CVE-2024-46333

An authenticated cross-site scripting XSS vulnerability in Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Album Name parameter under the Add Album function...

PT-2024-31994

Name of the Vulnerable Software and Affected Versions iq3xcite versions 2.31 through 3.05 Description A cross-site scripting XSS issue in the "/test/" component allows attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations For versions 2.31 through 3.05, conside...

CVE-2024-8741: Improper Neutralization of Input During Web Page Generation

The Beam me up Scotty – Back to Top Button plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to inject...

CVE-2024-8713: Improper Neutralization of Input During Web Page Generation

The Kodex Posts likes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.5.0. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag...

SAP NetWeaver AS Cross-Site Scripting Vulnerability (CNVD-2024-49630)

SAP NetWeaver AS is a SAP network application server from SAP. It not only provides network services, but also the basic platform for SAP software. SAP NetWeaver AS suffers from a cross-site scripting vulnerability that stems from insufficient coding of user control input, which can be exploited ...

CVE-2024-8724: Improper Neutralization of Input During Web Page Generation

The Waitlist Woocommerce Back in stock notifier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to inject...

CVE-2024-44837: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the component \bean\Manager.java of Drug v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user parameter...

CVE-2024-42904: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in SysPass 3.2.x allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter at /Controllers/ClientController.php...

NetIQ Advanced Authentication Cross-Site Scripting Vulnerability

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a more secure way to protect your sensitive information by moving away from usernames and passwords. A cross-site scripting vulnerability exists in NetIQ Advanced Authentication versions prior to 6.3.5.1, which stems from ...

Kashipara Music Management System Cross-Site Scripting Vulnerability (CNVD-2024-37431)

Kashipara Music Management System is a music management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Music Management System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the title and description parameters of...

Fortinet FortiSOAR Cross-Site Scripting Vulnerability (CNVD-2025-00411)

Fortinet FortiSOAR is a Security Orchestration, Automation and Response SOAR solution from Fortinet. Fortinet FortiSOAR suffers from a cross-site scripting vulnerability that originates from entering an incorrect neutralization during web page generation. A remote attacker could exploit this...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2024-37806)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2024-37807)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2024-37809)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2024-37811)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Kashipara Hotel Management System security vulnerabilities

Kashipara Hotel Management System is a hotel management system from Kashipara. A cross-site scripting vulnerability exists in Kashipara Hotel Management System v1.0, which stems from the lack of effective filtering and escaping of user-supplied data in the useremail parameter of...

CVE-2024-42779

An Unrestricted file upload vulnerability was found in "/music/ajax.php?action=savemusic" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file...

Mini Inventory and Sales Management System security vulnerabilities

Mini Inventory and Sales Management System is a small inventory and sales management system written in PHP CodeIgniter framework that supports MySQL and Sqlite3 databases. A security vulnerability exists in Mini Inventory and Sales Management System. An attacker can exploit this vulnerability to...

TpMeCMS Cross-Site Scripting Vulnerability

TpMeCMS is a CMS developed on the FastAdmin framework. TpMeCMS version 1.3.3.2 suffers from a cross-site scripting vulnerability, which originates from the lack of effective filtering and escaping of user-supplied data in the parameter Site Name/Beian/Contact address/copyright/technical support i...

ZZCMS content parameter cross-site scripting vulnerability

ZZCMS is a content management system CMS by the ZZCMS team in China. A cross-site scripting vulnerability exists in ZZCMS v2023, which originates from the lack of effective filtering and escaping of user-supplied data in the content parameter of /user/askedit.php?action=add, which can be exploite...