Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters leading to XSS via &# HTML entities.


index.php/appointment/insert_patient_add_appointment

in

Chikitsa

Patient

Management

System

allows

XSS.


In Nagios XI before 5.8.6 XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.


PluXML 5.8.7 allows Article Editing stored XSS via Headline or Content.


Certain

Motorola

Solutions

Avigilon

devices

allow

XSS

in

the

administrative

UI.

This

affects

before

before

before

before

before

and

and

before


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Crocoblock JetEngine before 2.6.1 allows XSS by remote authenticated users via a custom form input.


An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML SVG and MathML are mishandled a similar issue to CVE-2020-26870.


** UNSUPPORTED WHEN ASSIGNED ** LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


PluXML 5.8.7 allows core/admin/profil.php stored XSS via the Information field.


An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account it is possible for the customer to log in and proceed with a change of name and last name. However these fields are vulnerable to XSS payload insertion being triggered in the admin panel when the admin tries to see the client list. This type of XSS (stored) can lead to the extraction of the PHPSESSID cookie belonging to the admin.


In ocProducts Composr CMS before 10.0.38 an attacker can inject JavaScript via the staff_messaging messaging system for XSS.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS.


NETGEAR RAX40 devices before 1.0.3.64 are affected by stored XSS.


In addBouquet in js/bqe.js in OpenWebif (aka e2openplugin-OpenWebif) through 1.4.7 inserting JavaScript into the Add Bouquet feature of the Bouquet Editor (i.e. bouqueteditor/api/addbouquet?name=) leads to Stored XSS.


Ivanti Service Manager 2021.1 allows reflected XSS via the appName parameter associated with ConfigDB calls such as in RelocateAttachments.aspx.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An

issue

was

discovered

in

Form

Tools

through

A

low-privileged

user

can

trigger

Reflected

XSS

when

a

viewing

a

form

via

the

parameter

e.g.

clients/forms/edit_submission.php?form_id=1&view_id=1&submission_id=XSS.


Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 allow tweb/ft.php?u=XSS attacks.


DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter.


The Brizy Page Builder plugin <= 2.3.11 for WordPress was vulnerable to stored XSS by lower-privileged users such as a subscribers. It was possible to add malicious JavaScript to a page by modifying the request sent to update the page via the brizy_update_item AJAX action and adding JavaScript to the data parameter which would be executed in the session of any visitor viewing or previewing the post or page.


Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing.


Increments Qiita::Markdown before 0.33.0 allows XSS in transformers.


WP Mailster 1.6.18.0 allows XSS when a victim opens a mail server's details in the mst_servers page for a crafted server_host server_name or connection_parameter parameter.


An issue was discovered in PunBB before 1.4.6. An XSS vulnerability in the email BBcode tag allows (with authentication) injecting arbitrary JavaScript into any forum message.


Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious user details from AD.


The OUGC Feedback plugin before 1.8.23 for MyBB allows XSS via the comment field of feedback during an edit operation.


The Administration GUI component of TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition TIBCO Administrator - Enterprise Edition TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric TIBCO Administrator - Enterprise Edition for z/Linux TIBCO Administrator - Enterprise Edition for z/Linux TIBCO Runtime Agent TIBCO Runtime Agent TIBCO Runtime Agent for z/Linux and TIBCO Runtime Agent for z/Linux contains an easily exploitable vulnerability that allows an unauthenticated attacker to social engineer a legitimate user with network access to execute a Stored XSS attack targeting the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Administrator - Enterprise Edition: versions 5.10.2 and below TIBCO Administrator - Enterprise Edition: versions 5.11.0 and 5.11.1 TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.10.2 and below TIBCO Administrator - Enterprise Edition Distribution for TIBCO Silver Fabric: versions 5.11.0 and 5.11.1 TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.10.2 and below TIBCO Administrator - Enterprise Edition for z/Linux: versions 5.11.0 and 5.11.1 TIBCO Runtime Agent: versions 5.10.2 and below TIBCO Runtime Agent: versions 5.11.0 and 5.11.1 TIBCO Runtime Agent for z/Linux: versions 5.10.2 and below and TIBCO Runtime Agent for z/Linux: versions 5.11.0 and 5.11.1.


The aimeos (aka Aimeos shop and e-commerce framework) extension before 19.10.12 and 20.x before 20.10.5 for TYPO3 allows XSS via a backend user account.


A DOM-based XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.3.1652 Build 20210428. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 Build 20210414. QNAP Systems Inc. QuTScloud versions prior to c4.5.5.1656 Build 20210503. This issue does not affect: QNAP Systems Inc. QTS 4.3.6; 4.3.3.


An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.


Increments Qiita::Markdown before 0.34.0 allows XSS via a crafted gist link a different vulnerability than CVE-2021-28796.


Concrete CMS (formerly concrete5) before 8.5.5 allows remote authenticated users to conduct XSS attacks via a crafted survey block. This requires at least Editor privileges.


Gitea 1.12.x and 1.13.x before 1.13.4 allows XSS via certain issue data in some situations.


Self Authenticated XSS in Nagios Network Analyzer before 2.4.2 via the nagiosna/groups/queries page.


Wireless-N WiFi Repeater REV 1.0 (28.08.06.1) suffers from a reflected XSS vulnerability due to unsanitized SSID value when the latter is displayed in the /repeater.html page (\Repeater Wizard\ homepage section).


The

\origin\

parameter

passed

to

some

of

the

endpoints

like

'/trigger'

was

vulnerable

to

XSS

exploit.

This

issue

affects

Apache

Airflow

versions

in

series

and

affects

and

and

series.

This

is

the

same

as

but

the

implemented

fix

did

not

fix

the

issue

completely.

Update

to

Airflow

or

Please

also

update

your

Python

version

to

the

latest

available

PATCH

releases

of

the

installed

MINOR

versions

example

update

to

Python

if

you

are

on

Python

(Those

contain

the

fix

for


A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.


bluemonday before 1.0.5 allows XSS because certain Go lowercasing converts an uppercase Cyrillic character defeating a protection mechanism against the \script\ string.


A remote dom xss crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.


The Nextcloud dialogs library (npm package @nextcloud/dialogs) before 3.1.2 insufficiently escaped text input passed to a toast. If your application displays toasts with user-supplied input this could lead to a XSS vulnerability. The vulnerability has been patched in version 3.1.2 If you need to display HTML in the toast explicitly pass the `options.isHTML` config flag.


Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staff via the chatbot feature.


RSA Archer before 6.9 SP1 P1 (6.9.1.1) contains a stored XSS vulnerability. A remote authenticated malicious Archer user with access to modify link name fields could potentially exploit this vulnerability to execute code in a victim's browser.


DMA Softlab Radius Manager 4.4.0 is affected by Cross Site Scripting (XSS) via the description name or address field (under admin.php).


PRTG Network Monitor before 21.3.69.1333 allows stored XSS via an unsanitized string imported from a User Object in a connected Active Directory instance.


remark42 before 1.6.1 allows XSS as demonstrated by \Locator: Locator{URL:\ followed by an XSS payload. This is related to backend/app/store/comment.go and backend/app/store/service/service.go.


Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0 the default configuration of client side sessions results in unencrypted but signed data being set as cookie values. This means that if something sensitive goes into the session it could be read by something with access to the cookies. For this to be a vulnerability some kind of sensitive data would need to be stored in the session and the session cookie would have to leak. For example the cookies are not configured with httpOnly and an adjacent XSS vulnerability within the site allowed capture of the cookies. As of version 1.9.0 a securely randomly generated signing key is used. As a workaround one may supply an encryption key as per the documentation recommendation.


A stored Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server Services Directory version 10.8.1 and below may allow a remote authenticated attacker to pass and store malicious strings in the ArcGIS Services Directory.


BTCPay Server through 1.0.7.0 suffers from a Stored Cross Site Scripting (XSS) vulnerability within the POS Add Products functionality. This enables cookie stealing.


Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources could execute code in the end user's browser. The vulnerability is patched in version 9. As a workaround implementers who are not able to upgrade may apply DOMPurify recursively to the options structure to filter out malicious markup.


Cloudera Hue 4.6.0 allows XSS.


Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.


Redmine 4.1.x before 4.1.2 allows XSS because an issue's subject is mishandled in the auto complete tip.


Softing AG OPC Toolbox through 4.10.1.13035 allows /en/diag_values.html Stored XSS via the ITEMLISTVALUES##ITEMID parameter resulting in JavaScript payload injection into the trace file. This payload will then be triggered every time an authenticated user browses the page containing it.


