An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title parameter.


Discuz! DiscuzX X3.4 has XSS via the include\\spacecp\\spacecp_space.php appid parameter in a delete action.


An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php weblizar_pffree_settings_save_get-users parameter.


BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI.


The \Add Link to Facebook\ plugin through 2.3 for WordPress has XSS via the al2fb_facebook_id parameter to wp-admin/profile.php.


An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_pattern parameter.


The tabs-responsive plugin 1.8.0 for WordPress has XSS via the post_title parameter to wp-admin/post.php.


An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php button_text_link parameter.


An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_end parameter.


Piwigo v2.8.2 has XSS via the `tab` `to` `section` `mode` `installstatus` and `display` parameters of the `admin.php` file.


The \SagePay Server Gateway for WooCommerce\ plugin before 1.0.9 for WordPress has XSS via the includes/pages/redirect.php page parameter.


Netis WF2419 V2.2.36123 devices allow XSS via the Description parameter on the Bandwidth Control Rule Settings page.


The NotificationRepresentationFactoryImpl class in Atlassian Universal Plugin Manager before version 2.22.9 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of user submitted add-on names.


A vulnerability has been identified in SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1) SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3). A remote authenticated attacker with access to the configuration web server could be able to store script code on the web site if the HRP redundancy option is set. This code could be executed in the web browser of victims visiting this web site (XSS) affecting its confidentiality integrity and availability. User interaction is required for successful exploitation as the user needs to visit the manipulated web site. At the stage of publishing this security advisory no public exploitation is known. The vendor has confirmed the vulnerability and provides mitigations to resolve it.


The newsfeed (aka /index.php?page=viewnews) in BTITeam XBTIT 2.5.4 has stored XSS via the title of a news item. This is also exploitable via CSRF.


An issue was discovered in Joomla! before 3.8.12. Inadequate output filtering on the user profile page could lead to a stored XSS attack.


PHP Scripts Mall advanced-real-estate-script has XSS via the Name field of a profile.


PHP Scripts Mall hotel-booking-script 2.0.4 allows XSS via the First Name Last Name or Address field.


In waimai Super Cms 20150505 there is stored XSS via the /admin.php/Foodcat/editsave fcname parameter.


The editor in Xiuno BBS 4.0.4 allows stored XSS.


An issue was discovered in MiniCMS 1.10. There is a post.php?date= XSS vulnerability.


An issue was discovered in BTITeam XBTIT. By using String.replace and eval it is possible to bypass the includes/crk_protection.php anti-XSS mechanism that looks for a number of dangerous fingerprints.


PHP Scripts Mall Naukri / Shine / Jobsite Clone Script 3.0.4 has Stored XSS via the USERNAME field a related issue to CVE-2018-6795.


ThinkSAAS through 2018-07-25 has XSS via the index.php?app=group&ac=create&ts=do groupdesc parameter.


GetSimple CMS 3.3.14 has XSS via the admin/edit.php \Add New Page\ field.


Zyxel

devices

are

affected

by

a

persistent

XSS

vulnerability

via

the

hostname

parameter.


An issue was discovered in puppyCMS 5.1. There is an XSS vulnerability via menu.php in the \Add Page/URL\ URL link field.


CMS ISWEB 3.5.3 has XSS via the ordineRis sezioneRicerca or oggettiRicerca parameter to index.php.


tp5cms through 2017-05-25 has XSS via the admin.php/article/index.html q parameter.


PHP Scripts Mall Myperfectresume / JobHero / Resume Clone Script 2.0.6 has Stored XSS via the Full Name and Title fields.


_core/admin/pages/add/ in Subrion CMS 4.2.1 has XSS via the titlesen parameter.


CMSUno before 1.5.3 has XSS via the title field.


The Discuss v1.2.1 module in Claromentis 8.2.2 is vulnerable to stored Cross Site Scripting (XSS). An authenticated attacker will be able to place malicious JavaScript in the discussion forum which is present in the login landing page. A low privilege user can use this to steal the session cookies from high privilege accounts and hijack these enabling them to hijack the elevated session and perform actions in their security context.


An

issue

was

discovered

in

in

MyBB

On

the

forum

RSS

Syndication

page

one

can

generate

a

URL

such

as

The

thread

titles

(within

title

elements

of

the

generated

XML

documents)

aren't

sanitized

leading

to

XSS.


EasyIO EasyIO-30P devices before 2.0.5.27 allow XSS via the dev.htm GDN parameter.


ThinkSAAS through 2018-07-25 has XSS via the index.php?app=article&ac=comment&ts=do content parameter.


An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the Author field of the \Leave a Comment\ screen.


AirTies Air 5443v2 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.


Intelbras NPLUG 1.0.0.14 devices have XSS via a crafted SSID that is received via a network broadcast.


An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2. There is reflected XSS in the SQUEAL search function.


MiniCMS 1.10 when Internet Explorer is used allows XSS via a crafted URI because $_SERVER'REQUEST_URI' is mishandled.


AirTies Air 5442 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.


AirTies Air 5021 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.


XSS exists in WUZHI CMS 2.0 via the index.php v or f parameter.


An issue was discovered in SeaCMS 6.64. XSS exists in admin_video.php via the action area type yuyan jqtype v_isunion v_recycled v_ismoney or v_ispsd parameter.


XSS exists in admin/gb-dashboard-widget.php in the Gwolle Guestbook (gwolle-gb) plugin before 2.5.4 for WordPress via the PATH_INFO to wp-admin/index.php


Prospecta Master Data Online (MDO) 2.0 has Stored XSS.


On

the

RICOH

Aficio

MP

printer

HTML

Injection

and

Stored

XSS

vulnerabilities

have

been

discovered

in

the

area

of

adding

addresses

via

the

entryNameIn

parameter

to


The Tribulant Slideshow Gallery plugin before 1.6.6.1 for WordPress has XSS via the id method Gallerymessage Galleryerror or Galleryupdated parameter.


