CVE-2026-4951

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...

CVE-2026-4951 Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...

EUVD-2026-108613

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...

CVE-2026-4951

The VertiGIS WebOrderSystem CustomerAdministration portal (KundenManager ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The flaw exists because the application fails to properly neutralize input in the "searchValue" URL parameter, allowing an unauthenticated attacker to execute arbitra...

PT-2026-121785

The CustomerAdministration portal KundenManager of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies user groups. The search term can be passed in the "searchValue" URL parameter, so the search is performed when a logged-in user opens such a URL...

CVE-2023-46858

Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content are used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."...

CVE-2023-46858: Improper Neutralization of Input During Web Page Generation

Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. NOTE: the Moodle Security FAQ link states "Some forms of rich content are used by teachers to enhance their courses ... admins and teachers can post XSS-capable content, but students can not."...

Moodle Cross-Site Scripting Vulnerability

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. A cross-site scripting vulnerability exists in Moodle version 4.3 that stems from allowing payload injection via the searchvalue field...

PT-2023-30245 · Moodle +1 · Moodle +1

Name of the Vulnerable Software and Affected Versions: Moodle version 4.3 Description: The issue allows for reflected XSS in the /grade/report/grader/index.php endpoint when the searchvalue parameter is used, and the user is logged in as a teacher. According to the Moodle Security FAQ, teachers c...

CVE-2020-24604

A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request "searchName", "searchValue", "searchDescription", "searchDefaultValue","searchPlugin", "searchDescriptio...