OpenPLC runtime V3 through 2016-03-14 allows stored XSS via the Device Name to the web server's Add New Device page.


In MikroTik RouterOS through 2021-01-04 the hotspot login page is vulnerable to reflected XSS via the target parameter.


Ovation Dynamic Content 1.10.1 for Elementor allows XSS via the post_title parameter.


GLPi 9.5.4 does not sanitize the metadata. This way its possible to insert XSS into plugins to execute JavaScript code.


Certain HP Enterprise LaserJet and PageWide MFPs may be vulnerable to stored cross site scripting (XSS).


Collabtive 3.1 allows XSS when an authenticated user enters an XSS payload into the address section of the profile edit page aka the manageuser.php?action=edit address1 parameter.


** DISPUTED ** A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a crafted onloadstart attribute of an IMG element) in a text field. Note: Researchers have claimed that this issue is not within the product itself but is intended behavior in a web browser.


Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment.


The

Express

Entries

Dashboard

in

allows

stored

XSS

via

the

name

field

of

a

new

data

object

at

an

index.php/dashboard/express/entries/view/

URI.


attach/ajax.php in DzzOffice through 2.02.1 allows XSS via the editorid parameter.


Seo Panel 4.8.0 allows reflected XSS via the seo/seopanel/login.php?sec=forgot email parameter.


An issue was discovered in the tagDiv Newspaper theme 10.3.9.1 for WordPress. It allows XSS via the wp-admin/admin-ajax.php td_block_id parameter in a td_ajax_block API call.


** UNSUPPORTED WHEN ASSIGNED ** Oracle GlassFish Server 3.1.2.18 and below allows /common/logViewer/logViewer.jsf XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


A flaw was found in Red Hat Ceph Storage 4 in the Dashboard component. In response to CVE-2020-27839 the JWT token was moved from localStorage to an httpOnly cookie. However token cookies are used in the body of the HTTP response for the documentation which again makes it available to XSS.The greatest threat to the system is for confidentiality integrity and availability.


An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks.


The DOMParser API did not properly process '<noscript>' elements for escaping. This could be used as an mXSS vector to bypass an HTML Sanitizer. This vulnerability affects Firefox < 86.


An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of feed fields could lead to xss issues.


An XSS bug in internal error pages could have led to various spoofing attacks including other error pages and the address bar. Note: This issue only affected Firefox for Android. Other operating systems are unaffected. This vulnerability affects Firefox < 85.


The TIBCO EBX Web Server component of TIBCO Software Inc.'s TIBCO EBX contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.9.12 and below.


An issue was discovered in Joomla! 2.5.0 through 3.9.24. Missing filtering of messages showed to users that could lead to xss issues.


An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_filter HTTP request body parameter for the acp interface. The affected parameter accepts malicious client-side script without proper input sanitization. For example a malicious user can leverage this vulnerability to steal cookies from a victim user and perform a session-hijacking attack which may then lead to unauthorized access to the site.


Authenticated users with Site roles may inject XSS scripts via file names that will execute in the browser for this and other users of the same site.


An issue was discovered in Joomla! 3.1.0 through 3.9.23. The lack of escaping of image-related parameters in multiple com_tags views cause lead to XSS attack vectors.


The Application Development Clients component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a Cross Site Scripting (XSS) attack on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO BPM Enterprise: versions 4.3.0 and below and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric: versions 4.3.0 and below.


An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user which will execute javascript code in the context of the user.


An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected.


An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request body parameter for the acp interface. An admin user can inject malicious client-side script into the affected parameter without any form of input sanitization. The injected payload will be executed in the browser of a user whenever one visits the affected module page.


An error in a page handler of the VRM may lead to a reflected cross site scripting (XSS) in the web-based interface. To exploit this vulnerability an attack must be able to modify the HTTP header that is sent. This issue also affects installations of the DIVAR IP and BVMS with VRM installed.


The Spotfire client component of TIBCO Software Inc.'s TIBCO Spotfire Analyst TIBCO Spotfire Analytics Platform for AWS Marketplace TIBCO Spotfire Desktop and TIBCO Spotfire Server contains a vulnerability that theoretically allows a low privileged attacker with network access to execute a stored Cross Site Scripting (XSS) attack on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions 10.3.3 and below versions 10.10.0 10.10.1 and 10.10.2 versions 10.7.0 10.8.0 10.9.0 11.0.0 and 11.1.0 TIBCO Spotfire Analytics Platform for AWS Marketplace: versions 11.1.0 and below TIBCO Spotfire Desktop: versions 10.3.3 and below versions 10.10.0 10.10.1 and 10.10.2 versions 10.7.0 10.8.0 10.9.0 11.0.0 and 11.1.0 and TIBCO Spotfire Server: versions 10.3.11 and below versions 10.10.0 10.10.1 10.10.2 and 10.10.3 versions 10.7.0 10.8.0 10.8.1 10.9.0 11.0.0 and 11.1.0.


An issue was discovered in UiPath App Studio 21.4.4. There is a persistent XSS vulnerability in the file-upload functionality for uploading icons when attempting to create new Apps. An attacker with minimal privileges in the application can build their own App and upload a malicious file containing an XSS payload by uploading an arbitrary file and modifying the MIME type in a subsequent HTTP request. This then allows the file to be stored and retrieved from the server by other users in the same organization.


Cross Site Scripting (XSS) vulnerability exits in Anchor CMS <=0.12.7 in posts.php. Attackers can use the posts column to upload the title and content containing malicious code to achieve the purpose of obtaining the administrator cookie thereby achieving other malicious operations.


A Cross Site Scripting (XSS) vulnerability exists in RosarioSIS before 7.6.1 via the xss_clean function in classes/Security.php which allows remote malicious users to inject arbitrary JavaScript or HTML. An example of affected components are all Markdown input fields.


KNIME Server before 4.13.4 allows XSS via the old WebPortal login page.


Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.


XE before 1.11.6 is vulnerable to Unrestricted file upload via modules/menu/menu.admin.controller.php. When uploading the Mouse over button and When selected button there is no restriction on the file suffix which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type uploading HTML-type files leads to stored XSS vulnerabilities.


Attendance Management System 1.0 is affected by a Cross Site Scripting (XSS) vulnerability. The value of the FirstRecord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The attacker can access the system by using the XSS-reflected method and then can store information by injecting the admin account on this system.


Quest KACE Desktop Authority before 11.2 allows XSS because it does not prevent untrusted HTML from reaching the jQuery.htmlPrefilter method of jQuery.


GL.iNet GL-AR150 2.x before 3.x devices configured as repeaters allow cgi-bin/router_cgi?action=scanwifi XSS when an attacker creates an SSID with an XSS payload as the name.


SPIP 4.0.0 is affected by a Cross Site Request Forgery (CSRF) vulnerability in ecrire/public/aiguiller.php ecrire/public/balises.php ecrire/balise/formulaire_.php. To exploit the vulnerability a visitor must visit a malicious website which redirects to the SPIP website. It is also possible to combine XSS vulnerabilities in SPIP 4.0.0 to exploit it. The vulnerability allows an authenticated attacker to execute malicious code without the knowledge of the user on the website (CSRF).


Django CMS 3.7.3 does not validate the plugin_type parameter while generating error messages for an invalid plugin type resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.


In XE 1.116 when uploading the Normal button there is no restriction on the file suffix which leads to any file uploading to the files directory. Since .htaccess only restricts the PHP type uploading HTML-type files leads to stored XSS vulnerabilities. If the .htaccess configuration is improper for example before the XE 1.11.2 version you can upload the PHP type file to GETSHELL.


Opmantek Open-AudIT Community 4.2.0 (Fixed in 4.3.0) is affected by a Cross Site Scripting (XSS) vulnerability. If a bad value is passed to the routine via a URL malicious JavaScript code can be executed in the victim's browser.


SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability in ecrire/public/interfaces.php adding the function safehtml to the vulnerable fields. An editor is able to modify his personal information. If the editor has an article written and available when a user goes to the public site and wants to read the author's information the malicious code will be executed. The \Who are you\ and \Website Name\ fields are vulnerable.


DMP Roadmap before 3.0.4 allows XSS.


An issue was discovered in Firmware Analysis and Comparison Tool v3.2. With administrator privileges the attacker could perform stored XSS attacks by inserting JavaScript and HTML code in user creation functionality.