Vanilla before 2.6.1 allows XSS via the email field of a profile.


An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'sitename' parameter of the UpdateSite endpoint is vulnerable to stored XSS.


ExpressionEngine before 4.3.5 has reflected XSS.


On

the

RICOH

SP

printer

HTML

Injection

and

Stored

XSS

vulnerabilities

have

been

discovered

in

the

area

of

adding

addresses

via

the

entryNameIn

parameter

to


An issue was discovered in YMFE YApi 1.3.23. There is stored XSS in the name field of a project.


An issue was discovered in ZrLog 2.0.3. There is stored XSS in the file upload area via a crafted attached/file/ pathname.


Intersystems Cache 2017.2.2.865.0 allows XSS.


WUZHI CMS 4.1.0 has stored XSS via the \Membership Center\ \I want to ask\ \detailed description\ field under the index.php?m=member URI.


DASAN H660GW devices have Stored XSS in the Port Forwarding functionality.


The Snazzy Maps plugin before 1.1.5 for WordPress has XSS via the text or tab parameter.


An issue was discovered in springboot_authority through 2017-03-06. There is stored XSS via the admin/role/edit roleKey name or description parameter.


In the 5.4.0 version of the Fork CMS software HTML Injection and Stored XSS vulnerabilities were discovered via the /backend/ajax URI.


The Apache2 component in PHP before 5.6.38 7.0.x before 7.0.32 7.1.x before 7.1.22 and 7.2.x before 7.2.10 allows XSS via the body of a \Transfer-Encoding: chunked\ request because the bucket brigade is mishandled in the php_handler function in sapi/apache2handler/sapi_apache2.c.


The Quizlord plugin through 2.0 for WordPress is prone to Stored XSS via the title parameter in a ql_insert action to wp-admin/admin.php.


AirTies Air 5343v2 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.


An issue was discovered in OTCMS 3.61. XSS exists in admin/share_switch.php via these parameters: fieldName fieldName2 tabName.


Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php because $_SERVER'PHP_SELF' is mishandled.


Navigate CMS 2.8 has Stored XSS via a navigate_upload.php (aka File Upload) request with a multipart/form-data JavaScript payload.


translate man before 2018-08-21 has XSS via containers/outputBox/outputBox.vue and store/index.js.


AirTies Air 5650 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.


The admin interface of the Grouptime Teamwire Client 1.5.1 prior to 1.9.0 on-premises messenger server allows stored XSS. All backend versions prior to prod-2018-11-13-15-00-42 are affected.


in

EasyCMS

has

XSS

via

the

uploadifyID

or

movieName

parameter

a

related

issue

to


An issue was discovered in yiqicms through 2016-11-20. There is stored XSS in comment.php because a length limit can be bypassed.


An issue was discovered on D-Link Central WiFi Manager before v 1.03r0100-Beta1. The 'username' parameter of the addUser endpoint is vulnerable to stored XSS.


An issue was discovered in ZRLOG 2.0.1. There is a Stored XSS vulnerability in the nickname field of the comment area.


An issue was discovered in DonLinkage 6.6.8. The modules /pages/bazy/bazy_adresow.php and /pages/proxy/add.php are vulnerable to stored XSS that can be triggered by closing <textarea> followed by <script></script> tags.


AirTies Air 5750 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.


Lifesize Express ls ex2_4.7.10 2000 (14) devices allow XSS via the interface/interface.php brand parameter.


PrinterOn Enterprise 4.1.4 suffers from multiple authenticated stored XSS vulnerabilities via the (1) \Machine Host Name\ or \Server Serial Number\ field in the clustering configuration (2) \name\ field in the Edit Group configuration (3) \Rule Name\ field in the Access Control configuration (4) \Service Name\ in the Service Configuration or (5) First Name or Last Name field in the Edit Account configuration.


In LimeSurvey 3.14.7 HTML Injection and Stored XSS have been discovered in the appendix via the surveyls_title parameter to /index.php?r=admin/survey/sa/insert.


BullGuard Safe Browsing before 18.1.355.9 allows XSS on Google Bing and Yahoo! pages via domains indexed in search results.


An issue was discovered in e107 v2.1.9. There is a XSS attack on e107_admin/comment.php.


A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.


An issue was discovered in UCMS 1.4.6. aaddpost.php has stored XSS via the sadmin/aindex.php minfo parameter in a sadmin_aaddpost action.


InfluxDB 0.9.5 has Reflected XSS in the Write Data module.


An issue was discovered in GetSimple CMS 3.3.15. An administrator can insert stored XSS via the admin/settings.php Custom Permalink Structure parameter which injects the XSS payload into any page created at the admin/pages.php URI.


A stored XSS vulnerability exists in the web interface on D-Link DSL-3782 devices with firmware 1.01 that allows authenticated attackers to inject a JavaScript or HTML payload inside the ACL page. The injected payload would be executed in a user's browser when \/cgi-bin/New_GUI/Acl.asp\ is requested.


Kofax Front Office Server version 4.1.1.11.0.5212 (both Thin Client and Administration Console) suffers from multiple authenticated stored XSS vulnerabilities via the (1) \Filename\ field in /Kofax/KFS/ThinClient/document/upload/ - (Thin Client) or (2) \DeviceName\ field in /Kofax/KFS/Admin/DeviceService/device/ - (Administration Console).


CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.


The

Jibu

Pro

plugin

through

for

WordPress

is

prone

to

Stored

XSS

via

the

name

(aka

Quiz

Name)

field.


AirTies Air 5453 devices with software 1.0.0.18 have XSS via the top.html productboardtype parameter.


In

YzmCMS

stored

XSS

exists

via

the

title

parameter.


Aryanic HighPortal 12.5 has XSS via an Add Tags action.


In Zoho ManageEngine AssetExplorer a Stored XSS vulnerability was discovered in the 6.2.0 version via the /AssetDef.do ciName or assetName parameter.


