

Versions prior to Astro 7.3.2 contain a cross-site scripting vulnerability. This vulnerability arises because the JSX and MDX rendering pipelines treat string sub-elements within script and style elements as trusted HTML, failing to distinguish between text content generated by the compiler and...

ProjectDiscovery Nuclei Templates Cross-Site Script Vulnerabilities

Versions of ProjectDiscovery Nuclei Templates prior to 1.1.1 contained a cross-site scripting vulnerability. This vulnerability stemmed from uncleaned input of the ff parameter, making it susceptible to reflective cross-site scripting attacks. Such attacks could execute scripts and steal session...

jcrodriguez-dis Virtual Programming Lab for Moodle Cross-Site Script Vulnerabilities

The jcrodriguez-dis Virtual Programming Lab for Moodle versions prior to 5.0.0 has a cross-site scripting vulnerability. This vulnerability stems from the unencoded filename1/filename2 parameters in the similarity/diff.php file. It may lead to reflective cross-site scripting attacks. Attackers ca...

WordPress Custom Tables: Cross-site Scripting Vulnerabilities

Versions of WordPress Custom Tables prior to 3.4.6 contained a cross-site scripting vulnerability. This vulnerability stemmed from the uncleaned key parameter in the iframe.php file. It could lead to reflective XSS attacks. Unauthenticated attackers could construct GET requests to execute scripts...

WordPress Tutor LMS Cross-site Scripting Vulnerability

WordPress Tutor LMS versions 4.1.0 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'tab' parameter. Additionally, when the nav-items array of the target course page is empty, the inarray validation can be...

WordPress Payment Plugins for Stripe: WooCommerce Cross-Site Script Vulnerabilities

WordPress payment plugins for Stripe and WooCommerce versions 4.0.17 and earlier have a cross-site scripting vulnerability. This vulnerability stems from the use of the “response” URL fragment to trigger reflective cross-site scripting. The issue arises due to improper input cleaning and output...

WordPress WPForms cross-site scripting vulnerabilities

WordPress WPForms 2.0.2.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper handling of parameters referenced by smart tags, particularly in the cleanup of attacker-controlled key inputs and output escaping. It may lead to reflective cross-site...

DedeCMS v5.7.111 - Cross-Site Scripting Detection

DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting XSS vulnerability via the component selectmediapostwangEditor.php. !/usr/bin/env python3 -- coding: utf-8 -- """DedeCMS v5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS) Detection

Reflective Cross Site Scripting XSS vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APPHOST parameter at config/i18n/en/main.php. !/usr/bin/env python3 -- coding: utf-8 -- """Reflective Cross Site Scripting XSS...

CVE-2026-63264: Improper Neutralization of Input During Web Page Generation

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller...

WordPress plugin NS Product icon badge: Cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...

VulnCheck KEV: CVE-2022-28290

Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the HTTP request...

WordPress’s various products have cross-site scripting vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be added t...

xss

CSS Style Sheet Mutation alert"This is a test" alert"...

Semantic MediaWiki cross-site scripting vulnerability

Semantic MediaWiki is an open-source extension of Semantic MediaWiki that stores and queries data within wiki pages. Semantic MediaWiki has a cross-site scripting vulnerability. This vulnerability stems from the endpoint parameters in /index.php/Speciaal:GefacetteerdZoeken, which allow for...