CVE Daily
← All tags

Tag: Cross-site Scripting (XSS)

All CVEs associated with "Cross-site Scripting (XSS)". Page 7/8 • 871 CVEs.

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0
2025-03-01
Medium

CVE-2025-1459

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Embedded Video(PB) widget in all versions up to, and including, 2.31.4 due to insufficient inp…

CVSS: 6.4 CWE: CWE-79
Read more
2025-02-26
Medium

CVE-2025-20116

A vulnerability in the web UI of Cisco APIC could allow an authenticated, remote attacker to perform a stored XSS attack on an affected system. To exploit this vulnerability, the attacker must have v…

CVSS: 4.8 CWE: CWE-79
Read more
Medium

CVE-2025-0719

IBM Cloud Pak for Data 4.0.0 through 4.8.5 and 5.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus…

CVSS: 6.1 CWE: CWE-79
Read more
2025-02-24
High

CVE-2025-26530

The question bank filter required additional sanitizing to prevent a reflected XSS risk.

CVSS: 8.3 CWE: CWE-79
Read more
High

CVE-2025-26529

Description information displayed in the site administration live log required additional sanitizing to prevent a stored XSS risk.

CVSS: 8.3 CWE: CWE-79
Read more
Low

CVE-2025-26528

The drag-and-drop onto image (ddimageortext) question type required additional sanitizing to prevent a stored XSS risk.

CVSS: 3.4 CWE: CWE-79
Read more
2025-02-20
Medium

CVE-2024-13802

The Bandsintown Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bandsintown_events' shortcode in all versions up to, and including, 1.3.1 due to insufficien…

CVSS: 6.4 CWE: CWE-79
Read more
2025-02-19
Medium

CVE-2024-28776

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thu…

CVSS: 5.4 CWE: CWE-79
Read more
2025-02-17
Low

CVE-2025-1392

A vulnerability has been found in D-Link DIR-816 1.01TO and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/webproc?getpage=html/index.html&…

CVSS: 3.5 CWE: CWE-79
Read more
2025-02-13
Medium

CVE-2024-54951

Monica 4.1.2 is vulnerable to Cross Site Scripting (XSS). A malicious user can create a malformed contact and use that contact in the "HOW YOU MET" customization options to trigger the XSS.

CVSS: 5.4 CWE: CWE-79
Read more
Medium

CVE-2025-25287

Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious s…

CVSS: 4.7 CWE: CWE-79
Read more
High

CVE-2024-46910

An authenticated user can perform XSS and potentially impersonate another user. This issue affects Apache Atlas versions 2.3.0 and earlier. Users are recommended to upgrade to version 2.4.0, which…

CVSS: 7.1 CWE: CWE-80
Read more
2025-02-12
High

CVE-2025-0376

An XSS vulnerability exists in GitLab CE/EE affecting all versions from 13.3 prior to 17.6.5, 17.7 prior to 17.7.4 and 17.8 prior to 17.8.2 that allows an attacker to execute unauthorized actions via…

CVSS: 8.7 CWE: CWE-79
Read more
2025-02-11
High

CVE-2024-27781

An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiSandbox at least versions 4.4.0 through 4.4.4 and 4.2.0 through 4.2.6 and 4.0.0 through 4.0.4…

CVSS: 7.1 CWE: CWE-79
Read more
Low

CVE-2024-27780

Multiple Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerabilities [CWE-79] in FortiSIEM 7.1 all versions, 7.0 all versions, 6.7 all versions incident page…

CVSS: 2.2 CWE: CWE-79
Read more
High

CVE-2024-12755

A Cross-Site Scripting (XSS) vulnerability in Avaya Spaces may have allowed unauthorized code execution and potential disclose of sensitive information.