Nagios XI before 5.5.4 has XSS in the auto login admin management page.


MODX Revolution v2.6.5-pl allows stored XSS via a Create New Media Source action.


An issue was discovered in OTCMS 3.61. XSS exists in admin/users.php via these parameters: dataTypeCN dataMode dataModeStr.


The

$args

variable

in

in

REDAXO

is

not

effectively

filtered

because

names

are

not

restricted

(only

values

are

restricted).

The

attacker

can

insert

XSS

payloads

via

an

index.php?page=mediapool/media&opener_input_field=&args

substring.


CQU-LANKERS through 2017-11-02 has XSS via the public/api.php callback parameter in an uploadpic action.


An

issue

was

discovered

in

JEESNS

The

XSS

filter

in

com.lxinet.jeesns.core.utils.XssHttpServletRequestWrapper.java

could

be

bypassed

as

demonstrated

by

a

<svg/onLoad=confirm

substring.

NOTE:

this

vulnerability

exists

because

of

an

incomplete

fix

for


XSS exists in zzcms v8.3 via the /uploadimg_form.php noshuiyin parameter.


K-Net Cisco Configuration Manager through 2014-11-19 has XSS via devices.php.


On

the

RICOH

Aficio

MP

printer

HTML

Injection

and

Stored

XSS

vulnerabilities

have

been

discovered

in

the

area

of

adding

addresses

via

the

entryNameIn

parameter

to


WUZHI CMS 4.1.0 has stored XSS via the \Extension module\ \SMS in station\ field under the index.php?m=core URI.


The message-page.jsp error page used the value of the HTTP request header X-ProxyContextPath without sanitization resulting in a reflected XSS attack. Mitigation: The fix to correctly parse and sanitize the request attribute value was applied on the Apache NiFi 1.8.0 release. Users running a prior 1.x release should upgrade to the appropriate release.


An issue was discovered in SeaCMS 6.64. XSS exists in admin_datarelate.php via the time or maxHit parameter in a dorandomset action.


In Joomla! before 3.8.4 inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types i.e. list radio and checkbox


PHP Scripts Mall Doctor Search Script 1.0.2 has Stored XSS via an arbitrary profile field.


PHP Scripts Mall Image Sharing Script 1.3.3 has XSS via the Full Name field in an Edit Profile action.


Simditor v2.3.11 allows XSS via crafted use of svg/onload=alert in a TEXTAREA element as demonstrated by Firefox 54.0.1.


A persistent Cross Site Scripting (XSS) vulnerability in the Green Electronics RainMachine Mini-8 (2nd Generation) and Touch HD 12 web application allows an attacker to inject arbitrary JavaScript via the REST API.


Composr CMS 10.0.13 has XSS via the site_name parameter in a page=admin-setupwizard&type=step3 request to /adminzone/index.php.


XSS vulnerability in htdocs/webinc/js/bsc_sms_inbox.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to read a cookie via a crafted Treturn parameter to soap.cgi.


XSS vulnerabilities in Interstitials in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension or open Developer Console to inject arbitrary scripts or HTML via a crafted HTML page.


The acx_asmw_saveorder_callback function in function.php in the acurax-social-media-widget plugin before 3.2.6 for WordPress has CSRF via the recordsArray parameter to wp-admin/admin-ajax.php with resultant social_widget_icon_array_order XSS.


static/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href.


The

PropertyHive

plugin

before

for

WordPress

has

XSS

via

the

body

parameter

to


XSS vulnerability in htdocs/webinc/body/bsc_sms_send.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to read a cookie via a crafted receiver parameter to soap.cgi.


PHP Scripts Mall Multilanguage Real Estate MLM Script 3.0 has Stored XSS via every profile input field.


Cozy version 2 has XSS allowing remote attackers to obtain administrative access via JavaScript code in the url parameter to the /api/proxy URI as demonstrated by an XMLHttpRequest call with an 'email:\attacker@example.com\' request which can be followed by a password reset.


Promise Technology WebPam Pro-E devices allow remote attackers to conduct XSS HTTP Response Splitting and CRLF Injection attacks via JavaScript code in a PHPSESSID cookie.


XSS Auditor in Google Chrome prior to 64.0.3282.119 did not ensure the reporting URL was in the same origin as the page it was on which allowed a remote attacker to obtain referrer details via a crafted HTML page.


Kentico 10 before 10.0.50 and 11 before 11.0.3 has XSS in which a crafted URL results in improper construction of a system page.


The

page

module

in

before

and

has

XSS

via

$GLOBALS'TYPO3_CONF_VARS''SYS''sitename'

as

demonstrated

by

an

admin

entering

a

crafted

site

name

during

the

installation

process.


Monstra CMS through 3.0.4 has XSS in the title function in plugins/box/pages/pages.plugin.php via a page title to admin/index.php.


Insufficient encoding of URL fragment identifiers in Blink in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform a DOM based XSS attack via a crafted HTML page.


dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.


In Joomla! Core before 3.8.8 inadequate filtering of file and folder names leads to various XSS attack vectors in the media manager.


F-Secure

Radar

(on-premises)

before

has

XSS

via

vectors

involving

the

Tags

parameter

in

the

JSON

request

body

in

an

outbound

request

for

the

resource

aka

a

\suggested

metadata

tags

for

assets\

issue.


XSS

vulnerability

in

in

D-Link

and

previous

versions

and

previous

versions

and

and

previous

versions

allows

remote

attackers

to

read

a

cookie

via

a

crafted

deviceid

parameter

to

soap.cgi.


PHP Scripts Mall Multi Language Olx Clone Script 2.0.6 has XSS via the Leave Comment field.


PHP Scripts Mall Naukri Clone Script 3.0.3 has Stored XSS via every profile input field.


Netis WF2419 V3.2.41381 devices allow XSS via the Description field on the MAC Filtering page.