SPIP 4.0.0 is affected by a Cross Site Scripting (XSS) vulnerability. To exploit the vulnerability a visitor must browse to a malicious SVG file. The vulnerability allows an authenticated attacker to inject malicious code running on the client side into web pages visited by other users (stored XSS).


Cross Site Scripting (XSS) vulnerability exists in AAT Novus Management System through 1.51.2. The WebUI has wrong HTTP 404 error handling implemented. A remote unauthenticated attacker may be able to exploit the issue by sending malicious HTTP requests to non-existing URIs. The value of the URL path filename is copied into the HTML document as plain text tags.


CheckSec Canopy before 3.5.2 allows XSS attacks against the login page via the LOGIN_PAGE_DISCLAIMER parameter.


The Refined GitHub browser extension before 21.6.8 might allow XSS via a link in a document. NOTE: github.com sends Content-Security-Policy headers to in general address XSS and other concerns.


** DISPUTED ** Accela Civic Platform through 20.1 allows ssoAdapter/logoutAction.do successURL XSS. NOTE: the vendor states \there are configurable security flags and we are unable to reproduce them with the available information.\


Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard.


In the Pro and Enterprise versions of GTranslate < 2.8.65 the gtranslate_request_uri_var function runs at the top of all pages and echoes out the contents of $_SERVER'REQUEST_URI'. Although this uses addslashes and most modern browsers automatically URLencode requests this plugin is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below or in cases where an attacker is able to modify the request en route between the client and the server or in cases where the user is using an atypical browsing solution.


A stored cross site scripting (XSS) vulnerability was discovered in Ice Hrm 29.0.0.OS which allows attackers to execute arbitrary web scripts or HTML via a crafted file uploaded into the Document Management tab. The exploit is triggered when a user visits the upload location of the crafted file.


A stored cross site scripting (XSS) vulnerability in index.php?menu=billing_rates of Issabel PBX version 4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \Name\ or \Prefix\ fields under the \Create New Rate\ module.


Smashing 1.3.4 is vulnerable to Cross Site Scripting (XSS). A URL for a widget can be crafted and used to execute JavaScript on the victim's computer. The JavaScript code can then steal data available in the session/cookies depending on the user environment (e.g. if re-using internal URL's for deploying or cookies that are very permissive) private information may be retrieved by the attacker.


SAS Environment Manager 2.5 allows XSS through the Name field when creating/editing a server. The XSS will prompt when editing the Configuration Properties.


Thruk

allows

/thruk/#cgi-bin/status.cgi?style=combined&title={TITLE

Reflected

XSS

via

the

host

or

title

parameter.

An

attacker

could

inject

arbitrary

JavaScript

into

status.cgi.

The

payload

would

be

triggered

every

time

an

authenticated

user

browses

the

page

containing

it.


OpenWay WAY4 ACS before 1.2.278-2693 allows XSS via the /way4acs/enroll action parameter.


Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. This affects users who open a crafted link or third-party web page.


Thruk before 2.44 allows XSS for a quick command.


Thruk

allows

/thruk/#cgi-bin/extinfo.cgi?type=2&host={HOSTNAME&service={SERVICENAME&backend={BACKEND

Reflected

XSS

via

the

host

or

service

parameter.

An

attacker

could

inject

arbitrary

JavaScript

into

extinfo.cgi.

The

malicious

payload

would

be

triggered

every

time

an

authenticated

user

browses

the

page

containing

it.


Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.


An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url.


Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56 4.9.18 4.11.7.


The Web Reporting component of TIBCO Software Inc.'s TIBCO Nimbus contains easily exploitable Stored Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Nimbus: versions 10.4.0 and below.


In Plone 5.0 through 5.2.4 Editors are vulnerable to XSS in the folder contents view if a Contributor has created a folder with a SCRIPT tag in the description field.


A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer because they do not support 'rel=noopener'.


Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit action.


The WebFOCUS Reporting Server and WebFOCUS Client components of TIBCO Software Inc.'s TIBCO WebFOCUS Client TIBCO WebFOCUS Installer and TIBCO WebFOCUS Reporting Server contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO WebFOCUS Client: versions 8207.27.0 and below TIBCO WebFOCUS Installer: versions 8207.27.0 and below and TIBCO WebFOCUS Reporting Server: versions 8207.27.0 and below.


User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website.


The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-preview/ PATH aka PFSI-62467. The attacker could execute JavaScript code in the victim's browser by using the link to preview sites hosted on the server. Authentication is not required to exploit the vulnerability.


phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.


Contao 4.5.x through 4.9.x before 4.9.16 and 4.10.x through 4.11.x before 4.11.5 allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end.


A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink.


Mermaid before 8.11.0 allows XSS when the antiscript feature is used.


OWASP AntiSamy before 1.6.4 allows XSS via HTML attributes when using the HTML output serializer (XHTML is not affected). This was demonstrated by a javascript: URL with &#00058 as the replacement for the : character.


Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Slims9 Bulian 9.4.2 is affected by Cross Site Scripting (XSS) in /admin/modules/system/custom_field.php.


Quectel UC20 UMTS/HSPA+ UC20 6.3.14 is affected by a Cross Site Scripting (XSS) vulnerability.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

and

before


There is a stored Cross Site Scripting (XSS) vulnerability in maccms v10 through adding videos. XSS code can be inserted at parameter positions including name and remarks.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


NETGEAR R7000 devices before 1.0.11.126 are affected by stored XSS.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

and

before


An

issue

was

discovered

in

PONTON

X/P

Messenger

before

Several

functions

are

vulnerable

to

reflected

XSS

as

demonstrated

by

private/index.jsp?partners/ShowNonLocalPartners.do?localID=

or

private/index.jsp

or

private/index.jsp?database/databaseTab.jsp

or

private/index.jsp?activation/activationMainTab.jsp

or

private/index.jsp?communication/serverTab.jsp

or

private/index.jsp?emailNotification/notificationTab.jsp.


Certain

NETGEAR

devices

are

affected

by

reflected

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

Stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An XSS issue was discovered in COINS Construction Cloud 11.12. Due to insufficient neutralization of user input in the description of a task it is possible to store malicious JavaScript code in the task description. This is later executed when it is reflected back to the user.


Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface.


An issue was discovered in COINS Construction Cloud 11.12. In several locations throughout the application JavaScript code is passed as a URL parameter. Attackers can trivially alter this code to cause malicious behaviour. The application is therefore vulnerable to reflected XSS via malicious URLs.


AppCMS 2.0.101 has a XSS injection vulnerability in \\templates\\m\\inc_head.php


NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can steal the user's session by injecting malicious JavaScript codes which leads to session hijacking.


NETGEAR R7000 devices before 1.0.9.88 are affected by stored XSS.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


SLICAN WebCTI 1.01 2015 is affected by a Cross Site Scripting (XSS) vulnerability. The attacker can steal the user's session by injecting malicious JavaScript codes which leads to Session Hijacking and cause user's credentials theft.


In MediaWiki through 1.37 Wikibase item descriptions allow XSS which is triggered upon a visit to an action=info URL (aka a page-information sidebar).


An issue was discovered in PONTON X/P Messenger before 3.11.2. The navigation tree that is shown on the left side of every page of the web application is vulnerable to XSS: it allows injection of JavaScript into its nodes. Creating such nodes is only possible for users who have the role Configuration Administrator or Administrator.


Certain NETGEAR devices are affected by stored XSS. This affects GS108Tv2 before 5.4.2.36 and GS110TPv2 before 5.4.2.36.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

and

before


Studio 42 elFinder through 2.1.31 allows XSS via an SVG document.


VMware vRealize Log Insight (8.x prior to 8.4) contains a Cross Site Scripting (XSS) vulnerability due to improper user input validation. An attacker with user privileges may be able to inject a malicious payload via the Log Insight UI which would be executed when the victim accesses the shared dashboard link.


Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `status` parameter of campaign-zone-zones.php. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code.


Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in stats.php via the `setPerPage` parameter.


Bad validation logic in the Dart SDK versions prior to 2.12.3 allow an attacker to use an XSS attack via DOM clobbering. The validation logic in dart:html for creating DOM nodes from text did not sanitize properly when it came across template tags.


Revive Adserver before 5.1.1 is vulnerable to a reflected XSS vulnerability in userlog-index.php via the `period_preset` parameter.


There is a XSS injection vulnerability in iMaster NCE-Fabric V100R019C10. A module of the client does not verify the input sufficiently. Attackers can exploit this vulnerability by modifying input after logging onto the client. This may compromise the normal service of the client.


