Lucene search
+L

6875 matches found

Nuclei
Nuclei
added 2026/09/20 2:05 a.m.139 views

Simple URLs < 115 - Cross Site Scripting

The plugin does not sanitise and escape some parameters before outputting them back in some pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2023-0099 info: name: Simple URLs 115 - Cross Site Scripting author: r3Y3r53 severit...

6.1CVSS6.3AI score0.01726EPSS
SaveExploits6References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.173 views

phpIPAM - 1.6 - Cross-Site Scripting

phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

6.1CVSS6.2AI score0.03904EPSS
SaveExploits3References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.96 views

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. id: CVE-2023-26843 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site scripti...

5.4CVSS6.1AI score0.0142EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.60 views

Bank Locker Management System - Cross-Site Scripting

A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate...

4.8CVSS3.6AI score0.37608EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.44 views

Aajoda Testimonials < 2.2.2 - Cross-Site Scripting

The plugin does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. id: CVE-2023-2178 info: name: Aajoda Testimonials...

4.8CVSS6.1AI score0.00773EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.104 views

Academy LMS 6.0 - Cross-Site Scripting

Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting XSS vulnerability through query parameter. id: CVE-2023-38964 info: name: Academy LMS 6.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | Creative Item Academy LMS 6.0 was discovered to...

6.1CVSS6.2AI score0.01092EPSS
SaveExploits1References2
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.68 views

HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting

HotelDruid Hotel Management Software 3.0.3 contains a cross-site scripting vulnerability via the prezzoperiodo4 parameter in creaprezzi.php. id: CVE-2022-26564 info: name: HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting author: alexrydzak severity: medium description: | HotelDru...

6.1CVSS6.1AI score0.02759EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.79 views

Haraj 3.7 - Cross-Site Scripting

Haraj 3.7 contains a cross-site scripting vulnerability in the User Upgrade Form. An attacker can inject malicious script and thus steal authentication credentials and launch other attacks. id: CVE-2022-31299 info: name: Haraj 3.7 - Cross-Site Scripting author: edoardottt severity: medium...

6.1CVSS6.2AI score0.05139EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.64 views

eShop 3.0.4 - Cross-Site Scripting

eShop 3.0.4 contains a reflected cross-site scripting vulnerability in json search parse and json response in wrteam.in. id: CVE-2022-35493 info: name: eShop 3.0.4 - Cross-Site Scripting author: arafatansari severity: medium description: | eShop 3.0.4 contains a reflected cross-site scripting...

6.1CVSS6.2AI score0.01696EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.130 views

Sercomm VD625 Smart Modems - CRLF Injection

Sercomm AGCOMBO VD625 Smart Modems with firmware version AGSOT2.1.0 are vulnerable to Carriage Return Line Feed CRLF injection via the Content-Disposition header. id: CVE-2021-27132 info: name: Sercomm VD625 Smart Modems - CRLF Injection author: geeknik severity: critical description: Sercomm...

9.8CVSS8.2AI score0.16487EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.74 views

WBCE CMS v1.5.4 - Cross Site Scripting (Stored)

A cross-site scripting XSS vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field. id: CVE-2022-45038 info: name: WBCE CMS v1.5.4 - Cross Site Scripting Stored author:...

5.4CVSS6.2AI score0.01035EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.48 views

WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting

WordPress Sunshine Photo Cart plugin before 2.9.15 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affecte...

6.1CVSS6.2AI score0.00902EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.65 views

Seo Panel 4.8.0 - Cross-Site Scripting

Seo Panel 4.8.0 contains a reflected cross-site scripting vulnerability via the seo/seopanel/login.php?sec=forgot email parameter. id: CVE-2021-3002 info: name: Seo Panel 4.8.0 - Cross-Site Scripting author: edoardottt severity: medium description: Seo Panel 4.8.0 contains a reflected cross-site...

6.1CVSS6.2AI score0.04278EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.204 views

Hotel Druid 3.0.2 - Cross-Site Scripting

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. id: CVE-2021-37833 info: name: Hotel Druid 3.0.2 - Cross-Site Scripting author: pikpikcu,s4e-io severity: medium description: Hotel Druid 3.0.2 contains a...

6.1CVSS6.3AI score0.04878EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.119 views

AppCMS - Cross-Site Scripting

AppCMS 2.0.101 has a cross-site scripting vulnerability in \templates\m\inchead.php. id: CVE-2021-45380 info: name: AppCMS - Cross-Site Scripting author: pikpikcu severity: medium description: AppCMS 2.0.101 has a cross-site scripting vulnerability in \templates\m\inchead.php. impact: | Successfu...

6.1CVSS6.1AI score0.02521EPSS
SaveExploits1References4
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.56 views

2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting

A cross-site scripting vulnerability in libs/xing.php in the 2 Click Social Media Buttons plugin before 0.34 for WordPress allows remote attackers to inject arbitrary web script or HTML via the xing-url parameter. id: CVE-2012-4273 info: name: 2 Click Socialmedia Buttons 0.34 - Cross-Site Scripti...

4.3CVSS5.8AI score0.0578EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.82 views

Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting

Redwood Report2Web 4.3.4.5 and 4.5.3 contains a cross-site scripting vulnerability in the login panel which allows remote attackers to inject JavaScript via the signIn.do urll parameter. id: CVE-2021-26710 info: name: Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting author: pikpikcu...

6.1CVSS6.2AI score0.075EPSS
SaveExploits1References5
Nuclei
Nuclei
added 2026/09/20 2:05 a.m.51 views

Timesheet Next Gen <=1.5.3 - Cross-Site Scripting

Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the...

6.1CVSS6.4AI score0.043EPSS
SaveExploits1References5
Kitploit
Kitploit
added 2026/09/20 1:40 a.m.7 views

CVE-2025-50754-PoC

CVE-2025-50754 存储型XSS导致PHP CMS平台远程代码执行 摘要 某基于PHP的CMS平台(版本5)的“报告”功能中存在存储型跨站脚本(XSS)漏洞。当管理员查看用户提交的报告时,恶意JavaScript会在管理面板上下文中执行。这使得攻击者能够劫持管理员会话,并利用内置的模板编辑器上传PHP Web Shell,最终在服务器上实现完全远程代码执行(RCE)。 技术细节 漏洞类型: 存储型跨站脚本(XSS) 受影响产品: CMS平台 v5 攻击类型: 远程 影响: 远程代码执行(RCE):是 信息泄露:是 攻击向量(抽象描述)...

9.6CVSS5.9AI score0.0056EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/20 1:11 a.m.11 views

CVE-2025-68461

CVE-2025-68461 扫描器 一个用于检测 Roundcube Webmail 安装中跨站脚本 XSS 漏洞的 C++ 安全扫描工具。 影响 未经授权访问用户账户 会话劫持 数据泄露 以用户身份执行未授权操作 受影响版本 扫描器检查以下存在漏洞的版本: 1.5.x 系列: 1.5.0 至 1.5.11 1.6.x 系列: 1.6.0 至 1.6.11 缓解措施 升级到: Roundcube Webmail 1.5.12 或更高版本(适用于 1.5.x) Roundcube Webmail 1.6.12 或更高版本(适用于 1.6.x) ✨ 特性 自动检测 Roundcube...

7.2CVSS7.5AI score0.26842EPSS
SaveExploits1References1
Rows per page
Query Builder