In Joomla! before 3.8.4 lack of escaping in the module chromes leads to XSS vulnerabilities in the module system.


templates/forms/thanks.html in Formspree before 2018-01-23 allows XSS related to the _next parameter.


PHP Scripts Mall Student Profile Management System Script v2.0.6 has XSS via the Name field to list_student.php.


In Joomla! before 3.8.4 inadequate input filtering in the Uri class (formerly JUri) leads to an XSS vulnerability.


Bookly #1 WordPress Booking Plugin Lite before 14.5 has XSS via a jQuery.ajax request to ng-payment_details_dialog.js.


An

issue

was

discovered

in

Western

Bridge

Cobub

Razor

Authentication

is

not

required

for

/index.php?/manage/channel/modifychannel.

For

example

with

a

crafted

channel

name

stored

XSS

is

triggered

during

a

later

/index.php?/manage/channel

request

by

an

admin.


An issue was discovered in ProjectSend before r1053. XSS exists in the \Name\ field on the My Account page.


In Schneider Electric U.motion Builder software versions prior to v1.3.4 a cross site scripting (XSS) vulnerability exists which could allow injection of malicious scripts.


An issue was discovered on RLE Protocol Converter FDS-PC / FDS-PC-DP 2.1 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP.


The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /admin.php?page=photo-${photo_number} request. CSRF exploitation related to CVE-2017-10681 may be possible.


An issue was discovered in GLPI through 9.2.1. The application is affected by XSS in the query string to front/preference.php. An attacker is able to create a malicious URL that if opened by an authenticated user with debug privilege will execute JavaScript code supplied by the attacker. The attacker-supplied code can perform a wide variety of actions such as stealing the victim's session token or login credentials performing arbitrary actions on the victim's behalf and logging their keystrokes.


An XSS issue was discovered in VirtueMart before 3.2.14. All the textareas in the backend of the plugin can be closed by simply adding </textarea> to the value and saving the product/config. By editing back the product/config the editor's browser will execute everything after the </textarea> leading to a possible XSS.


In Drupal's 3rd party module search auto complete prior to versions 7.x-4.8 there is a Cross Site Scripting vulnerability. This Search Autocomplete module enables you to autocomplete textfield using data from your website (nodes comments etc.). The module doesn't sufficiently filter user-entered text among the autocompletion items leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited by any user allowed to create one of the autocompletion item for instance nodes users comments.


PHP Scripts Mall Hot Scripts Clone:Script Classified Version 3.1 Application is vulnerable to stored XSS within the \Add New\ function for a Management User. Within the \Add New\ section the application does not sanitize user supplied input to the name parameter and renders injected JavaScript code to the user's browser. This is different from CVE-2018-6878.


An

issue

was

discovered

in

Wowza

Streaming

Engine

before

There

is

an

XSS

vulnerability

in

the

HTTP

providers

(com.wowza.wms.http.HTTPProviderMediaList

and

com.wowza.wms.http.streammanager.HTTPStreamManager)

causing

script

injection

and/or

reflection

via

a

crafted

HTTP

request.


lyadmin

has

XSS

via

the

parameter

to

the

/admin.php?s=/admin/config/groupsave.html

URI.


Monitorix before 3.10.1 allows XSS via CGI variables.


There are multiple Persistent XSS vulnerabilities in Radiant CMS 1.1.4. They affect Personal Preferences (Name and Username) and Configuration (Site Title Dev Site Domain Page Parts and Page Fields).


Shimmie 2 2.6.0 allows an attacker to upload a crafted SVG file that enables stored XSS.


An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340 Premium Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a password change on the web server.


In YzmCMS 3.6 index.php has XSS via the a c or m parameter.


An issue was discovered on RLE Wi-MGR/FDS-Wi 6.2 devices. Persistent XSS exists in the web server. Remote attackers can inject malicious JavaScript code using the device's BACnet implementation. This is similar to a Cross Protocol Injection with SNMP.


controllers/admin/Linkage.php in dayrui FineCms 5.3.0 has Cross Site Scripting (XSS) via the id or lid parameter in a c=linkage m=import request to admin.php because the xss_clean protection mechanism is defeated by crafted input that lacks a '<' or '>' character.


An XSS vulnerability (via an SVG image) in Tiki before 18 allows an authenticated user to gain administrator privileges if an administrator opens a wiki page with a malicious SVG image related to lib/filegals/filegallib.php.


Stored XSS exists on Polycom QDX 6000 devices.


Eramba e1.0.6.033 has Reflected XSS in the Date Filter via the created parameter to the /crons URI.


October CMS through 1.0.431 allows XSS by entering HTML on the Add Posts page.


The management panel in Piwigo 2.9.3 has stored XSS via the virtual_name parameter in a /admin.php?page=cat_list request a different issue than CVE-2017-9836. CSRF exploitation related to CVE-2017-10681 may be possible.


Eramba e1.0.6.033 has Reflected XSS on the Error page of the CSV file inclusion tab of the /importTool/preview URI with a CSV file polluted with malicious JavaScript.


Eramba

has

Reflected

XSS

in

reviews/filterIndex/ThirdPartyRiskReview

via

the

parameter

(aka

the

Search

Parameter).


The htmlImageAddTitleAttribute function in sige.php in the Kubik-Rubik Simple Image Gallery Extended (SIGE) extension 3.2.3 for Joomla! has XSS via a crafted image header as demonstrated by the Caption-Abstract header object in a JPEG file. This is fixed in 3.3.1.


Tiki 17.1 allows upload of a .PNG file that actually has SVG content leading to XSS.


The management panel in Piwigo 2.9.3 has stored XSS via the name parameter in a /ws.php?format=json request. CSRF exploitation related to CVE-2017-10681 may be possible.


Eramba e1.0.6.033 has Stored XSS on the tooltip box via the /programScopes description parameter.


lib/Zonemaster/GUI/Dancer/Export.pm in Zonemaster Web GUI before 1.0.11 has XSS.