Revive Adserver before v5.2.0 is vulnerable to a reflected XSS vulnerability in the `statsBreakdown` parameter of stats.php (and possibly other scripts) due to single quotes not being escaped. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and pressing a certain key combination to execute injected JavaScript code.


An improper neutralization of input during web page generation in FortiWeb GUI interface 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated remote attacker to perform a reflected cross site scripting attack (XSS) by injecting malicious payload in different vulnerable API end-points.


On BIG-IP version 16.0.x before 16.0.1 15.1.x before 15.1.1 14.1.x before 14.1.3.1 13.1.x before 13.1.3.5 and all 12.1.x and 11.6.x versions undisclosed endpoints in iControl REST allow for a reflected XSS attack which could lead to a complete compromise of BIG-IP if the victim user is granted the admin role. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


On BIG-IP versions 16.0.x before 16.0.1.1 15.1.x before 15.1.2.1 14.1.x before 14.1.4 13.1.x before 13.1.3.6 12.1.x before 12.1.5.3 and 11.6.x before 11.6.5.3 undisclosed endpoints in iControl REST allow for a reflected XSS attack which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role. This vulnerability is due to an incomplete fix for CVE-2020-5948. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.11.1 allows stored XSS.


Text-based feedback answers required additional sanitizing to prevent stored XSS and blind SSRF risks in moodle before 3.10.2 3.9.5 3.8.8 3.5.17.


The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored XSS as user input is not properly sanitized.


The ID number user profile field required additional sanitizing to prevent a stored XSS risk in moodle before 3.10.2 3.9.5 3.8.8 3.5.17.


A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.


A Chamilo LMS 1.11.14 reflected XSS vulnerability exists in main/social/search.php=q URI (social network search feature).


OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used.


app/View/GalaxyClusters/add.ctp in MISP 2.4.146 allows Stored XSS when forking a galaxy cluster.


Telegram Web K Alpha 0.6.1 allows XSS via a document name.


in

MISP

allows

Stored

XSS

when

viewing

galaxy

cluster

relationships.


In RPCMS v1.8 and below the \nickname\ variable is not properly sanitized before being displayed on page. Attacker can use \update password\ function to inject XSS payloads into nickname variable and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.


QSAN Storage Manager header page parameters does not filter special characters. Remote attackers can inject JavaScript without logging in and launch reflected XSS attacks to access and modify specific data.


The TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar.


Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. This issue is patched in the latest `stable` 2.7.8 version of Discourse. As a workaround users may ensure that the Content Security Policy is enabled and has not been modified in a way which would make it more vulnerable to XSS attacks.


In NCH WebDictate v2.13 persistent Cross Site Scripting (XSS) exists in the Recipient Name field. An authenticated user can add or modify the affected field to inject arbitrary JavaScript.


Joplin before 2.0.9 allows XSS via button and form in the note body.


OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via binary data that is mishandled when the legacy dataretrieval endpoint has been enabled.


app/View/GalaxyElements/ajax/index.ctp in MISP 2.4.147 allows Stored XSS when viewing galaxy cluster elements in JSON format.


Laravel Booking System Booking Core 2.0 is vulnerable to Cross Site Scripting (XSS). The Avatar upload in the My Profile section could be exploited to upload a malicious SVG file which contains Javascript. Now if another user/admin views the profile and clicks to view his avatar an XSS will trigger.


In RPCMS v1.8 and below the \nickname\ variable is not properly sanitized before being displayed on page. When the API functions are enabled the attacker can use API to update user nickname with XSS payload and achieve stored XSS. Users who view the articles published by the injected user will trigger the XSS.


A Cross SIte Scripting (XSS) vulnerability exists in OneBlog <= 2.2.8. via the add function in the operation tab list in the background.


In jfinal_cms >= 5.1 0 there is a storage XSS vulnerability in the background system of CMS. Because developers do not filter the parameters submitted by the user input form any user with background permission can affect the system security by entering malicious code.


There is a Cross Site Scripting attack (XSS) vulnerability in JavaQuarkBBS <= v2. By entering specific statements into the background tag management module the attack statement will be stored in the database and the next victim will be attacked when he accesses the tag module.


Sourcecodester Car Rental Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via vehicalorcview parameter.


An issue was discovered in MediaWiki before 1.35.5 1.36.x before 1.36.3 and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling as demonstrated by an XSS payload in MediaWiki:October.


A problem was found in ForestBlog as of 2021-12-29 there is a XSS vulnerability that can be injected through the nickname input box.


Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.


Kentico Xperience 13.0.44 allows XSS via an XML document to the Media Libraries subsystem.


An issue was discovered in MediaWiki before 1.35.5 1.36.x before 1.36.3 and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file.


Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hijack.


D-Link DSL-2730E CT-20131125 devices allow XSS via the username parameter to the password page in the maintenance configuration.


phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter (aka num or number).


ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). Insecure URI handling leads to bypass security restriction to achieve Cross Site Scripting which allows an attacker able to execute arbitrary JavaScript codes to perform multiple attacks such as clipboard hijacking and session hijacking.


Scoold 1.47.2 is a Q&A/knowledge base platform written in Java. When writing a Q&A the markdown editor is vulnerable to a XSS attack when using uppercase letters.


phpIPAM

allows

Reflected

XSS

and

CSRF

via

of

the

subnets

functionality.


Blackboard Learn through 9.1 allows XSS by an authenticated user via the Feedback to Learner form.


The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.


An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages a privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields. The attack could easily propagate across many pages for many users.


It's possible to craft a request for appointment edit screen which could lead to the XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.28 and prior versions.


An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36. Within several special pages a privileged user could inject arbitrary HTML and JavaScript within various data fields. The attack could easily propagate across many pages for many users.


app/View/SharingGroups/view.ctp in MISP before 2.4.146 allows stored XSS in the sharing groups view.


The CheckMK management web console (versions 1.5.0 to 2.0.0) does not sanitise user input in various parameters of the WATO module. This allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) the XSS payload will be triggered when the user accesses some specific sections of the application. In the same sense a very dangerous potential way would be when an attacker who has the monitor role (not administrator) manages to get a stored XSS to steal the secretAutomation (for the use of the API in administrator mode) and thus be able to create another administrator user who has high privileges on the CheckMK monitoring web console. Another way is that persistent XSS allows an attacker to modify the displayed content or change the victim's information. Successful exploitation requires access to the web management interface either with valid credentials or with a hijacked session.


Cross

Site

Scripting

(XSS)

vulnerability

in

Naviwebs

Navigate

Cms

via

the

navigate-quickse

parameter

to

and

because

the

function

is

built

in

these

files.


Blackboard Learn through 9.1 allows XSS by an authenticated user via the Assignment Instructions HTML editor.


Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.


Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name.


The yoast_seo (aka Yoast SEO) extension before 7.2.3 for TYPO3 allows XSS.


The dated_news (aka Dated News) extension through 5.1.1 for TYPO3 allows XSS.


The \blog title\ field in the \Settings\ menu \config\ page of \dashboard\ in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send an authenticated post HTTP request to admin/config and inject arbitrary web script or HTML through a special website name.


The miniorange_saml (aka Miniorange Saml) extension before 1.4.3 for TYPO3 allows XSS.


In

accountrecoveryendpoint/recoverpassword.do

in

Identity

Server

it

is

possible

to

perform

a

DOM-Based

XSS

attack

affecting

the

callback

parameter

modifying

the

URL

that

precedes

the

callback

parameter.

Once

the

username

or

password

reset

procedure

is

completed

the

JavaScript

code

will

be

executed.

(recoverpassword.do

also

has

an

open

redirect

issue

for

a

similar

reason.)


SilverStripe Framework through 4.8.1 allows XSS.


The \content\ field in the \regular post\ page of the \add content\ menu under \dashboard\ in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through special content.


Nightscout Web Monitor (aka cgm-remote-monitor) 14.2.2 allows XSS via a crafted X-Forwarded-For header.


It's possible to create an email which contains specially crafted link and it can be used to perform XSS attack. This issue affects: OTRS AG ((OTRS)) Community Edition:6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x version 7.0.27 and prior versions; 8.0.x version 8.0.14 and prior versions.


There is a XSS vulnerability in the ticket overview screens. It's possible to collect various information by having an e-mail shown in the overview screen. Attack can be performed by sending specially crafted e-mail to the system and it doesn't require any user intraction. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x version 6.0.1 and later versions. OTRS AG OTRS 7.0.x version 7.0.26 and prior versions.