CVSS: 7.9 CWE: CWE-79
Read more
2025-02-10
Medium

CVE-2025-25247

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix Webconsole 4.x up to 4.9.8 and 5.x up t…

CVSS: 6.1 CWE: CWE-79
Read more
2025-02-07
High

CVE-2024-10383

An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE s…

CVSS: 8.7 CWE: CWE-79
Read more
2025-02-06
Medium

CVE-2024-52892

IBM Jazz for Service Management 1.1.3 through 1.1.3.23 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI th…

CVSS: 6.1 CWE: CWE-79
Read more
2025-02-05
Medium

CVE-2025-20180

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an authenticated, remote attacker to conduc…

CVSS: 4.8 CWE: CWE-79
Read more
Medium

CVE-2024-52365

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to stored cross-site scripting…

CVSS: 6.4 CWE: CWE-79
Read more
Medium

CVE-2024-52364

IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is vulnerable to cross-site scripting. This vu…

CVSS: 5.4 CWE: CWE-79
Read more
2025-02-04
Medium

CVE-2024-40700

IBM Security Verify Access Appliance and Container 10.0.0 through 10.0.8 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript cod…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2025-0825

cpp-httplib version v0.17.3 through v0.18.3 fails to filter CRLF characters ("\r\n") when those are prefixed with a null byte. This enables attackers to exploit CRLF injection that could further lead…

CVSS: 5.3 CWE: CWE-113
Read more
Medium

CVE-2024-13403

The WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘fieldHTML’ parameter in all ve…

CVSS: 6.4 CWE: CWE-79
Read more
Medium

CVE-2024-13325

The Glossy WordPress plugin through 2.3.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high…

CVSS: 6.1 CWE: CWE-79
Read more
2025-01-31
Medium

CVE-2024-49349

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed ar…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2024-49339

IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.1 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed ar…

CVSS: 6.4 CWE: CWE-79
Read more
2025-01-30
Medium

CVE-2024-12409

The Simple:Press Forum plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 6.10.11 due to insufficient input sanitization…

CVSS: 6.1 CWE: CWE-79
Read more
2025-01-27
Medium

CVE-2023-46187

IBM InfoSphere Master Data Management 11.6, 12.0, and 14.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering…

CVSS: 5.4 CWE: CWE-79
Read more
2025-01-24
Medium

CVE-2025-24731

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IP2Location Download IP2Location Country Blocker allows Stored XSS. This issue affects Download I…

CVSS: 5.9 CWE: CWE-79
Read more
High

CVE-2025-0314

An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.6.4, 17.7 before 17.7.3, and 17.8 before 17.8.1. Improper rendering of certain file types lead to cross-site sc…

CVSS: 8.7 CWE: CWE-79
Read more
2025-01-23
Medium

CVE-2024-57329

HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attackers to inject and execute arbitrary JavaSc…

CVSS: 5.4 CWE: CWE-79
Read more
Medium

CVE-2025-23227

IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.11 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript…

CVSS: 6.4 CWE: CWE-79
Read more
Medium

CVE-2024-12504

The Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'videowhisper_hls' shortcode in all versi…

CVSS: 6.4 CWE: CWE-79
Read more
2025-01-22
Medium

CVE-2024-51457

IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitr…

CVSS: 4.4 CWE: CWE-79
Read more
2025-01-21
High

CVE-2025-22763

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affects Brizy Pro: from n/a through 2.6.1.

CVSS: 7.1 CWE: CWE-79
Read more
2025-01-17
Medium

CVE-2024-26157

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in get view method under view parameter. The ETIC RAS web serve…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2024-26156

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in the method parameter. The ETIC RAS web server uses dynamic p…

CVSS: 4.8 CWE: CWE-79
Read more
Medium

CVE-2024-26154

All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance site name. The ETIC RAS web server saves the site name and t…

CVSS: 4.8 CWE: CWE-79
Read more
2025-01-16
High

CVE-2024-41746

IBM CICS TX Advanced 10.1, 11.1, and Standard 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int…

CVSS: 7.2 CWE: CWE-79
Read more
2025-01-14
Medium

CVE-2024-12240

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions up to, and including, 2.31.0 due to insufficient input san…

CVSS: 6.4 CWE: CWE-79
Read more
Medium

CVE-2024-13323

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'booking' shortcode in all versions up to, and including, 10.9.2 due to insufficient input s…