** DISPUTED ** In Z-BlogPHP 1.5.1.1740 cmd.php has XSS via the ZC_BLOG_SUBNAME parameter or ZC_UPLOAD_FILETYPE parameter. NOTE: the software maintainer disputes that this is a vulnerability.


RoomWizard before 4.4.x allows XSS via the HelpAction.action pageName parameter.


Subrion CMS v4.2.1 allows XSS via the panel/configuration/general/ SITE TITLE parameter.


PHP Scripts Mall Olx Clone 3.4.2 has XSS.


helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.


panel/uploads/#elf_l1_XA in Subrion CMS v4.2.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.


Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.


The Image Import function in XWiki through 10.7 has XSS.


PESCMS Team 2.2.1 has multiple reflected XSS via the keyword parameter: g=Team&m=User&a=index&keyword= g=Team&m=User_group&a=index&keyword= g=Team&m=Department&a=index&keyword= and g=Team&m=Bulletin&a=index&keyword=.


PHP Scripts Mall Domain Lookup Script 3.0.5 allows XSS in the search bar.


index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.


Ogma CMS 0.4 Beta has XSS via the \Footer Text footer\ field on the \Theme/Theme Options\ screen.


** DISPUTED ** There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via Add Filtering Options(Add Rule). NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator and the action described can only be taken advantage of by a logged in administrator.


SeaCMS V6.61 has XSS via the admin_video.php v_content parameter related to the site name.


An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter.


The

removeXSS

function

in

(called

from

in

EasyCMS

allows

XSS

via

an

onhashchange

event.


MorningStar WhatWeb 0.4.9 has XSS via JSON report files.


WUZHI CMS 4.1.0 has XSS via the index.php?m=core&f=set&v=basic formstatcode parameter.


An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the site name in the \Categories\ menu.


Evolution CMS 1.4.x allows XSS via the manager/ search parameter.


An issue was discovered in Mayan EDMS before 3.0.2. The Appearance app sets window.location directly leading to XSS.


** DISPUTED ** There are multiple XSS vulnerabilities in WP All Import plugin 3.4.9 for WordPress via action=template. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator and the action described can only be taken advantage of by a logged in administrator.


panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page.


WUZHI CMS 4.1.0 has XSS via the index.php?m=link&f=index&v=add formremark parameter.


There is an XSS vulnerability in the mndpsingh287 File Manager plugin 3.0 for WordPress via the page=wp_file_manager_root public_path parameter.


Complete Responsive CMS Blog through 2018-05-20 has XSS via a comment.


SolarWinds

Database

Performance

Analyzer

(DPA)

and

have

several

persistent

XSS

vulnerabilities

related

to

logViewer.iwc

centralManage.cen

userAdministration.iwc

database.iwc

alertManagement.iwc

eventAnnotations.iwc

and

central.cen.


There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.


Kirby v2.5.12 allows XSS by using the \site files\ Add option to upload an SVG file.


In the rcfilters plugin 2.1.6 for Roundcube XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).


panel/login in Kirby v2.5.12 allows XSS via a blog name.


Frog CMS 0.9.5 has stored XSS via /admin/?/plugin/comment/settings.


WAGO 750-88X and WAGO 750-89X Ethernet Controller devices versions 01.09.18(13) and before have XSS in the SNMP configuration via the webserv/cplcfg/snmp.ssi SNMP_DESC or SNMP_LOC_SNMP_CONT field.


D-Link DIR-600M devices allow XSS via the Hostname and Username fields in the Dynamic DNS Configuration page.


BlogCMS through 2016-10-25 has XSS via a comment.


In b3log Solo 2.9.3 XSS in the Input page under the Publish Articles menu with an ID of linkAddress stored in the link JSON field allows remote attackers to inject arbitrary Web scripts or HTML via a crafted site name provided by an administrator.


MiniCMS V1.10 has XSS via the mc-admin/post-edit.php tags parameter.


DedeCMS 5.7 SP2 allows XSS via an onhashchange attribute in the msg parameter to /plus/feedback_ajax.php.


CraftedWeb through 2013-09-24 has reflected XSS via the p parameter.


In Symphony before 3.3.0 there is XSS in the Title under Post. The ID \articleTitle\ of this is stored in the \articleTitle\ JSON field and executes a payload when accessing the /member/test/points URI allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated user via a crafted web site name.


index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name.


** DISPUTED ** There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=evaluate. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator and the action described can only be taken advantage of by a logged in administrator.


An issue was discovered in Mayan EDMS before 3.0.3. The Tags app has XSS because tag label values are mishandled.


In Zoho ManageEngine SupportCenter Plus before 8.1 Build 8109 there is HTML Injection and Stored XSS via the /ServiceContractDef.do contractName parameter.


Mezzanine

CMS

allows

XSS

via

the

/admin/blog/blogcategory/add/?_to_field=id&_popup=1

title

parameter

at

admin/blog/blogpost/add/.


There is XSS in GetSimple CMS 3.4.0.9 via the admin/edit.php title field.


There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. Carefully crafted requests can impact the data returned by the `scheme` method on `Rack::Request`. Applications that expect the scheme to be limited to 'http' or 'https' and do not escape the return value could be vulnerable to an XSS attack. Note that applications using the normal escaping mechanisms provided by Rails may not impacted but applications that bypass the escaping mechanisms or do not use them may be vulnerable.


An issue was discovered in Gleez CMS v1.2.0. There is XSS via media/imagecache/resize.


dotCMS

has

XSS

in

the

fieldName

and

inode

parameters.


** DISPUTED ** There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator and the action described can only be taken advantage of by a logged in administrator.


The issue was discovered in IdeaCMS through 2016-04-30. There is reflected XSS via the index.php?c=content&a=search kw parameter. NOTE: this product is discontinued.


The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.


Zurmo

Stable

allows

XSS

via

app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.