GLPI is open source software which stands for Gestionnaire Libre de Parc Informatique and it is a Free Asset and IT Management Software package. In GLPI before verison 9.5.4 there is an XSS vulnerability involving a logged in user while updating a ticket.


Online Invoicing System (OIS) is open source software which is a lean invoicing system for small businesses consultants and freelancers created using AppGini. In OIS version 4.0 there is a stored XSS which can enables an attacker takeover of the admin account through a payload that extracts a csrf token and sends a request to change password. It has been found that Item description is reflected without sanitization in app/items_view.php which enables the malicious scenario.


MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie which is not set to HTTPOnly.


** DISPUTED ** The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. NOTE: the vendor states that this \would rely on an admin hacking his/her own website.\


In

PageKit

a

user

can

upload

SVG

files

in

the

file

upload

portion

of

the

CMS.

These

SVG

files

can

contain

malicious

scripts.

This

file

will

be

uploaded

to

the

system

and

it

will

not

be

stripped

or

filtered.

The

user

can

create

a

link

on

the

website

pointing

to

\/storage/exp.svg\

that

will

point

to

When

a

user

comes

along

to

click

that

link

it

will

trigger

a

XSS

attack.


mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9 there is an XSS vulnerability in when using `OIDCPreservePost On`.


ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. Moodle 3.10 to 3.10.3 3.9 to 3.9.6 3.8 to 3.8.8 3.5 to 3.5.17 and earlier unsupported versions are affected.


SmarterTools SmarterMail before Build 7776 allows XSS.


In CS-Cart version 4.11.1 it is possible to induce copy-paste XSS by manipulating the \post description\ filed in the blog post creation page.


The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect risks. Moodle versions 3.10 to 3.10.3 3.9 to 3.9.6 3.8 to 3.8.8 and earlier unsupported versions are affected.


Multiple improper neutralization of input during web page generation (CWE-79) in FortiManager and FortiAnalyzer versions 7.0.0 6.4.5 and below 6.2.7 and below user interface may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious payload in GET parameters.


Cloudera Hue 4.6.0 allows XSS via the type parameter.


An

improper

neutralization

of

input

during

web

page

generation

vulnerability

in

FortiPortal

GUI

and

below

and

below

and

below

and

below

and

below

and

below

and

below

and

below

may

allow

a

remote

and

unauthenticated

attacker

to

perform

an

XSS

attack

via

sending

a

crafted

request

with

an

invalid

lang

parameter

or

with

an

invalid

org.springframework.web.servlet.i18n.CookieLocaleResolver.LOCALE

value.


Craft CMS before 3.6.13 has an XSS vulnerability.


Add event in calendar function in the 101EIP system does not filter special characters in specific fields which allows remote authenticated users to inject JavaScript and perform a stored XSS attack.


Combodo iTop is an open source web based IT Service Management tool. In affected versions there is a XSS vulnerability on \run query\ page when logged as administrator. This has been resolved in versions 2.6.5 and 2.7.5.


Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. Prior to Pi-hole Web interface version 5.5.1 the function to add domains to blocklists or allowlists is vulnerable to a stored cross-site-scripting vulnerability. User input added as a wildcard domain to a blocklist or allowlist is unfiltered in the web interface. Since the payload is stored permanently as a wildcard domain this is a persistent XSS vulnerability. A remote attacker can therefore attack administrative user accounts through client-side attacks. Pi-hole Web Interface version 5.5.1 contains a patch for this vulnerability.


Collabora Online is a collaborative online office suite. A reflected XSS vulnerability was found in Collabora Online prior to version 6.4.9-5. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser as well as the session's authentication token which was also passed in at iframe creation time. The issue is patched in Collabora Online 6.4.9-5. Collabora Online 4.2 is not affected.


There is missing input validation of host names displayed in OpenWrt before 19.07.8. The Connection Status page of the luci web-interface allows XSS which can be used to gain full control over the affected system via ICMP.


Discourse is an open-source discussion platform. In Discourse versions 2.7.5 and prior parsing and rendering of YouTube Oneboxes can be susceptible to XSS attacks. This vulnerability only affects sites which have modified or disabled Discourse's default Content Security Policy. The issue is patched in `stable` version 2.7.6 `beta` version 2.8.0.beta3 and `tests-passed` version 2.8.0.beta3. As a workaround ensure that the Content Security Policy is enabled and has not been modified in a way which would make it more vulnerable to XSS attacks.


Share/IncomingWizard.htm in SolarWinds Serv-U before 15.2.3 mishandles the user-supplied SenderEmail parameter aka \Share URL XSS.\


The npm package \striptags\ is an implementation of PHP's strip_tags in Typescript. In striptags before version 3.2.0 a type-confusion vulnerability can cause `striptags` to concatenate unsanitized strings when an array-like object is passed in as the `html` parameter. This can be abused by an attacker who can control the shape of their input e.g. if query parameters are passed directly into the function. This can lead to a XSS.


Add announcement function in the 101EIP system does not filter special characters which allows authenticated users to inject JavaScript and perform a stored XSS attack.


OctoPrint before 1.6.0 allows XSS because API error messages include the values of input parameters.


Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.


myfactory.FMS before 7.1-912 allows XSS via the Error parameter.


An issue was discovered in AbanteCart before 1.3.2. It allows DOM Based XSS.


The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.


An issue was discovered in Zammad before 4.1.1. The Chat functionality allows XSS because clipboard data is mishandled.


A Stored Cross Site Scripting (XSS) Vulneraibiilty exists in Sourcecodester Engineers Online Portal in PHP via the (1) Quiz title and (2) quiz description parameters to add_quiz.php. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf which can lead to cookie stealing and more.


An issue was discovered in AbanteCart before 1.3.2. Any low-privileged user with file-upload permissions can upload a malicious SVG document that contains an XSS payload.


Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters thus unauthenticated attackers can inject JavaScript syntax remotely and further perform reflective XSS attacks.


Cross SIte Scripting (XSS) vulnerability exists in KindEditor 4.1.x via a Google search inurl:/examples/uploadbutton.html and then the .html file on the website that uses this editor (the file suffix is allowed).


Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.


When using Apache Knox SSO prior to 1.6.1 a request could be crafted to redirect a user to a malicious page due to improper URL parsing. A request that included a specially crafted request parameter could be used to redirect the user to a page controlled by an attacker. This URL would need to be presented to the user outside the normal request flow through a XSS or phishing campaign.


An issue was discovered in Zammad before 4.1.1. There is stored XSS via a custom Avatar.


The Unicorn framework through 0.35.3 for Django allows XSS via component.name.


An issue was discovered in CALDERA 2.8.1. It contains multiple reflected stored and self XSS vulnerabilities that may be exploited by authenticated and unauthenticated attackers.


myfactory.FMS before 7.1-912 allows XSS via the UID parameter.


The \File upload question\ functionality in LimeSurvey 3.x-LTS through 3.27.18 allows XSS in assets/scripts/modaldialog.js and assets/scripts/uploader.js.


A security vulnerability has been discovered in the SAP Knowledge Warehouse - versions 7.30 7.31 7.40 7.50. The usage of one SAP KW component within a Web browser enables unauthorized attackers to conduct XSS attacks which might lead to disclose sensitive data.


A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Event Booking and Reservation System in PHP/MySQL via the Holiday reason parameter. An attacker can leverage this vulnerability in order to run javascript commands on the web server surfers behalf which can lead to cookie stealing and more.


An issue was discovered in Zammad before 4.1.1. Stored XSS may occur via an Article during addition of an attachment to a Ticket.


Apostrophe CMS versions between 2.63.0 to 3.3.1 are vulnerable to Stored XSS where an editor uploads an SVG file that contains malicious JavaScript onto the Images module which triggers XSS once viewed.


The Buffer Button WordPress plugin through 1.0 was vulnerable to Authenticated Stored Cross Site Scripting (XSS) within the Twitter username to mention text field.


MISP 2.4.136 has Stored XSS in the galaxy cluster view via a cluster name to app/View/GalaxyClusters/view.ctp.


The WP Booking System WordPress plugin before 2.0.15 was affected by a reflected xss in wp-booking-system on the wpbs-calendars admin page.


The Smash Balloon Social Post Feed WordPress plugin before 4.1.1 was affected by a reflected XSS in custom-facebook-feed in cff-top admin page.


Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from MySophos admin to SFOS admin in Sophos Firewall older than version 19.0 GA.


In OpenEMR versions 4.2.0 to 6.0.0 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly. An attacker could trick a user to click on a malicious url and execute malicious code.


In OpenEMR versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the U2F USB Device authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.


In SiCKRAGE versions 9.3.54.dev1 to 10.0.11.dev1 are vulnerable to Reflected Cross-Site-Scripting (XSS) due to user input not being validated properly in the `quicksearch` feature. Therefore an attacker can steal a user's sessionID to masquerade as a victim user to carry out any actions in the context of the user.


FTAPI 4.0 through 4.10 allows XSS via an SVG document to the Background Image upload feature in the Submit Box Template Editor.


JetBrains TeamCity before 2020.2 was vulnerable to reflected XSS on several pages.


The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action allowing any authenticated to call it and set arbitrary settings. Furthermore due to the lack of sanitisation and escaping it could lead to Stored XSS issues


In PiranhaCMS versions 7.0.0 to 9.1.1 are vulnerable to stored XSS due to the page title improperly sanitized. By creating a page with a specially crafted page title a low privileged user can trigger arbitrary JavaScript execution.


Multiple stored cross site scripting (XSS) vulnerabilities in the \Register\ module of House Rental and Property Listing 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in all text fields except for Phone Number and Alternate Phone Number.


Stored XSS injection vulnerabilities were discovered in the Avaya Aura Experience Portal Web management which could allow an authenticated user to potentially disclose sensitive information. Affected versions include 7.0 through 7.2.3 (without hotfix) and 8.0.0 (without hotfix).


In OpenEMR versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.


In OpenEMR versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly and rendered in the TOTP Authentication method page. A highly privileged attacker could inject arbitrary code into input fields when creating a new user.


The Modern Events Calendar Lite WordPress plugin before 6.2.0 alloed any logged-in user even a subscriber user may add a category whose parameters are incorrectly escaped in the admin panel leading to stored XSS.


Multiple XSS vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 19.0 GA.


Mobile application \Testes de Codigo\ v11.3 and prior allows stored XSS by injecting a payload in the \feedback\ message field causing it to be stored in the remote database and leading to its execution on client devices when loading the \feedback list\ either by accessing the website directly or using the mobile application.


Stored XSS can execute as administrator in quarantined email detail view in Sophos UTM before version 9.706.


In OpenEMR versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the `Allergies` section. An attacker could lure an admin to enter a malicious payload and by that initiate the exploit.


The Landing Page Builder WordPress plugin before 1.4.9.6 was affected by a reflected XSS in page-builder-add on the ulpb_post admin page.


Multiple stored cross site scripting (XSS) vulnerabilities in the \Update Profile\ module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name Last Name and Address text fields.


The Smooth Scroll Page Up/Down Buttons WordPress plugin before 1.4 did not properly sanitise and validate its settings such as psb_distance psb_buttonsize psb_speed only validating them client side. This could allow high privilege users (such as admin) to set XSS payloads in them


The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin leading to a stored cross site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings.


The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them allowing high privilege users to perform XSS attacks even when the unfiltered_html capability is disallowed


The

AJAX

action

of

the

Email

Subscriber

WordPress

plugin

through

does

not

properly

sanitise

validate

and

escape

the

submitted

and

POST

parameters

inserting

them

in

the

DB

and

then

outputting

them

back

in

the

Subscriber

list

(/wp-admin/edit.php?post_type=kes_campaign&page=kento_email_subscriber_list_settings)

leading

a

Stored

XSS

issue.


The WP RSS Aggregator WordPress plugin before 4.19.3 does not sanitise and escape data before outputting it in the System Info admin dashboard which could lead to a Stored XSS issue due to the wprss_dismiss_addon_notice AJAX action missing authorisation and CSRF checks allowing any authenticated users such as subscriber to call it and set a malicious payload in the addon parameter.


The Erident Custom Login and Dashboard WordPress plugin before 3.5.9 did not properly sanitise its settings allowing high privilege users to use XSS payloads in them (even when the unfileted_html is disabled)


The Timetable and Event Schedule by MotoPress WordPress plugin before 2.3.19 does not sanitise some of its parameters which could allow low privilege users such as author to perform XSS attacks against frontend and backend users when viewing the related event/s


The Photo Gallery by 10Web - Mobile-Friendly Image Gallery WordPress plugin before 1.5.67 did not properly sanitise the gallery title allowing high privilege users to create one with XSS payload in it which will be triggered when another user will view the gallery list or the affected gallery in the admin dashboard. This is due to an incomplete fix of CVE-2019-16117


The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend however higher privilege users such as editor could exploit this without the need of approval and even when the blog disallows the unfiltered_html capability.


The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe and the stored reservation with XSS payload is loaded.


The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages leading to stored XSS.


The YouTube Embed WordPress plugin before 5.2.2 does not validate escape or sanitise some of its shortcode attributes leading to Stored XSS issues by 1. using w h controls cc_lang color language start stop or style parameter of youtube shortcode 2. by using style class rel target width height or alt parameter of youtube_thumb shortcode or 3. by embedding a video whose title or description contains XSS payload (if API key is configured).


The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings which could allow attackers to make a logged in admin change them. Furthermore as the plugin allows arbitrary HTML to be inserted in one of the setting (feature mentioned by the plugin) this could lead to Stored XSS issue which will be triggered either in the backend frontend or both depending on the payload used.


The \Schedule Name\ input in the Weekly Schedule WordPress plugin before 3.4.3 general options did not properly sanitize input allowing a user to inject javascript code using the <script> HTML tags and cause a stored XSS issue


The Any Hostname WordPress plugin through 1.0.6 does not sanitise or escape its \Allowed hosts\ setting leading to an authenticated stored XSS issue as high privilege users are able to set XSS payloads in it


The method and share GET parameters of the Giveaway pages were not sanitised validated or escaped before being output back in the pages thus leading to reflected XSS


The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML which could allow users with a role as low as Contributors to exploit stored XSS issues


The KN Fix Your Title WordPress plugin through 1.0.1 was vulnerable to Authenticated Stored XSS in the separator field.


The WP SVG images WordPress plugin before 3.4 did not sanitise the SVG files uploaded which could allow low privilege users such as author+ to upload a malicious SVG and then perform XSS attacks by inducing another user to access the file directly. In v3.4 the plugin restricted such upload to editors and admin with an option to also allow author to do so. The description of the plugin has also been updated with a security warning as upload of such content is intended.


The Stock in & out WordPress plugin through 1.0.4 has a search functionality the lowest accessible level to it being contributor. The srch POST parameter is not validated sanitised or escaped before using it in the echo statement leading to a reflected XSS issue


The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape most don't and there are even some attributes that are insecure by design (like su_button's onclick attribute).


The Podcast Subscribe Buttons WordPress plugin before 1.4.2 allows users with any role capable of editing or adding posts to perform stored XSS.


The WP Login Security and History WordPress plugin through 1.0 did not have CSRF check when saving its settings not any sanitisation or validation on them. This could allow attackers to make logged in administrators change the plugin's settings to arbitrary values and set XSS payloads on them as well


The

AJAX

action

of

the

DSGVO

All

in

one

for

WP

WordPress

plugin

before

did

not

sanitise

or

escape

some

POST

parameter

submitted

before

outputting

them

in

the

Log

page

in

the

administrator

dashboard

(wp-admin/admin.php?page=dsgvoaiofree-show-log).

This

could

allow

unauthenticated

attackers

to

gain

unauthorised

access

by

using

an

XSS

payload

to

create

a

rogue

administrator

account

which

will

be

trigged

when

an

administrator

will

view

the

logs.


The Target First WordPress Plugin v2.0 also previously known as Watcheezy suffers from a critical unauthenticated stored XSS vulnerability. An attacker could change the licence key value through a POST on any URL with the 'weeWzKey' parameter that will be save as the 'weeID option and is not sanitized.


In

the

default

configuration

of

the

File

Manager

WordPress

plugin

before

a

Reflected

XSS

can

occur

on

the

endpoint

/wp-admin/admin.php?page=wp_file_manager_properties

when

a

payload

is

submitted

on

the

User-Agent

parameter.

The

payload

is

then

reflected

back

on

the

web

application

response.


The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode which could allow users with a role as low as Contributor to perform Stored XSS attacks.


