21 matches found
PT-2026-104506
Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scrip...
CVE-2021-41464
Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
PT-2024-33534 · WordPress · Blocksy
Name of the Vulnerable Software and Affected Versions: Blocksy theme for WordPress versions up to, and including, 2.0.46 Description: The issue is related to Stored Cross-Site Scripting via the has field link rel parameter due to insufficient input sanitization and output escaping. This allows...
CVE-2021-41465
Cross-site scripting XSS vulnerability in concrete/elements/collectiontheme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
CVE-2021-41465
Cross-site scripting XSS vulnerability in concrete/elements/collectiontheme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
CVE-2021-41464
Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in concrete/elements/collectiontheme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
CVE-2021-41465
Cross-site scripting XSS vulnerability in concrete/elements/collectiontheme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
CVE-2021-41464
Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
CVE-2021-41465
Cross-site scripting XSS vulnerability in concrete/elements/collectiontheme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
CVE-2021-41464
Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
CVE-2021-41464: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in concrete/elements/collectionadd.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
CVE-2021-41465: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in concrete/elements/collectiontheme.php in concrete5-legacy 5.6.4.0 and below allows remote attackers to inject arbitrary web script or HTML via the rel parameter...
PT-2021-23307
Name of the Vulnerable Software and Affected Versions concrete5-legacy versions 5.6.4.0 and below Description The issue is a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the rel parameter in the concrete/elements/collection add.php...
PortlandLabs Concrete CMS Cross-Site Script Vulnerabilities
Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, Inc. A cross-site scripting vulnerability exists in Portlandlabs Concrete5 crete5-legacy 5.6.4.0 and prior versions, which can be exploited by remote attackers to "rel" parameter to inject arbitrary web scri...
PT-2021-23308
Name of the Vulnerable Software and Affected Versions concrete5-legacy versions 5.6.4.0 and below Description The issue is a cross-site scripting XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the rel parameter in the concrete/elements/collection theme.p...
Portlandlabs Concrete5 cross-site scripting vulnerabilities
Portlandlabs Concrete5 is an open source content management system CMS from PortlandLabs, Inc. A cross-site scripting vulnerability exists in Portlandlabs Concrete5 crete5-legacy 5.6.4.0 and prior versions, which can be exploited by remote attackers to "rel" parameter to inject arbitrary web scri...
Free Reprintables ArticleFR Cross-Site Scripting Vulnerability
ArticleFR is an article directory and content catalog system. Multiple cross-site scripting vulnerabilities exist in Free Reprintables ArticleFR version 3.0.6, which stem from the dashboard/settings/categories/ URI not sufficiently filtering the 'name' parameter, the dashboard/settings/links/ URI...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Free Reprintables ArticleFR 3.0.6 allow remote attackers to inject arbitrary web script or HTML via the 1 name parameter to dashboard/settings/categories/, 2 title or 3 rel parameter to dashboard/settings/links/, or 4 url parameter to...
CVE-2007-5163: Improper Control of Generation of Code
PHP remote file inclusion vulnerability in includes/functions/layout.php in Nexty 1.01.A Beta allows remote attackers to execute arbitrary PHP code via a URL in the rel parameter. NOTE: this issue is disputed by CVE because the applicable include is in a function that is not called on a direct...