\\upload\\plugins\\sys\\Install.php in CScms 4.1 has XSS via the site name.


An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete state=draft or state=publish request.


An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View.


Cybrotech CyBroHttpServer 1.0.3 allows XSS via a URI.


An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.


Mitsubishi Electric SmartRTU devices allow XSS via the username parameter or PATH_INFO to login.php.


In IceWarp Server 12.0.3.1 and before there is XSS in the /webmail/ username field.


Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.


** DISPUTED ** There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator and the action described can only be taken advantage of by a logged in administrator.


Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.


An issue was discovered in Dolibarr through 7.0.0. There is Stored XSS in expensereport/card.php in the expense reports plugin via the comments parameter or a public or private note.


A stored xss in tianma-static module versions <=1.0.4 allows an attacker to execute arbitrary javascript.


ShowDoc v1.8.0 has XSS via a new page.


An issue was discovered in UCMS 1.4.6. There is XSS in the title bar as demonstrated by a do=list request.


An issue was discovered in Open XDMoD through 7.5.0. html/gui/general/login.php has Reflected XSS via the xd_user_formal_name parameter.


The \utilisateur\ menu in Creatiwity wityCMS 0.6.2 modifies the presence of XSS at two input points for user information with the \first name\ and \last name\ parameters.


Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the \Site options\ in the admin panel dashboard dropdown.


An

issue

is

discovered

in

baijiacms

XSS

exists

via

the

id

parameter

aka

\Non-standard

use

of

the

flash

component.\


Monstra CMS V3.0.4 has XSS when ones tries to register an account with a crafted password parameter to users/registration a different vulnerability than CVE-2018-11473.


b3log Solo 2.9.3 has XSS in the Input page under the \Publish Articles\ menu with an ID of \articleTags\ stored in the \tag\ JSON field which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request.


** DISPUTED ** There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via action=options. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator and the action described can only be taken advantage of by a logged in administrator.


Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.


An issue was discovered in Mayan EDMS before 3.0.2. The Cabinets app has XSS via a crafted cabinet label.


Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new.


PHPOK 4.8.278 has a Reflected XSS vulnerability in framework/www/login_control.php via the _back parameter to the ok_f function.


PHP Scripts Mall Market Place Script 1.0.1 allows XSS via a keyword.


The mndpsingh287 File Manager plugin V2.9 for WordPress has XSS via the lang parameter in a wp-admin/admin.php?page=wp_file_manager request because set_transient is used in file_folder_manager.php and there is an echo of lang in lib\\wpfilemanager.php.


cPanel through 74 allows XSS via a crafted filename in the logs subdirectory of a user account because the filename is mishandled during frontend/THEME/raw/index.html rendering.


An issue was discovered in the administration page in IPBRICK OS 6.3. There are multiple XSS vulnerabilities.


Authenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to execute codeby injecting arbitrary web script or HTML via modifying the name of the users. The XSS is executed when an administrator access the logs.


Stored XSS in b2evolution CMS version 6.11.6 and prior allows an attacker to perform malicious JavaScript code execution via the plugin name input field in the plugin module.


Unauthenticated Stored XSS in FME Server versions 2019.2 and 2020.0 Beta allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via the login page. The XSS is executed when an administrator accesses the logs.


Untis WebUntis before 2020.9.6 allows XSS in multiple functions that store information.


MediaKind (formerly Ericsson) RX8200 5.13.3 devices are vulnerable to multiple reflected and stored XSS. An attacker has to inject JavaScript code directly in the \path\ or \Services+ID\ parameters and send the URL to a user in order to exploit reflected XSS. In the case of stored XSS an attacker must modify the \name\ parameter with the malicious code.


An issue was discovered in HFish 0.5.1. When a payload is inserted where the password is entered XSS code is triggered when the administrator views the information.


CMS Made Simple before 2.2.15 allows XSS via the m1_mod parameter in a ModuleManager local_uninstall action to admin/moduleinterface.php.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


Subrion CMS 4.2.1 is affected by: Cross Site Scripting (XSS) through the avatarpath parameter in a POST request to the /_core/profile/ URI.


Courier Management System 1.0 - 'First Name' Stored XSS


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


** UNSUPPORTED WHEN ASSIGNED ** Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseAssets.do file via the title parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


The DNS query log in Pi-hole before 5.2.2 is vulnerable to stored XSS. An attacker with the ability to directly or indirectly query DNS with a malicious hostname can cause arbitrary JavaScript to execute when the Pi-hole administrator visits the Query Log or Long-term data Query Log page.


MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter::makePageLink(). This affects MediaWiki 1.33.0 and later.


EGavilan Barcodes generator 1.0 is affected by: Cross Site Scripting (XSS) via the index.php. An Attacker is able to inject the XSS payload in the web application each time a user visits the website.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

and

before


** UNSUPPORTED WHEN ASSIGNED ** Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/index.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


** UNSUPPORTED WHEN ASSIGNED ** Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the initFile.jsp file via the msg parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


The job posting recommendation form in Persis Human Resource Management Portal (Versions 17.2.00 through 17.2.35 and 19.0.00 through 19.0.20) when the \Recommend job posting\ function is enabled allows XSS via the SENDER parameter.


Adminer through 4.7.8 allows XSS via the history parameter to the default URI.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

Stored

XSS.

This

affects

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

and

before


Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies an application feature could attack other users including administrators. For example by loading an externally crafted JavaScript file an attacker could eventually perform actions as the target user. These actions include changing the user passwords altering user or email addresses or adding a new administrator to the system.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


CXUUCMS V3 3.1 is affected by a reflected XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the imgurl parameter of admin.php?c=content&a=add.


** UNSUPPORTED WHEN ASSIGNED ** Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Search/index.jsp file via the added parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. The pagelayer_settings_page function is vulnerable to CSRF which can lead to XSS.


