24 matches found
CVE-2026-53992: Improper Neutralization of Input During Web Page Generation
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the startdate and enddate GET parameters, which are echoed unescaped into HTML attribute...
CVE-2024-12438: Improper Neutralization of Input During Web Page Generation
The WooCommerce Digital Content Delivery incl. DRM – FlickRocket plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'startdate’ and 'enddate' parameters in all versions up to, and including, 4.75 due to insufficient input sanitization and output escaping. This makes it...
CVE-2024-11369: Improper Neutralization of Input During Web Page Generation
The Store credit / Gift cards for woocommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'coupon', 'startdate', and 'enddate' parameters in all versions up to, and including, 1.0.49.46 due to insufficient input sanitization and output escaping. This makes it...
BIT-SUITECRM-2021-45041
SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resourceid and startdate...
CVE-2023-4471: Improper Neutralization of Input During Web Page Generation
The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the startdate and enddate parameters in versions up to, and including, 3.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
ForkCMS stored XSS via `start_date` parameter
A stored cross-site scripting XSS issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the startdate Parameter. This issue was patched in version 5.11.0...
GHSA-9HMC-87H4-W869 ForkCMS stored XSS via `start_date` parameter
A stored cross-site scripting XSS issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the startdate Parameter. This issue was patched in version 5.11.0...
CVE-2022-35585
A stored cross-site scripting XSS issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "startdate" Parameter...
CVE-2022-35585
A stored cross-site scripting XSS issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "startdate" Parameter...
CVE-2022-35585
A stored cross-site scripting XSS issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "startdate" Parameter...
CVE-2022-35585: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "startdate" Parameter...
CVE-2021-45041
SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resourceid and startdate...
CVE-2021-45041
SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resourceid and startdate...
CVE-2021-45041
SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resourceid and startdate...
CVE-2021-45041
SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resourceid and startdate...
CVE-2021-45041: Improper Neutralization of Special Elements used in an SQL Command
SuiteCRM before 7.12.2 and 8.x before 8.0.1 allows authenticated SQL injection via the Tooltips action in the Project module, involving resourceid and startdate...
CVE-2021-39354
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $startdate and $enddate parameters found in the /includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2...
CVE-2021-39354: Improper Neutralization of Input During Web Page Generation
The Easy Digital Downloads WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the $startdate and $enddate parameters found in the /includes/admin/payments/class-payments-table.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.11.2...
CVE-2021-24235: Improper Neutralization of Input During Web Page Generation
The Goto WordPress theme before 2.0 does not sanitise the keywords and startdate GET parameter on its Tour List page, leading to an unauthenticated reflected Cross-Site Scripting issue...