Liferay Portal & DXP - Cross-Site Scripting

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. id: CVE-2025-4576 info: name: Liferay Portal & DXP - Cross-Site...

Odoo <= 15.0 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting

Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATHINFO variable to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page. id:...

WP DeskLite - Reflected XSS

WP DeskLite WordPress plugin through 1.0.0 contains a reflected XSS caused by unsanitized and unescaped parameter output, letting attackers execute scripts against high privilege users such as admin, exploit requires crafted request. id: CVE-2024-12724 info: name: WP DeskLite - Reflected XSS...

CVE-2021-20717

CVE-2021-20717-EC-CUBE-XSS Описание NVD Уязвимость межсайтового скриптинга XSS в EC-CUBE с 4.0.0 по 4.0.5 позволяет удаленному злоумышленнику внедрить специально созданный скрипт в определенное поле ввода сайта электронной коммерции, созданного с помощью EC-CUBE. В результате это может привести к...

CVE-2025-63830

📂 CKFinder 1.4.3 – Stored Cross-Site Scripting XSS via Malicious SVG Upload CVE ID: CVE-2025-63830 🧭 Overview A stored Cross-Site Scripting XSS vulnerability was identified in CKFinder v1.4.3. The issue resides in the file upload functionality, which fails to properly sanitize SVG files containin...

poc-cribl-rce

Disclaimer This is for informational/educational purposes only. This was put together to demonstrate an insecurity in the tool, in order for a fix to be verified by the vendor. Info Tested on Cribl v1.5.0 - Previous versions not tested but likely vulnerable. A valid JWT token can be transfered fr...

CVE-2026-105791

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the runshell tool in the CommandLineExecutor component of ufo/client/mcp/localservers/climcpserver.py validates only the first token of the bashcommand parameter and permits...

CVE-2020-14882-WebLogic-Analysis

Vulnerability Research: Exploitation of the CVE-2020-14882 and CVE-2020-14883 Chain in Oracle WebLogic Server The repository contains a technical report Write-up and a conceptual Proof of Concept PoC demonstrating the chained Authentication Bypass and Remote Code Execution RCE vulnerabilities in...

CVE-2026-84370

A flaw was found in SVGO SVG Optimizer, a Node.js library for optimizing SVG files. The removeScripts plugin, intended to filter executable links, incompletely processes namespace-prefixed SVG anchor elements and fails to remove ASCII control characters before validating URL schemes. A remote...

Veeam Backup and Replication < 12.3.2 (kb4934)

The version of Veeam Backup and Replication installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the kb4934 advisory. - A reflected cross-site scripting vulnerability in Veeam Backup Enterprise Manager allows an attacker to execut...

Cisco ASA Cross-site Scripting (CVE-2019-1701)

Multiple vulnerabilities in the WebVPN service of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the WebVPN portal of an affected device. Th...

CVE-2026-77226

The Camunda engine, specifically versions 7.24.0 before 7.24.15 , is vulnerable to an incorrect authorization flaw in the Admin web application's first-run setup endpoint. The SetupResource component incorrectly determines setup availability by only counting direct members of the camunda-admin gr...

CVE-2026-77226 Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint

Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group rather than recognizing all configured...

CVE-2023-49987

CVE-2023-49987 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "tname" parameter on "newterm" Description : A cross-site scripting XSS vulnerability in the component “newterm” of School Fees Management System 1.0 allow attackers to execute arbitrary web scripts or...

CVE-2023-43339-CMSmadesimple-Reflected-XSS---Installation

Cmsmadesimple CMS Reflected XSS v2.2.18 Author: Sergio Description: Multiple Cross-Site Scripting XSS vulnerabilities in installation of cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the Database Name, DataBase User or Database...

CVE-2023-49986

CVE-2023-49986 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "name" parameter on "addnewparent" Description : A cross-site scripting XSS vulnerability in the component “addnewparent” of School Fees Management System 1.0 allow attackers to execute arbitrary web...

CVE-2026-30502-OpenKM-6.3.12-Reflected-XSS

🛡️ CVE-2026-30502 — Reflected XSS in OpenKM v6.3.12 Discovered & Reported by Dharmendra Kumar — Security Researcher Cybersecurity | Penetration Testing | Vulnerability Research | Responsible Disclosure 📌 Table of Contents Overview CVE Details Affected Product Vulnerability Description Root Cause...

CVE-2026-102576

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

CVE-2023-33977

CVE-2023-33977 Stored XSS Via SVG Upload in kiwitcms/kiwi - by M Nadeem Qazi Description This repository addresses the stored XSS vulnerability discovered in the kiwitcms/kiwi application, which was assigned the CVE-2023-33977 identifier. The vulnerability allows for the execution of malicious...