CVSS: 6.4 CWE: CWE-79
Read more
2025-01-08
Medium

CVE-2025-20168

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks ag…

CVSS: 5.4 CWE: CWE-86
Read more
Medium

CVE-2025-20167

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks ag…

CVSS: 5.4 CWE: CWE-86
Read more
Medium

CVE-2025-20166

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks ag…

CVSS: 5.4 CWE: CWE-86
Read more
Medium

CVE-2025-20123

Multiple vulnerabilities in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks agains…

CVSS: 4.8 CWE: CWE-79
Read more
2025-01-07
High

CVE-2024-11626

Improper Neutralization of Input During CMS Backend (adminstrative section) Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Progress Sitefinity.This issue affects Sitefinity: fro…

CVSS: 8.4 CWE: CWE-79
Read more
2025-01-04
Medium

CVE-2024-12047

The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including,…

CVSS: 6.1 CWE: CWE-79
Read more
2024-12-18
Medium

CVE-2024-55492

Winmail Server 4.4 is vulnerable to f_user=%22%3E%3Csvg%20onload Cross Site Scripting (XSS).

CVSS: 6.1 CWE: CWE-79
Read more
2024-12-10
Medium

CVE-2024-47117

IBM Carbon Design System (Carbon Charts 0.4.0 through 1.13.16) is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI…

CVSS: 5.4 CWE: CWE-79
Read more
2024-12-09
Medium

CVE-2024-53285

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote aut…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2024-53284

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows r…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2024-53283

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Router Port Forward functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows re…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2024-53282

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in WiFi Connect MAC Filter functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allow…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2024-53281

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Network WOL functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote aut…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2024-53280

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in network center policy route functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 a…

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2024-53279

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in file station functionality in Synology Router Manager (SRM) before 1.3.1-9346-10 allows remote au…

CVSS: 5.9 CWE: CWE-79
Read more
2024-12-07
Medium

CVE-2024-47107

IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionali…

CVSS: 6.4 CWE: CWE-79
Read more
Medium

CVE-2024-12167

The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_wpnonce' parameter in all versions up to, and including, 2.2.0 due to insufficien…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2024-12166

The Shortcodes Blocks Creator Ultimate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 2.2.0 due to insufficient in…

CVSS: 6.1 CWE: CWE-79
Read more
2024-12-06
Medium

CVE-2024-12326

Jirafeau normally prevents browser preview for SVG files due to the possibility that manipulated SVG files could be exploited for cross site scripting. This was done by storing the MIME type of a fil…

CVSS: 6.1 CWE: CWE-79
Read more
2024-12-02
Medium

CVE-2024-53988

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used wi…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2024-53987

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used wi…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2024-53986

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used wi…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2024-53985

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used wi…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2024-53989

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. There is a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer 1.6.0 when used wi…

CVSS: 6.1 CWE: CWE-79
Read more
2024-11-28
Medium

CVE-2024-11685

The `Kudos Donations – Easy donations and payments with Mollie` plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of `add_query_arg` without appropriate escaping on…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2024-11684

The Kudos Donations – Easy donations and payments with Mollie plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 3.2.9 du…

CVSS: 6.1 CWE: CWE-79
Read more
2024-11-23
Medium

CVE-2024-10116

The Twitter Follow Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 0.2 due to insufficient input sanitizati…

CVSS: 6.4 CWE: CWE-79
Read more
2024-11-21
Low

CVE-2024-51337

Cross Site Scripting vulnerability in Gibbon before v.27.0.01 and fixed in v.28.0.00 allows a remote attacker to obtain sensitive information via the email parameter found in /Gibbon/modules/User Adm…

CVSS: 3.5 CWE: CWE-79
Read more
2024-11-20
Medium

CVE-2024-52597

2FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes. Versions prior to 5.4.1 are vulnerable to stored cross-site scripting due to improper headers…

CVSS: 6.1 CWE: CWE-79
Read more
2024-11-18
Medium

CVE-2020-26067

A vulnerability in the web-based interface of Cisco Webex Teams could allow an authenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to improper valid…