The WP Prayer WordPress plugin before 1.6.2 provides the functionality to store requested prayers/praises and list them on a WordPress website. These stored prayer/praise requests can be listed by using the WP Prayer engine. An authenticated WordPress user with any role can fill in the form to request a prayer. The form to request prayers or praises have several fields. The 'prayer request' and 'praise request' fields do not use proper input validation and can be used to store XSS payloads.


The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos.


The Prismatic WordPress plugin before 2.8 does not sanitise or validate some of its shortcode parameters allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS trigger able in the frontend however higher privilege users such as editor could exploit this without the need of approval and even when the blog disallows the unfiltered_html capability.


The WordPress Related Posts plugin through 3.6.4 contains an authenticated (admin+) stored XSS vulnerability in the title field on the settings page. By exploiting that an attacker will be able to execute JavaScript code in the user's browser.


This Advanced Order Export For WooCommerce WordPress plugin before 3.1.8 helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to reflected XSS.


The WP Customer Reviews WordPress plugin before 3.5.6 did not sanitise some of its settings allowing high privilege users such as administrators to set XSS payloads in them which will then be triggered in pages where reviews are enabled


The WP Reactions Lite WordPress plugin before 1.3.6 does not properly sanitize inputs within wp-admin pages allowing users with sufficient access to inject XSS payloads within /wp-admin/ pages.


The Wp Cookie Choice WordPress plugin through 1.1.0 is lacking any CSRF check when saving its options and do not escape them when outputting them in attributes. As a result an attacker could make a logged in admin change them to arbitrary values including XSS payloads via a CSRF attack.


The Smooth Scroll Page Up/Down Buttons WordPress plugin through 1.4 does not properly sanitise and validate its psb_positioning settings allowing high privilege users such as admin to set an XSS payload in it which will be executed in all pages of the blog


The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter (stored in their cookies) with an XSS payload in it.


The SMS Alert Order Notifications WordPress plugin before 3.4.7 is affected by a cross site scripting (XSS) vulnerability in the plugin's setting page.


The Content Copy Protection & Prevent Image Save WordPress plugin through 1.3 does not check for CSRF when saving its settings not perform any validation and sanitisation on them allowing attackers to make a logged in administrator set arbitrary XSS payloads in them.


Multiple instances of improper neutralization of input during web page generation vulnerabilities in FortiSandbox before 4.0.0 may allow an unauthenticated attacker to perform an XSS attack via specifically crafted request parameters.


The Rearrange Woocommerce Products WordPress plugin before 3.0.8 does not have proper access controls in the save_all_order AJAX action nor validation and escaping when inserting user data in SQL statement leading to an SQL injection and allowing any authenticated user such as subscriber to modify arbitrary post content (for example with an XSS payload) as well as exfiltrate any data by copying it to another post.


The Scroll Baner WordPress plugin through 1.0 does not have CSRF check in place when saving its settings nor perform any sanitisation escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS


An improper neutralization of input vulnerability CWE-79 in FortiAnalyzer versions 6.4.3 and below 6.2.7 and below and 6.0.10 and below may allow a remote authenticated attacker to perform a stored cross site scripting attack (XSS) via the column settings of Logview in FortiAnalyzer should the attacker be able to obtain that POST request via other hypothetical attacks.


When taxes are enabled the \Additional tax classes\ field was not properly sanitised or escaped before being output back in the admin dashboard allowing high privilege users such as admin to use XSS payloads even when the unfiltered_html is disabled


The Contact Form Check Tester WordPress plugin through 1.0.2 settings are visible to all registered users in the dashboard and are lacking any sanitisation. As a result any registered user such as subscriber can leave an XSS payload in the plugin settings which will be triggered by any user visiting them and could allow for privilege escalation. The vendor decided to close the plugin.


The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend it could also lead to Stored XSS issues


The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode which could allow users with a role as low as Contributor to perform Stored XSS attacks.


The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation


The Advanced Booking Calendar WordPress plugin before 1.6.7 did not sanitise the calId GET parameter in the \Seasons & Calendars\ page before outputing it in an A tag leading to a reflected XSS issue


The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist leading to a reflected XSS issue


An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.6 did not have capability checks nor sanitization allowing low privilege users (subscriber+) to call it and set XSS payloads which will be triggered in all backend pages.


The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute leading to a reflected XSS issue.


The Timetable and Event Schedule WordPress plugin before 2.4.2 does not have proper access control when updating a timeslot allowing any user with the edit_posts capability (contributor+) to update arbitrary timeslot from any events. Furthermore no CSRF check is in place as well allowing such attack to be perform via CSRF against a logged in with such capability. In versions before 2.3.19 the lack of sanitisation and escaping in some of the fields like the descritption could also lead to Stored XSS issues


issabelPBX version 2.11 is affected by a Cross Site Scripting (XSS) vulnerability. In file page.backup_restore.php the exit function will terminate the script and print the message to the user. The message will contain $_REQUEST without sanitization then there is a XSS vulnerability.


LibreNMS through 21.10.2 allows XSS via a widget title.


Wechat-php-sdk v1.10.2 is affected by a Cross Site Scripting (XSS) vulnerability in Wechat.php.


Sourcecodester Messaging Web Application 1.0 is vulnerable to stored XSS. If a sender inserts valid scripts into the chat the script will be executed on the receiver chat.


manage

(last

update

Oct

is

affected

by

a

Cross

Site

Scripting

(XSS)

vulnerability

in

The

exit

function

will

terminate

the

script

and

print

a

message

which

have

values

from


Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Products module.


JetBrains YouTrack before 2021.3.24402 is vulnerable to stored XSS.


In halo 1.4.14 the function point of uploading the avatar any file can be uploaded such as uploading an HTML file which will cause a stored XSS vulnerability.


Backstage is an open platform for building developer portals. In affected versions the auth-backend plugin allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack but it is expected that some deployments have these policies disabled due to incompatibilities. This is vulnerability is patched in version `0.4.9` of `@backstage/plugin-auth-backend`.


** DISPUTED ** Lorensbergs Connect2 3.13.7647.20190 is affected by an XSS vulnerability. Exploitation requires administrator privileges and is performed through the Wizard editor of the application. The attack requires an administrator to go into the Wizard editor and enter an XSS payload within the Page title Page Instructions Text before Text after or Text on side box. Once this has been done the administrator must click save and finally wait until any user of the application performs a booking for rental items in the booking area of the application where the XSS triggers. NOTE: another perspective is that the administrator may require JavaScript to customize any aspect of the page rendering. There is no effective way for the product to defend users in the face of a malicious administrator.


SakuraPanel v1.0.1.1 is affected by a Cross Site Scripting (XSS) vulnerability in /master/core/PostHandler.php. The exit function will terminate the script and print the message $data'proxy_name'.


BuddyBoss Platform through 1.8.0 allows XSS via the Group Name or Group Description field.


There is a Cross Site Scripting (XSS) vulnerability in SpotPage_login.php of Spotweb 1.5.1 and below which allows remote attackers to inject arbitrary web script or HTML via the dataperformredirect parameter.


In GNU Mailman before 2.1.36 a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS.


MartDevelopers Inc iResturant v1.0 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins the XSS payload will be executed.


Lychee-v3 3.2.16 is affected by a Cross Site Scripting (XSS) vulnerability in php/Access/Guest.php. The function exit will terminate the script and print the message to the user. The message will contain albumID which is controlled by the user.


A Universal XSS vulnerability was present in Firefox for Android resulting from improper sanitization when processing a URL scanned from a QR code. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 94.


Zoho ManageEngine SupportCenter Plus before 11016 is vulnerable to Reflected XSS in the Accounts module.


An improper neutralization of input during web page generation vulnerability CWE-79 in FortiOS version 7.0.3 and below 6.4.8 and below 6.2.10 and below 6.0.14 to 6.0.0. and in FortiProxy version 7.0.1 and below 2.0.7 to 2.0.0 web filter override form may allow an unauthenticated attacker to perform an XSS attack via crafted HTTP GET requests.


phpWhois (last update Jun 30 2021) is affected by a Cross Site Scripting (XSS) vulnerability. In file example.php the exit function will terminate the script and print the message to the user. The message will contain $_GET'query' then there is a XSS vulnerability.


YurunProxy v0.01 is affected by a Cross Site Scripting (XSS) vulnerability in src/Client.php. The exit function will terminate the script and print a message which have values from the socket_read.


nZEDb v0.4.20 is affected by a Cross Site Scripting (XSS) vulnerability in www/pages/api.php. The exit function will terminate the script and print the message which has the input $_GET't'.


An XSS issue was discovered in the google_for_jobs (aka Google for Jobs) extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability.


The Interior Server and Gateway Server components of TIBCO Software Inc.'s TIBCO PartnerExpress contain easily exploitable Stored and Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker to social engineer a legitimate user with network access to execute scripts targeting the affected system or the victim's local system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO PartnerExpress: versions 6.2.1 and below.


Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability.


thinkphp-bjyblog (last update Jun 4 2021) is affected by a Cross Site Scripting (XSS) vulnerability in AdminBaseController.class.php. The exit function terminates the script and prints a message to the user that contains $_SERVER'HTTP_HOST'.


dzzoffice 2.02.1_SC_UTF8 is affected by a Cross Site Scripting (XSS) vulnerability in explorerfile.php. The output of the exit function is printed for the user via exit(json_encode($return)).


twmap v2.91_v4.33 is affected by a Cross Site Scripting (XSS) vulnerability. In file list.php the exit function will terminate the script and print the message to the user. The message will contain $_REQUEST then there is a XSS vulnerability.


SmarterTools SmarterMail 16.x through 100.x before 100.0.7803 allows XSS.


When receiving a URL through a SEND intent Firefox would have searched for the text but subsequent usages of the address bar might have caused the URL to load unintentionally which could lead to XSS and spoofing attacks. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 95.


Collabora Online is a collaborative online office suite based on LibreOffice technology. In affected versions a reflected XSS vulnerability was found in Collabora Online. An attacker could inject unescaped HTML into a variable as they created the Collabora Online iframe and execute scripts inside the context of the Collabora Online iframe. This would give access to a small set of user settings stored in the browser as well as the session's authentication token which was also passed in at iframe creation time. Users should upgrade to Collabora Online 6.4.16 or higher or Collabora Online 4.2.20 or higher. Collabora Online Development Edition 21.11 is not affected.


youtube-php-mirroring (last update Jun 9 2017) is affected by a Cross Site Scripting (XSS) vulnerability in file ytproxy/index.php.


Stored XSS in Signup Form in iResturant 1.0 Allows Remote Attacker to Inject Arbitrary code via NAME and ADDRESS field


Workerman-ThinkPHP-Redis (last update Mar 16 2018) is affected by a Cross Site Scripting (XSS) vulnerability. In file Controller.class.php the exit function will terminate the script and print the message to the user. The message will contain $_GET{C('VAR_JSONP_HANDLER') then there is a XSS vulnerability.


** UNSUPPORTED WHEN ASSIGNED ** WebAdmin Control Panel in Atmail 6.5.0 (a version released in 2012) allows XSS via the format parameter to the default URI. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


chamilo-lms v1.11.14 is affected by a Cross Site Scripting (XSS) vulnerability in /plugin/jcapture/applet.php if an attacker passes a message hex2bin in the cookie.


Stored XSS in Add New Employee Form in Sourcecodester Employee Daily Task Management System 1.0 Allows Remote Attacker to Inject/Store Arbitrary Code via the Name Field.


pictshare v1.5 is affected by a Cross Site Scripting (XSS) vulnerability in api/info.php. The exit function will terminate the script and print the message which has $_REQUEST'hash'.


@joeattardi/emoji-button is a Vanilla JavaScript emoji picker component. In affected versions there are two vectors for XSS attacks: a URL for a custom emoji and an i18n string. In both of these cases a value can be crafted such that it can insert a `script` tag into the page and execute malicious code.


Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.


OX App Suite 7.10.5 allows XSS via an OX Chat system message.


RSA

Archer

through

allows

stored

XSS.


in

FuturePress

EPub.js

before

allows

XSS.


OX App Suite 7.10.5 allows XSS via an OX Chat room title during typing rendering.


COVID19 Testing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the \Admin name\ parameter.


An issue was discovered in JPress v3.3.0 and below. There are XSS vulnerabilities in the template module and tag management module. If you log in to the background by means of weak password the storage XSS vulnerability can occur.


Dutchcoders transfer.sh before 1.2.4 allows XSS via an inline view.


OX App Suite 7.10.5 allows XSS via an OX Chat room name.


Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2 as used in Plone through 5.2.4 and other products allow Reflected XSS.


SAP BusinessObjects Business Intelligence Platform (Crystal Report) versions - 420 430 does not sufficiently encode user controlled inputs and therefore an authorized attacker can exploit a XSS vulnerability leading to non-permanently deface or modify displayed content from a Web site.


Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.


Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers and thus a return value may contain an unsafe injection (e.g. XSS) that does not conform to the RFC1035 format.


Postbird 0.8.4 allows stored XSS via the onerror attribute of an IMG element in any PostgreSQL database table. This can result in reading local files via vectors involving XMLHttpRequest and open of a file:/// URL or discovering PostgreSQL passwords via vectors involving Window.localStorage and savedConnections.


When SAP Commerce Cloud version 100 hosts a JavaScript storefront it is vulnerable to MIME sniffing which in certain circumstances could be used to facilitate an XSS attack or malware proliferation.


Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.


An issue was discovered in CommentsService.ashx in OnyakTech Comments Pro 3.8. The comment posting functionality allows an attacker to add an XSS payload to the JSON request that will execute when users visit the page with the comment.


Dolibarr ERP and CRM 13.0.2 allows XSS via object details as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature.


SAP NetWeaver AS JAVA (Enterprise Portal) versions - 7.10 7.20 7.30 7.31 7.40 7.50 reveals sensitive information in one of their HTTP requests an attacker can use this in conjunction with other attacks such as XSS to steal this information.


An issue was discovered in JFinal framework v4.9.10 and below. The \set\ method of the \Controller\ class of jfinal framework is not strictly filtered which will lead to XSS vulnerabilities in some cases.


** DISPUTED ** In Accela Civic Platform through 21.1 the security/hostSignon.do parameter servProvCode is vulnerable to XSS. NOTE: The vendor states \there are configurable security flags and we are unable to reproduce them with the available information.\


The new add subject parameter of Tad Uploader view book list function fails to filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.


Tad Book3 editing book function does not filter special characters. Unauthenticated attackers can remotely inject JavaScript syntax and execute stored XSS attacks.


MyBB before 1.8.28 allows stored XSS because the displayed Template Name value in the Admin CP's theme management is not escaped properly.


Sofico Miles RIA 2020.2 Build 127964T is affected by Stored Cross Site Scripting (XSS). An attacker with access to a user account of the RIA IT or the Fleet role can create a crafted work order in the damage reports section (or change existing work orders). The XSS payload is in the work order number.


OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload execution the attacked user must preview a vulnerable email template. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible.


Beeline Smart Box 2.0.38 is vulnerable to Cross Site Scripting (XSS) via the choose_mac parameter to setup.cgi.


wire-server is an open-source back end for Wire a secure collaboration platform. Before version 2.106.0 the CORS ` Access-Control-Allow-Origin ` header set by `nginz` is set for all subdomains of `.wire.com` (including `wire.com`). This means that if somebody were to find an XSS vector in any of the subdomains they could use it to talk to the Wire API using the user's Cookie. A patch does not exist but a workaround does. To make sure that a compromise of one subdomain does not yield access to the cookie of another one may limit the `Access-Control-Allow-Origin` header to apps that actually require the cookie (account-pages team-settings and the webapp).


UNSUPPORTED

WHEN

ASSIGNED

In

ARCHIBUS

Web

Central

(a

version

from

XSS

occurs

in

because

the

data

received

as

input

from

clients

is

re-included

within

the

HTTP

response

returned

by

the

application

without

adequate

validation.

In

this

way

if

HTML

code

or

client-side

executable

code

(e.g.

Javascript)

is

entered

as

input

the

expected

execution

flow

could

be

altered.

This

is

fixed

in

all

recent

versions

such

as

version

NOTE:

This

vulnerability

only

affects

products

that

are

no

longer

supported

by

the

maintainer.

Version

was

officially

de-supported

by

the

end

of


jsuites is an open source collection of common required javascript web components. In affected versions users are subject to cross site scripting (XSS) attacks via clipboard content. jsuites is vulnerable to DOM based XSS if the user can be tricked into copying _anything_ from a malicious and pasting it into the html editor. This is because a part of the clipboard content is directly written to `innerHTML` allowing for javascript injection and thus XSS. Users are advised to update to version 4.9.11 to resolve.


XSS Hunter Express before 2021-09-17 does not properly enforce authentication requirements for paths.