Kentico CMS < 12.0.50 XSS

According to its self-reported version number, the version of Kentico CMS on the remote host is prior to 12.0.50. It is, therefore, affected by a cross-site scripting XSS vulnerability due to the Content-Type header being inconsistent with the file extension. An unauthenticated, remote attacker c...

Cross-Site Scripting (XSS)

react-native-webview is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript code in a user's browser via cross-origin iframes...

Cross-site Scripting (XSS)

gon is vulnerable to cross-site scripting XSS attacks. Lack of sanitization of malicious characters within the JSON data in jsondumper.rb allows a malicious user to inject and execute arbitrary javascript in a user's browser...

CVE-2020-19007

Halo blog 1.2.0 allows users to submit comments on blog posts via /api/content/posts/comments. The javascript code supplied by the attacker will then execute in the victim user's browser...

Cross-Site Scripting (XSS)

jspdf is vulnerable to cross-site scripting. An attacker is able to inject and execute arbitrary Javascript in a user's browser by bypassing the filtering regex using...

Cross-Site Scripting (XSS)

dijit is vulnerable to cross-site scripting. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the Editor's LinkDialog plugin...

Cross-Site Scripting (XSS)

com.liferay.portal.search.web is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the curUserName parameter...

Cross-Site Scripting (XSS)

github.com/grafana/grafana is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via the OpenTSDB datasource...

Cross-Site Scripting (XSS)

syncope-client-enduser is vulnerable to cross-site scripting XSS. Lack of sanitization in enduser notifications allow a remote attacker to inject and execute abitrary Javascript in a user's browser via the successMessage...

Cross-Site Scripting (XSS)

modperl is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript in a user's browser via el/functions.jsp, el/implicit-objects.jsp and jspx/textRotate.jspx in examples/jsp2...

Cross-Site Scripting (XSS)

mailman is vulnerable to cross-site scripting XSS. A listowner is able to inject and execute arbitrary Javascripts in a user's browser via the listinfo pages...

Cross-Site Scripting (XSS)

silverstripe/framework is vulnerable to cross-site scripting XSS. A remote attacker is able to inject and execute arbitrary Javascript into a user's browser via the login and custom forms...

Cross-Site Scripting (XSS)

erubis is vulnerable to cross-site scripting XSS. The single quote character ' is not validated and allows a remote attacker to inject and execute arbitrary Javascript in a user's browser via a template source and a malicious XML document...

Cross-Site Scripting (XSS)

Auth0-Lock is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary and execute arbitrary Javascript into a user's browser via the placeholder property. Customers using the additionalSignUpFields customization option are affected...

WordPress < 5.3.1

WordPress versions 5.3.0 and earlier are affected by the following vulnerabilities: - Two cross-site scripting XSS vulnerabilities exist due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit these, by convincing a user to click a specially crafted URL,...

Cisco Unity Connection Web Framework XSS (cisco-sa-20191002-cuc-xss)

A cross-site scripting XSS vulnerability exists due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script code in a user's browser session...

Cisco Firepower Management Center Software Stored Cross-Site Scripting (XSS) Vulnerability (cisco-sa-20191016-fpwr-xss)

According to its self-reported version, Cisco Firepower Management Center is prior to 6.5.0. It is, therefore, affected by a cross-site scripting XSS vulnerability due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this,...

CVE-2016-5819

Moxa G3100V2 Series, editions prior to Version 2.8, and OnCell G3111/G3151/G3211/G3251 Series, editions prior to Version 1.7 allows a reflected cross-site scripting attack which may allow an attacker to execute arbitrary script code in the user’s browser within the trust relationship between thei...

Cross-Site Scripting (XSS)

contao/core-bundle is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the system logs, which would be executed in the context of the user's browser when the user loads the logs...

Cross-Site Scripting (XSS)

moodle/moodle is vulnerable to cross-site scripting XSS. The user's full name is not escaped before displaying on a user's browser, allowing a remote attacker to inject arbitrary Javascript into a victim's browser through the title parameter...