CVE-2024-53563: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

WordPress plugin Hash Elements cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Hash...

WordPress Plugin Groundhogg Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2024-11328

The CLUEVO LMS, E-Learning Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.13.2. This makes it possible for unauthenticated attackers to...

CVE-2024-11686

CVE-2024-11686 details: WhatsApp click to chat WordPress plugin (manycontacts-bar) is vulnerable to Reflected Cross-Site Scripting via the manycontacts_code parameter in all versions up to 3.0.4, due to insufficient input sanitization and output escaping. The issue allows unauthenticated attacker...

CVE-2024-12218 Woocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

The Woocommerce check pincode/zipcode for shipping plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. This is due to missing or incorrect nonce validation. This makes it possible for unauthenticated attackers to inject malicious web scrip...

PT-2025-1803

Name of the Vulnerable Software and Affected Versions Simple Add Pages or Posts plugin for WordPress versions up to, and including, 2.0.0 Description The issue is due to missing or incorrect nonce validation, allowing unauthenticated attackers to update settings and inject malicious web scripts v...

CVE-2024-46209: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter...

LightPicture code injection vulnerability

LightPicture is an enterprise/team/personal image resource management system, picture bed system. LightPicture cross-site scripting vulnerability , the vulnerability stems from the file/api/upload parameter file on the user-supplied data lack of effective filtering and escaping , an attacker can...

CVE-2024-12475

The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inje...

JetBrains TeamCity Image Name Cross-Site Scripting Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A cross-site scripting vulnerability exists in...

CVE-2024-12100

CVE-2024-12100 affects Bitcoin Lightning Publisher for WordPress (WordPress plugin) up to version 1.4.1. The vulnerability is a Reflected Cross-Site Scripting (XSS) caused by using add_query_arg without proper escaping on URLs, enabling unauthenticated attackers to inject and execute scripts in p...

Reflected Cross-Site Scripting (Reflected XSS)

Liferay Portal is vulnerable to reflected cross-site scripting XSS. The vulnerability is due to improper handling of user input in the Dispatch name field, allowing remote attackers to execute arbitrary web script or HTML...

CVE-2024-11331

CVE-2024-11331 affects the isee-products-extractor plugin for WordPress (ppy: “استخراج محصولات ووکامرس برای آیسی”). The vulnerability is a Reflected Cross‑Site Scripting in which add_query_arg and remove_query_arg are used without proper escaping, in all versions up to and including 2.1.3. This e...

GHSA-PX38-239G-X5MG Liferay Portal and Liferay DXP have Cross-site Scripting vulnerability in edit Service Access Policy page

Cross-site scripting XSS vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted...

CVE-2023-37940

Cross-site scripting XSS vulnerability in the edit Service Access Policy page in Liferay Portal 7.0.0 through 7.4.3.87, and Liferay DXP 7.4 GA through update 87, 7.3 GA through update 29, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted...

CVE-2023-37940

This CVE refers to a Cross-site Scripting (XSS) vulnerability in the Service Access Policy edit page of Liferay Portal and Liferay DXP. A crafted payload placed in the Service Class field can inject script/HTML, affecting Liferay Portal versions 7.0.0–7.4.3.87 and Liferay DXP 7.4 GA–update 87, an...

Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.1.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38, 7.3 GA through update 36, 7.2 GA through fix pack 20 and 7.1 GA through fix pack 28 allows remote attackers to execute arbitrary web script or HTML via Dispatch nam...

CVE-2024-11993

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field...

CVE-2024-11993

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows remote attackers to execute arbitrary web script or HTML via Dispatch name field...