1048021 matches found
CVE-2022-32988
CVE-2022-32988 Prodotti interessati Non abbiamo ancora testato modelli Asus diversi da quelli elencati. Tuttavia sospettiamo che possa funzionare anche su altri modelli con la stessa versione del firmware. root@kitploit: DSL-N14UB1 V.1.1.2.3805 Panoramica Nel router Asus DSL-N14U-B1 1.1.2.3805 è...
EUVD-2026-67649
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...
CVE-2026-5510
GiveWP – Donation Plugin and Fundraising Platform for WordPress is vulnerable to Stored Cross-Site Scripting via the give_form shortcode in all versions up to and including 4.14.4 . The root cause is insufficient output escaping on the continue_button_title and display_style shortcode attributes,...
CVE-2026-5510 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...
CVE-2026-6128
The All-in-One WP Migration Unlimited Extension WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the ai1wm_backups_path parameter in all versions up to and including 2.84 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes, co...
EUVD-2026-67648
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...
CVE-2026-6128 All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wmbackupspath' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes combine...
CVE-2025-54962
🔥 CVE-2025-54962 — Unsicherer Datei-Upload im OpenPLC Runtime Webserver OpenPLC Runtime ≤ 2024-12-31 — Stored XSS, CSRF 📌 Zusammenfassung Ich habe eine Schwachstelle im OpenPLC Runtime Webserver Release-Version: 2024-12-31 entdeckt, die es authentifizierten Benutzern ermöglicht, beliebige Dateien...
CVE-2025-34157
Gespeichertes XSS im Coolify-Löschvorgang CVE-2025-34157 Betrifft: Coolify ≤ v4.0.0-beta.420.6 Behoben in: v4.0.0-beta.420.7 Schweregrad: Kritisch 9.4 CVSS-4.0-Vektor: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE: CWE-79 Cross-Site-Scripting, CWE-20 Unzureichende...
CVE-2024-48589
phpAbook 9.0i - Vulnerabilità di Cross-Site Scripting XSS CVE-2024-48589 Riepilogo: È stata scoperta una vulnerabilità di Cross-Site Scripting XSS nel parametro rol di index.php o nella sezione del percorso nell'applicazione phpAbook. Questa vulnerabilità consente a un attaccante di iniettare...
WordPress Booking for Appointments and Events Calendar plugin <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission vulnerability
Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission vulnerability discovered by Lucas Montes NiRoX in WordPress Plugin Amelia versions = 2.2...
WordPress ElementsKit Pro plugin <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 's' Parameter vulnerability discovered by Ren Voza in WordPress Plugin ElementsKit Pro versions = 4.10.1...
WordPress One User Avatar | User Profile Picture plugin <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file Parameter vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via wpua-file Parameter vulnerability discovered by Dthangws - PTIT in WordPress Plugin One User Avatar versions = 2.5.4...
WordPress LiteSpeed Cache plugin <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability
Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability discovered by Jack Taylor in WordPress Plugin LiteSpeed Cache versions = 7.8.1...
WordPress Forminator Forms plugin <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability
Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.57.0.1...
WordPress TranslatePress plugin <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser vulnerability
Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser vulnerability discovered by daroo in WordPress Plugin TranslatePress versions = 3.3.3...
WordPress Optimole plugin <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'a' abovefoldimages Parameter vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Optimole versions = 4.2.10...
CVE-2021-40906
CVE-2021-40906 - XSS riflesso in una zona non autenticata Applicazione: CheckMK Management Web Console Versione del software: dalla 1.5.0 alla 1.5.0p25 Autore: Edgar Augusto Loyola Torres. Tipo di attacco: XSS riflesso Soluzione: aggiornare alla revisione 1.6.0p26 o successiva Sommario: Il softwa...
CVE-2021-36563
CVE-2021-36563 – Múltiplos XSS Armazenados e Refletidos Aplicação: CheckMK Management Web Console Revisão do Software: De 1.5.0 a 2.0.0p9 Tipo de ataque: XSS Armazenado e Refletido Solução: Atualizar para a Revisão de Software 2.0.0p10 ou posterior Resumo: A console web de gestão do CheckMK versõ...
CVE-2026-9548
An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks...