PT-2021-10531

Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4 Description: An issue in Monstra CMS allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML files. Recommendations: For Monstra CMS version 3.0.4,...

Monstra CMS code-related vulnerabilities

Monstra CMS is a lightweight PHP-based content management system CMS from the Ukrainian personal developer Sergey Romanenko.A code issue vulnerability exists in Monstra CMS v3.0.4, which could be exploited by attackers to execute arbitrary web scripts or HTML...

CVE-2020-20691: Unrestricted Upload of File with Dangerous Type

An issue in Monstra CMS v3.0.4 allows attackers to execute arbitrary web scripts or HTML via bypassing the file extension filter and uploading crafted HTML files...

PT-2021-10420

Name of the Vulnerable Software and Affected Versions: YzmCMS version 5.3 Description: A cross-site scripting XSS issue in the "/link/add.html" component allows attackers to execute arbitrary web scripts or HTML. Recommendations: For YzmCMS version 5.3, update to a version that includes a fix for...

PT-2021-10902

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.14 Description A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field. This enables attackers to potentially steal user da...

CMS Made Simple Cross-Site Scripting Vulnerabilities

CMS Made Simple CMSMS is an open source content management system CMS from the CMSMS Cmsms team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism and so on. A cross-site scripting vulnerability exists in CMS...

Cross site scripting

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page...

CVE-2021-20829

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page...

CVE-2021-20829: Improper Neutralization of Input During Web Page Generation

Cross-site scripting vulnerability due to the inadequate tag sanitization in GROWI versions v4.2.19 and earlier allows remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page...

PT-2021-10368

Name of the Vulnerable Software and Affected Versions: WUZHI CMS versions up to and including 4.1.0 Description: A Cross Site Scripting XSS issue exists in the config function in coreframe/app/attachment/libs/class/ckditor.class.php. This allows for potential malicious script execution...

PT-2021-14274

Name of the Vulnerable Software and Affected Versions: GROWI versions v4.2.19 and earlier Description: The issue is due to inadequate tag sanitization, allowing remote attackers to execute an arbitrary script on the web browser of the user who accesses a specially crafted page. This enables the...

GROWI and earlier cross-site scripting vulnerabilities

Weseek Growi is an open source wiki system that can be written in Markdown by Weseek Japan. A security vulnerability in GROWI v4.2.19 and earlier versions, which stems from insufficient tag cleanup, allows remote attackers to execute arbitrary scripts on the web browsers of users accessing...

EC-CUBE plugin "Order Status Batch Change Plug-in" vulnerable to cross-site scripting

Overview EC-CUBE plugin "Order Status Batch Change Plug-in" provided by ActiveFusions Co., Ltd. contains a cross-site scripting vulnerability CWE-79. An arbitrary script may be executed by conducting a specific operation on the management page of EC-CUBE. ActiveFusions Co., Ltd. reported this...

CVE-2021-35493

The WebFOCUS Reporting Server and WebFOCUS Client components of TIBCO Software Inc.'s TIBCO WebFOCUS Client, TIBCO WebFOCUS Installer, and TIBCO WebFOCUS Reporting Server contain easily exploitable Stored and Reflected Cross Site Scripting XSS vulnerabilities that allow a low privileged attacker ...

CVE-2021-35493

The CVE-2021-35493 issue affects TIBCO WebFOCUS WebFOCUS Client, Installer, and Reporting Server (WebFOCUS components). It is a cross-site scripting vulnerability (stored and reflected) caused by improper validation of user-supplied input. Affected releases are WebFOCUS Client, Installer, and Rep...

CVE-2021-33672

Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the...

PT-2021-20250

Name of the Vulnerable Software and Affected Versions: SAP Contact Center's Communication Desktop component version 700 Description: The issue arises from missing encoding in the Communication Desktop component, allowing an attacker to send malicious scripts via chat messages. When a recipient...

PT-2021-15129

Name of the Vulnerable Software and Affected Versions NetIQ Access Manager versions prior to 5.0.1 NetIQ Access Manager versions prior to 4.5.4 Description The issue is a Reflected Cross Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website, which wi...

CVE-2020-19283

A reflected cross-site scripting XSS vulnerability in the /newVersion component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML...

CVE-2020-19284

A stored cross-site scripting XSS vulnerability in the /group/comment component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the group comments text field...