CVE-2018-14689

An issue was discovered in Subsonic 6.1.1. The transcoding settings are affected by five stored cross-site scripting vulnerabilities in the namex, sourceformatsx, targetFormatx, step1x, and step2x parameters where x is an integer to transcodingSettings.view that could be used to steal session...

CVE-2018-11352

The Wallabag application 2.2.3 to 2.3.2 is affected by one cross-site scripting XSS vulnerability that is stored within the configuration page. This vulnerability enables the execution of a JavaScript payload each time an administrator visits the configuration page. The vulnerability can be...

CVE-2018-14690

Subsonic 6.1.1 is affected by two stored cross-site scripting vulnerabilities in the generalSettings.view endpoint (parameters: title and subtitle). The issue can allow an attacker to obtain session information from victims. The CVE entry notes the vulnerability in Subsonic’s generalSettings, but...

CVE-2018-14690

An issue was discovered in Subsonic 6.1.1. The general settings are affected by two stored cross-site scripting vulnerabilities in the title and subtitle parameters to generalSettings.view that could be used to steal session information of a victim...

Philips e-Alert Information Disclosure Vulnerability (CNVD-2019-28283)

Philips e-Alert is an electronic alert solution for MRI systems from Philips in the Netherlands, which is used to monitor and alert on MRI system performance. A security vulnerability exists in Philips e-Alert R2.1 and prior versions, which stems from the program not properly limiting the size of...

PayPal: [Venmo Android] Remote theft of user session

A URL activity in the Venmo application used the built-in android.net.Uri parser, which has a known logic problem with certain characters. If an external URL were passed from a website or other app on the device to the application activity, the app would open the URL without properly validating t...

OpenCart-Overclocked Cross-Site Scripting Vulnerability

OpenCart-Overclocked is an open source shopping cart application. A cross-site scripting vulnerability exists in upload/admin/view/template/extension/openbay.tplL95 in OpenCart-Overclocked 1.11.1 and earlier versions, which stems from the program not filtering user input. A remote attacker could...

FlightAirMap Cross-Site Scripting Vulnerability

FlightAirMap is a free, open source application developed using PHP for displaying flights on a map. A cross-site scripting vulnerability exists in the GET variable on the Registration sub-menu page in FlightAirMap 1.0-beta.21 and earlier versions. A remote attacker can exploit this vulnerability...

CVE-2018-1000642

FlightAirMap version =v1.0-beta.21 contains a Cross Site Scripting XSS vulnerability in GET variable used within registration sub menu page that can result in unauthorised actions and access to data, stealing session information. This vulnerability appears to have been fixed in after commit 22b09...

CVE-2018-1000640

OpenCart-Overclocked version =1.11.1 contains a Cross Site Scripting XSS vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data, stealing session information, denial of service. This attack appear to be...

Cross site scripting

OpenCart-Overclocked version =1.11.1 contains a Cross Site Scripting XSS vulnerability in User input entered unsanitised within JS function in the template that can result in Unauthorised actions and access to data, stealing session information, denial of service. This attack appear to be...

CVE-2018-1000642

FlightAirMap affected version:

CVE-2018-1000640

OpenCart-Overclocked (

Jirafeau Cross-Site Scripting Vulnerability (CNVD-2018-12870)

Jirafeau is a file sharing website system. A cross-site scripting vulnerability exists in the 'search file by link' form in Jirafeau versions prior to 3.4.1. A remote attacker can use this vulnerability to steal sessions and gain administrative privileges...

Jirafeau Cross-Site Scripting Vulnerability

Jirafeau is a file sharing website system. A cross-site scripting vulnerability exists in the 'search file by hash' form in Jirafeau versions prior to 3.4.1. A remote attacker can exploit this vulnerability to steal sessions and gain administrative privileges...

CVE-2018-13409

An issue was discovered in Jirafeau before 3.4.1. The "search file by hash" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges...

CVE-2018-13409

An issue was discovered in Jirafeau before 3.4.1. The "search file by hash" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges...

CVE-2018-13408

An issue was discovered in Jirafeau before 3.4.1. The "search file by link" form is affected by reflected XSS that could allow, by targeting an administrator, stealing a session and gaining administrative privileges...

CVE-2018-13409

CVE-2018-13409 affects Jirafeau prior to 3.4.1. The vulnerability is a reflected XSS in the "search file by hash" form, which could allow an attacker to target an administrator, steal a session, and gain administrative privileges. The connected sources consistently describe this XSS flaw and its ...

CVE-2018-13002

An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the wFilemanager.php and index.php files of the /grid5/scripts/ modules. The injection point is located in the Project Title and the execution point occurs in the Inhaltsprojekt...