Unisys Data Exchange Management Studio through 5.0.34 doesn't sanitize the input to a HTML document field. This could be used for an XSS attack.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An XSS issue was discovered in Roundcube Webmail before 1.2.13 1.3.x before 1.3.16 and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


In MediaWiki before 1.35.1 the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.)


A

storage

XSS

vulnerability

is

found

in

YzmCMS

which

can

be

used

by

attackers

to

inject

JS

code

and

attack

malicious

XSS

on

the

page.


An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is an incomplete XSS filter allowing an attacker to inject crafted malicious code into the page.


** UNSUPPORTED WHEN ASSIGNED ** Reflected XSS in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to inject malicious code into the browser via a specially crafted link to the cConn.jsp file via the ur parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


** UNSUPPORTED WHEN ASSIGNED ** Stored XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to store malicious code in multiple fields (first name last name and logon name) when creating or modifying a user via the submitUser.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example the return of Language::userTimeAndDate is is always unsafe for HTML in a month value. This affects MediaWiki 1.12.0 and later.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

and

before


An issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1. SpecialGlobalUsage.php calls WikiMap::makeForeignLink unsafely. The $page variable within the formatItem function was not being properly escaped allowing for XSS under certain conditions.


SolarWinds Orion Platform before 2020.2.5 allows stored XSS attacks by an administrator on the Customize View page.


** UNSUPPORTED WHEN ASSIGNED ** Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the Error.jsp file via the err parameter (or indirectly via the cpr tcp or abs parameter). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


Ignite Realtime Openfire 4.6.0 has plugins/dbaccess/db-access.jsp sql Stored XSS.


An issue was discovered in the All in One SEO Pack plugin before 3.6.2 for WordPress. The SEO Description and Title fields are vulnerable to unsanitized input from a Contributor leading to stored XSS.


bloofoxCMS 0.5.2.1 is infected with XSS that allows remote attackers to execute arbitrary JS/HTML Code.


An issue was discovered in MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 through 2.6.2. There is a self XSS issue with a crafted cookie in the login page.


An issue was discovered in zzcms2020. There is a XSS vulnerability that can insert and execute JS code arbitrarily via /user/manage.php.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Savsoft Quiz 5 is affected by: Cross Site Scripting (XSS) via field_title (aka a title on the custom fields page).


UNSUPPORTED

WHEN

ASSIGNED

Reflected

XSS

in

Quest

Policy

Authority

version

allows

attackers

to

inject

malicious

code

into

the

browser

via

a

specially

crafted

link

to

the

file

via

the

unqID

parameter.

NOTE:

This

vulnerability

only

affects

products

that

are

no

longer

supported

by

the

maintainer.


BigProf Online Invoicing System before 4.0 fails to adequately sanitize fields for HTML characters upon an administrator using admin/pageEditGroup.php to create a new group resulting in Stored XSS. The caveat here is that an attacker would need administrative privileges in order to create the payload. One might think this completely mitigates the privilege-escalation impact as there is only one high-privileged role. However it was discovered that the endpoint responsible for creating the group lacks CSRF protection.


Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp groupchatJID Stored XSS.


Ignite Realtime Openfire 4.6.0 has plugins/bookmarks/create-bookmark.jsp Stored XSS.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

and

before


XSS in the Add Expense Component of EGavilan Media Expense Management System 1.0 allows an attacker to permanently store malicious JavaScript code via the 'description' field


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

and

before


** UNSUPPORTED WHEN ASSIGNED ** Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the /WebCM/Applications/Reports/index.jsp file via the by parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


Seo Panel 4.8.0 allows stored XSS by an Authenticated User via the url parameter as demonstrated by the seo/seopanel/websites.php URI.


Ignite Realtime Openfire 4.6.0 has plugins/clientcontrol/spark-form.jsp Reflective XSS.


HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks.


The

limit-login-attempts-reloaded

plugin

before

for

WordPress

allows

wp-admin/options-general.php?page=limit-login-attempts&tab=

XSS.

A

malicious

user

can

cause

an

administrator

user

to

supply

dangerous

content

to

the

vulnerable

page

which

is

then

reflected

back

to

the

user

and

executed

by

the

web

browser.

The

most

common

mechanism

for

delivering

malicious

content

is

to

include

it

as

a

parameter

in

a

URL

that

is

posted

publicly

or

e-mailed

directly

to

victims.


BigProf Online Invoicing System before 3.1 fails to correctly sanitize an XSS payload when a user registers using the self-registration functionality. As such an attacker can input a crafted payload that will execute upon the application's administrator browsing the registered users' list. Once the arbitrary Javascript is executed in the context of the admin this will cause the attacker to gain administrative privileges effectively leading into an application takeover. This affects app/membership_signup.php and app/admin/pageViewMembers.php.


** UNSUPPORTED WHEN ASSIGNED ** Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the ReportPreview.do file via the referer parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


** DISPUTED ** Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report is disputed because \admins are considered trustworthy.\


in

Twitter

TwitterServer

(aka

twitter-server)

before

in

some

configurations

allows

XSS

via

the

/histograms

endpoint.


** UNSUPPORTED WHEN ASSIGNED ** Reflected XSS in Quest Policy Authority 8.1.2.200 allows remote attackers to inject malicious code into the browser via a specially crafted link to the BrowseDirs.do file via the title parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


Ignite Realtime Openfire 4.6.0 has create-bookmark.jsp users Stored XSS.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered in the PageLayer plugin before 1.1.2 for WordPress. Nearly all of the AJAX action endpoints lacked permission checks allowing these actions to be executed by anyone authenticated on the site. This happened because nonces were used as a means of authorization but a nonce was present in a publicly viewable page. The greatest impact was the pagelayer_save_content function that allowed pages to be modified and allowed XSS to occur.


An XSS issue has been discovered in phpLDAPadmin before 1.2.6.2 that allows users to store malicious values that may be executed by other users at a later time via get_request in lib/function.php.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


NoneCMS v1.3 has a CSRF vulnerability in public/index.php/admin/nav/add.html as demonstrated by adding a navigation column which can be injected with arbitrary web script or HTML via the name parameter to launch a stored XSS attack.


