CVE-2020-19282

Jeesns 1.4.2 is affected by a reflected cross-site scripting (XSS) vulnerability in the system error message text field. The issue allows an attacker to inject and execute arbitrary web scripts or HTML in a victim’s browser, potentially enabling session hijacking or data exposure. Root cause is a...

CVE-2020-19283

Jeesns 1.4.2 is vulnerable to a reflected cross-site scripting (XSS) in the /newVersion component. The issue allows an attacker to cause the victim’s browser to execute arbitrary web scripts or HTML, with potential outcomes including execution of malicious scripts in a session. The related nuclei...

CVE-2020-19295

Jeesns 1.4.2 is affected by a reflected XSS in the /weibo/topic component. A crafted payload in the system error message text field can execute arbitrary scripts/HTML in a victim’s browser. The issue is documented as CVE-2020-19295. Affected product: Jeesns 1.4.2 (reflected XSS) with the vulnerab...

CVE-2020-18035

CVE-2020-18035 is a cross-site scripting vulnerability in Jeesns v1.4.2. The issue arises in the CKEditor integration, specifically through the CKEditorFuncNum parameter in the file/component CkeditorUploadController.java, allowing remote attackers to craft inputs that execute arbitrary code in t...

CVE-2020-19287

CVE-2020-19287 affects Jeesns 1.4.2 with a stored XSS vulnerability in the /group/post component. The issue leverages a crafted payload in the title to execute arbitrary web scripts/HTML, enabling potential credential/session/data exposure depending on context. Public records in multiple feeds (N...

CVE-2018-17886

CVE-2018-17886 affects JEESNS 1.3. The vulnerability is a bypass of the XSS filter in com.lxinet.jeesns.core.utils.XssHttpServletRequestWrapper.java, demonstrated by a crafted

CVE-2022-38550

Jeesns v2.0.0 contains a stored XSS in the /weibo/list component. The vulnerability allows an attacker to execute arbitrary web scripts or HTML via a crafted payload. Affected software: Jeesns 2.0.0 (Web UI component /weibo/list). Root cause: stored XSS in the mentioned component. Impact: potenti...

CVE-2020-19280

Jeesns 1.4.2 is affected by a cross-site request forgery (CSRF) vulnerability that allows an attacker to escalate privileges and perform sensitive program operations. The available documents consistently describe CSRF as the flaw, but do not provide specific exploit details, affected endpoints, r...

CVE-2020-19291

Summary: CVE-2020-19291 is a stored cross-site scripting (XSS) vulnerability in the /weibo/publishdata component of JEESNS 1.4.2 that allows attackers to execute arbitrary web scripts or HTML via a crafted payload in a posted Weibo. Affected product/component: JEESNS 1.4.2; vulnerable path is /we...

CVE-2020-19292

CVE-2020-19292 affects Jeesns 1.4.2, with a stored XSS in the /question/ask component. The vulnerability allows an attacker to inject and execute arbitrary web scripts or HTML via a crafted payload in a posted question. The provided documents do not include exploitation details or an official rem...

CVE-2020-19290

CVE-2020-19290 is a stored cross-site scripting (XSS) vulnerability in the Jeesns 1.4.2 application, specifically in the /weibo/comment component. The issue enables an attacker to inject and execute arbitrary web scripts or HTML via a crafted payload submitted in Weibo comments. Connected sources...

CVE-2020-19294

Jeesns 1.4.2 contains a stored XSS vulnerability in the /article/comment component. A crafted payload placed in article comments can lead to execution of arbitrary web scripts/HTML. The available sources confirm the vulnerability and its presence in the specified version, but do not provide concr...

CVE-2018-12429

CVE-2018-12429 affects JEESNS up to version 1.2.1 and enables XSS by normal users publishing articles containing crafted payloads to capture an administrator cookie. Connected sources indicate the XSS filter in XssHttpServletRequestWrapper can be bypassed, and note that this vulnerability exists ...

CVE-2020-19293

CVE-2020-19293 describes a stored XSS in Jeesns 1.4.2’s /article/add, allowing a crafted payload in a posted article to execute script/HTML. The vulnerability is documented across multiple sources (NVD entry and industry disclosures) with the same impact: execution of arbitrary web scripts via us...

CVE-2020-19281

Jeesns 1.4.2 is affected by a stored XSS in the /manage/loginusername field. The vulnerability allows attackers to inject arbitrary web scripts or HTML via a crafted payload in the username parameter. The connected documents confirm the affected component and entry point but do not provide a patc...

CVE-2020-19284

A stored XSS vulnerability (CVE-2020-19284) affects Jeesns 1.4.2 in the /group/comment component, allowing an attacker to inject arbitrary scripts/HTML via the group comments text field. The connected sources consistently describe this as a stored XSS in that exact location; the root cause is des...

CVE-2020-19286

CVE-2020-19286 is a stored XSS in Jeesns 1.4.2. The vulnerability resides in the /question/detail component, exploitable via a crafted payload in the editor’s source field, allowing arbitrary web scripts or HTML execution. The connected Red Hat, CNVD, OSV, and CVE records corroborate a stored XSS...

CVE-2020-19289

Jeesns 1.4.2 contains a stored XSS vulnerability in the /member/picture/album component, exploitable via a crafted payload in the New Album tab. Root cause is a failure to sanitize user input, enabling arbitrary web script/HTML execution. The connected sources consistently describe the same issue...

CVE-2018-19178

CVE-2018-19178 concerns JEESNS 1.3. The vulnerability is in com/lxinet/jeesns/core/utils/XssHttpServletRequestWrapper.java and allows stored XSS via an HTML EMBED element. This CVE entry notes it is a different issue from CVE-2018-17886. The available sources describe the affected component and t...

CVE-2020-19288

Jeesns 1.4.2 has a stored XSS in the /localhost/u component that allows attackers to inject and execute arbitrary scripts via a crafted payload in a private message. Public references confirm the vulnerability and its impact; no specific exploit details or remediation are provided in the connecte...

CVE-2020-19285

The CVE-2020-19285 entry describes a stored XSS vulnerability in Jeesns 1.4.2. Affected component: /group/apply, where an attacker can inject arbitrary web scripts via the Name field, enabling script execution in a user’s browser. Root cause is improper input handling in the group/apply payload p...