CVSS: 5.4 CWE: CWE-80
Read more
Medium

CVE-2020-3420

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could a…

CVSS: 5.4 CWE: CWE-79
Read more
Medium

CVE-2024-9526

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The de…

CVSS: 5.4 CWE: CWE-79
Read more
2024-11-15
Medium

CVE-2022-20632

A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface of an affected device.…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2023-20060

A vulnerability in the web-based management interface of Cisco Prime Collaboration Deployment could allow an unauthenticated, remote attacker to conduct a cross-site scripting attack against a user o…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2022-20663

A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Stealthwatch Enterprise, could allow an unauthenticated, remote attacker to conduct a cross-site…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2022-20657

A vulnerability in the web-based management interface of Cisco PI and Cisco EPNM could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface of…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2022-20654

A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based…

CVSS: 6.1 CWE: CWE-80
Read more
Medium

CVE-2022-20631

A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface of an affected device.…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2022-20626

A vulnerability in the web-based management interface of Cisco Prime Access Registrar Appliance could allow an authenticated, remote attacker to conduct a cross-site scripting attack against a u…

CVSS: 5.5 CWE: CWE-79
Read more
Medium

CVE-2024-41785

IBM Concert Software 1.0.0 through 1.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering th…

CVSS: 6.1 CWE: CWE-79
Read more
2024-11-06
Medium

CVE-2024-20540

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an authenticated, remote attacker with low privileges to conduct a s…

CVSS: 5.4 CWE: CWE-79
Read more
Medium

CVE-2024-20514

A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authenticated, low-privileged, remote attacker…

CVSS: 5.4 CWE: CWE-79
Read more
Medium

CVE-2024-20511

A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) could a…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2024-20504

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Secure Email Gateway, and Secure Web Appliance could allow an authenticated, re…

CVSS: 5.4 CWE: CWE-80
Read more
2024-10-22
Medium

CVE-2024-10234

A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious…

CVSS: 6.1 CWE: CWE-79
Read more
2024-10-16
Medium

CVE-2024-20512

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal (Unified CCMP) could allow an unauthenticated, remote attacker to conduct a reflected cross-sit…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2024-47139

A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IQ Configuration utility that allows an attacker with the Administrator role to run JavaScript in the contex…

CVSS: 6.8 CWE: CWE-80
Read more
2024-10-12
Medium

CVE-2024-9595

The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the table cell content in all versions up to, and including, 2.4.2 due to insuffic…

CVSS: 6.4 CWE: CWE-79
Read more
2024-10-11
Low

CVE-2024-9856

A vulnerability was found in 07FLYCMS, 07FLY-CMS and 07FlyCRM 1.3.8. It has been rated as problematic. Affected by this issue is some unknown functionality of the component System Settings Page. The…

CVSS: 2.4 CWE: CWE-79
Read more
2024-10-05
High

CVE-2024-47384

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Compress WP Compress – Image Optimizer [All-In-One] allows Reflected XSS.This issue aff…

CVSS: 7.1 CWE: CWE-79
Read more
2024-09-26
Medium

CVE-2024-47075

LayUI is a native minimalist modular Web UI component library. Versions prior to 2.9.17 have a DOM Clobbering vulnerability that can lead to Cross-site Scripting (XSS) on web pages where attacker-con…

CVSS: 6.4 CWE: CWE-79
Read more
2024-09-17
Medium

CVE-2024-8907

Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts…

CVSS: 6.1 CWE: CWE-79
Read more
2024-09-10
Medium

CVE-2024-34831

cross-site scripting (XSS) vulnerability in Gibbon Core v26.0.00 allows an attacker to execute arbitrary code via the imageLink parameter in the library_manage_catalog_editProcess.php component.

CVSS: 6.1 CWE: CWE-79
Read more
2024-08-29
High

CVE-2024-43958

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gianni Porto IntoTheDark allows Reflected XSS.This issue affects IntoTheDark: from n/a thr…

CVSS: 7.1 CWE: CWE-79
Read more
2024-08-21
High

CVE-2024-21690

This High severity Reflected XSS and CSRF (Cross-Site Request Forgery) vulnerability was introduced in versions 7.19.0, 7.20.0, 8.0.0, 8.1.0, 8.2.0, 8.3.0, 8.4.0, 8.5.0, 8.6.0, 8.7.1, 8.8.0, and 8.9.…

CVSS: 8.2 CWE: CWE-79
Read more
2024-08-18
High

CVE-2024-43238

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in weDevs weMail allows Reflected XSS.This issue affects weMail: from n/a through 1.14.5.

