cPanel < 11.109.9999.116 - Cross-Site Scripting

An issue was discovered in cPanel before 11.109.9999.116. Cross Site Scripting can occur on the cpsrvd error page via an invalid webcall ID. id: CVE-2023-29489 info: name: cPanel 11.109.9999.116 - Cross-Site Scripting author: DhiyaneshDk,0xKayala severity: medium description: | An issue was...

OpenEMR < 7.0.1 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. id: CVE-2023-2948 info: name: OpenEMR 7.0.1 - Cross-Site Scripting author: ritikchaddha,princechaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr...

Adobe ColdFusion WDDX Deserialization Gadgets

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. Exploitation of this issue does not require user interaction. id: CVE-2023-44353 info: name: Adobe ColdFusion WDDX...

Advanced Custom Fields < 6.1.6 - Cross-Site Scripting

Advanced Custom Fields beofre 6.1.6 is susceptible to cross-site scripting via the poststatus parameter due to insufficient input sanitization and output escaping. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow th...

Jenkins build-metrics 1.3 - Cross-Site Scripting

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. id: CVE-2019-10475 info: name: Jenkins build-metrics 1.3 - Cross-Site Scripting author: madrobot severity...

HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route

The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the /includes/class-template-designer.php file, in versions up to...

Advantech R-SeeNet - Cross-Site Scripting

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the graph parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. id: CVE-2021-21801 info: name: Advantech R-SeeNet - Cross-Site Scripting author: gy74...

Nagios XI < 5.8.6 - Cross-Site Scripting

In Nagios XI before 5.8.6, XSS exists in the dashboard page /dashboards/ when administrative users attempt to edit a dashboard. id: CVE-2021-38156 info: name: Nagios XI 5.8.6 - Cross-Site Scripting author: ritikchaddha severity: medium description: | In Nagios XI before 5.8.6, XSS exists in the...

Netsweeper - Authentication Bypass

The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL. id: CVE-2014-9618 info: name: Netsweeper - Authentication...

Adobe Coldfusion - Cross-Site Scripting

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an unauthenticated attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within th...

Citrix StoreFront - Cross-Site Scripting

Reflected Cross-Site Scripting issue which is exploitable without authentication. This vulnerability was exploitable through coercing an error message during an XML parsing procedure in the SSO flow. id: CVE-2023-5914 info: name: Citrix StoreFront - Cross-Site Scripting author: DhiyaneshDK...

WP Helper Lite < 4.3 - Cross-Site Scripting

The WP Helper Lite WordPress plugin, in versions 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability. id: CVE-2023-0448 info: name: WP Helper Lite 4.3 - Cross-Site Scripting author: ritikchaddha severity: medium description: | T...

Apache Tomcat - Cross-Site Scripting

Apache Tomcat 9.0.0.M1 to 9.0.0.17, 8.5.0 to 8.5.39, and 7.0.0 to 7.0.93 are vulnerable to cross-site scripting because the SSI printenv command echoes user provided data without escaping. Note: SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be prese...

CVE-2025-66470

NiceGUI XSS Scanner - CVE-2025-66470 📸 Schermata Uno scanner veloce e semplice per rilevare CVE-2025-66470 - vulnerabilità XSS nel componente ui.interactiveimage di NiceGUI. 🔍 Dettagli della vulnerabilità Campo| Valore ---|--- CVE| CVE-2025-66470 GHSA| GHSA-2m4f-cg75-76w2 Componente|...

CVE-2017-6913

CVE-2017-6913 Questa è una vulnerabilità che ho trovato nella webmail di open-xchange OX App Suite https://www.open-xchange.com/ qualche tempo fa. Dettagli della vulnerabilità La webmail era vulnerabile a uno stored XSS all'apertura di un'email, a causa del fatto che gli attributi evento del tag...

CVE-2021-37833

CVE 2021-37833 Hotel Druid 3.0.2 Vulnerabilità di Cross Site Scripting Riflessa Esiste una vulnerabilità di Cross Site Scripting riflessa in più pagine della versione 3.0.2 dell'applicazione Hotel Druid che consente l'esecuzione arbitraria di comandi JavaScript...

CVE-2023-37979

CVE-2023-37979 Unauthentifizierte Reflected Cross-Site Scripting XSS Schwachstelle im Saturday Drive Ninja Forms Contact Form Plugin = 3.6.25 Versionen. PoC und Checker , nur zu Bildungszwecken 'python3 exploit.py https://target.com'...

CVE-2019-19651

CVE-2019-19651 Chevereto XSS riflesso in Nome sito, titolo documento e descrizione - 1.0.0 - 1.1.4 Free, Impostazioni - Nome sito, Titolo documento sito, Descrizione sito Inserendolo, verrà riflesso su tutto il sito per tutti gli utenti root@kitploit: "ChevtChevt...

CVE-2023-36163

Exploit Title: BuildaGate5library - Cross-Site Scripting riflesso XSS Data: 06/07/2023 Autore Exploit: Idan Malihi Homepage del fornitore: Nessuna Versione: 5 Testato su: Microsoft Windows 10 Pro CVE: CVE-2023-36163 PoC: Un attaccante deve trovare il parametro vulnerabile mc= e iniettare il codic...

CVE-2020-25627

CVE-2020-25627 Gespeichertes XSS über den Parameter moodlenetprofile im Benutzerprofil Mein PoC zu dieser CVE Benutzeranforderung: Student oder die Website für die Registrierung XSS im Parameter moodlenetprofile root@kitploit: Step 1: Log in with an authenticated user Can register or through...