CVSS: 7.1 CWE: CWE-79
Read more
2024-08-01
Medium

CVE-2024-39648

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 4.0.5.

CVSS: 5.9 CWE: CWE-79
Read more
Medium

CVE-2024-2872

The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Sit…

CVSS: 4.8 CWE: CWE-79
Read more
2024-07-22
Medium

CVE-2024-37100

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Mayur Somani, threeroutes media Elegant Themes Icons allows Stored XSS.This issue affects…

CVSS: 6.5 CWE: CWE-79
Read more
2024-07-21
Medium

CVE-2024-37507

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 3.3.57.

CVSS: 6.5 CWE: CWE-79
Read more
2024-06-22
Medium

CVE-2024-4940

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for…

CVSS: 6.1 CWE: CWE-601
Read more
2024-06-18
Medium

CVE-2024-38274

Insufficient escaping of calendar event titles resulted in a stored XSS risk in the event deletion prompt.

CVSS: 6.1 CWE: CWE-79
Read more
2024-06-15
Low

CVE-2024-6006

A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Summer Schedule Handler. The…

CVSS: 3.5 CWE: CWE-79
Read more
Low

CVE-2024-6005

A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Department Section.…

CVSS: 3.5 CWE: CWE-79
Read more
2024-06-11
Critical

CVE-2024-31401

Cross-site scripting vulnerability in Cybozu Garoon 5.0.0 to 5.15.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script on the web browser of the use…

CVSS: 9.0 CWE: CWE-79
Read more
2024-05-27
Low

CVE-2024-5385

A vulnerability, which was classified as problematic, has been found in oretnom23 Online Car Wash Booking System 1.0. This issue affects some unknown processing of the file /admin/?page=user/list. Th…

CVSS: 2.4 CWE: CWE-79
Read more
2024-05-25
Medium

CVE-2024-4045

The Popup Builder by OptinMonster – WordPress Popups for Optins, Email Newsletters and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘campaign_id’ paramete…

CVSS: 6.4 CWE: CWE-79
Read more
2024-05-23
Medium

CVE-2024-3648

The ShareThis Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sharethis-inline-button' shortcode in all versions up to, and including, 2.3.0 due to i…

CVSS: 6.4 CWE: CWE-79
Read more
2024-05-21
Medium

CVE-2024-4361

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siteorigin_widget' shortcode in all versions up to, and including, 2.29.15 due to in…

CVSS: 6.4 CWE: CWE-79
Read more
2024-05-15
Medium

CVE-2024-20392

A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack.…

CVSS: 6.1 CWE: CWE-113
Read more
Medium

CVE-2024-20383

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager could allow an authenticated, remote attacker to conduct an XSS attack against a…

CVSS: 4.8 CWE: CWE-79
Read more
Medium

CVE-2024-20258

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an unauthenticated, remote attacker to cond…

CVSS: 6.1 CWE: CWE-79
Read more
Medium

CVE-2024-20257

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an authenticated, remote attacker to conduct an XSS attack against a user of…

CVSS: 4.8 CWE: CWE-79
Read more
Medium

CVE-2024-20256

A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Web Appliance could allow an authenticated, remote attacker to conduc…

CVSS: 4.8 CWE: CWE-79
Read more
2024-05-14
Medium

CVE-2024-4445

The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, an…

CVSS: 6.5 CWE: CWE-601
Read more
Low

CVE-2024-28866

GoCD is a continuous delivery server. GoCD versions from 19.4.0 to 23.5.0 (inclusive) are potentially vulnerable to a reflected cross-site scripting vulnerability on the loading page displayed while…

CVSS: 3.1 CWE: CWE-79
Read more
2024-05-03
High

CVE-2023-42034

Visualware MyConnection Server doRTAAccessCTConfig Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installati…

CVSS: 8.8 CWE: CWE-79
Read more