PHP-Fusion

is

affected

by

Cross

Site

Scripting

(XSS)

via


Spiceworks Version <= 7.5.00107 is affected by XSS. Any name typed on Custom Groups function is vulnerable to stored XSS as they displayed on http://127.0.0.1/inventory/groups/ without output sanitization.


XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS to Home/c/ErrorController.php.


WebPort-v1.19.17121 is affected by Cross Site Scripting (XSS) on the \connections\ feature.


NeDi 1.9C allows pwsec.php oid XSS.


An issue was discovered in FUEL CMS V1.4.7. An attacker can use a XSS payload and bypass a filter via /fuelCM/fuel/pages/edit/1?lang=english.


Laborator Neon dashboard v3 is affected by stored Cross Site Scripting (XSS) via the chat tab.


webTareas v2.1 is affected by Cross Site Scripting (XSS) on \Search.\


Chamilo LMS version 1.11.10 contains an XSS vulnerability in the personal profile edition form affecting the user him/herself and social network friends.


XSS

exists

in

JIZHICMS

via

index.php/Wechat/checkWeixin?signature=1&echostr={XSS

to


Pega

Platform

through

is

affected

by

Cross

Site

Scripting

(XSS)

via

the

ConnectionID

parameter

as

demonstrated

by

a

pyActivity=Data-TRACERSettings.pzStartTracerSession

request

to

a

PRAuth

URI.


Stored XSS was discovered in the tree mode of jsoneditor before 9.0.2 through injecting and executing JavaScript.


In YzmCMS 5.6 XSS was discovered in member/member_content/init.html via the SRC attribute of an IFRAME element because of using UEditor 1.4.3.3.


NeDi 1.9C allows inc/rt-popup.php d XSS.


In

YzmCMS

stored

XSS

exists

via

the

action

parameter

which

allows

remote

attackers

to

upload

a

swf

file.

The

swf

file

can

be

injected

with

arbitrary

web

script

or

HTML.


Pbootcms v2.0.3 is vulnerable to Cross Site Scripting (XSS) via admin.php.


In IBOS 4.5.4 the email function has a cross site scripting (XSS) vulnerability in emailbodycontent parameter.


Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). An attacker can add JavaScript code to the filename.


Cross Site Scriptiong (XSS) vulnerability exists in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized \query_string\ variable in app\\devices\\device_imports.php.


Sagemcom

HUN

has

XSS

via

RgDiagnostics.asp

RgDdns.asp

RgFirewallEL.asp


HomeAutomation 3.3.2 is affected by persistent Cross Site Scripting (XSS). XSS vulnerabilities occur when input passed via several parameters to several scripts is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session.


Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type.


A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \Exclude these IP addresses from the \Site Down\ status\ parameter under the \Maintenance Mode\ module.


PageLayer before 1.3.5 allows reflected XSS via the font-size parameter.


The Advanced Custom Fields plugin before 5.8.12 for WordPress mishandles the escaping of strings in Select2 dropdowns potentially leading to XSS.


A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \Path for the {page_image} tag:\ or \Path for thumbnail field:\ parameters under the \Content Editing Settings\ module.


Redmine before 4.0.7 and 4.1.x before 4.1.1 has XSS via the back_url field.


Redmine before 4.0.7 and 4.1.x before 4.1.1 has stored XSS via textile inline links.


A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \Email address to receive notification of news submission\ parameter under the \Options\ module.


PageLayer before 1.3.5 allows reflected XSS via color settings.


An XSS vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited this vulnerability allows attackers to inject malicious code. This issue affects: QNAP Systems Inc. QTS versions prior to 4.5.2.1566 Build 20210202. QNAP Systems Inc. QuTS hero versions prior to h4.5.2.1638 build 20210414. This issue does not affect: QNAP Systems Inc. QTS 4.5.3.


RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows XSS via nested forms.


Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00 as demonstrated by the /if.cgi TF_submask field.


ZendTo prior to 5.22-2 Beta allowed reflected XSS and CSRF via the unlock.tpl unlock user functionality.


An improper HTML sanitization in Dart versions up to and including 2.7.1 and dev versions 2.8.0-dev.16.0 allows an attacker leveraging DOM Clobbering techniques to skip the sanitization and inject custom html/javascript (XSS). Mitigation: update your Dart SDK to 2.7.2 and 2.8.0-dev.17.0 for the dev version. If you cannot update we recommend you review the way you use the affected APIs and pay special attention to cases where user-provided data is used to populate DOM nodes. Consider using Element.innerText or Node.text to populate DOM elements.


The Username field in the Storage Service settings of A1 WLAN Box ADB VV2220v2 devices allows stored XSS (after a successful Administrator login).


index.php?p=/dashboard/settings/branding

in

Vanilla

allows

stored

XSS.


A missing link validation in Nextcloud Server before 20.0.2 19.0.5 18.0.11 allows execution of a stored XSS attack using Internet Explorer when saving a 'javascript:' URL in markdown format.


Western Digital mycloud.com before Web Version 2.2.0-134 allows XSS.


Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.


Fiserv Accurate Reconciliation 2.19.0 fixed in 3.0.0 or higher allows XSS via the Source or Destination field of the Configuration Manager (Configuration Parameter Translation) page.


A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions however under specific circumstances it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context allowing an attacker to execute arbitrary JS code on the browser of the victim.


In actionpack gem >= 6.0.0 a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.


A link preview rendering issue in Rocket.Chat versions before 3.9 could lead to potential XSS attacks.


Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via a user profile photo as demonstrated by a SCRIPT element in an SVG document.


An XSS Vulnerability exists in Webmin 1.941 and earlier affecting the Cluster Shell Commands Endpoint. A user may enter any XSS Payload into the Command field and execute it. Then after revisiting the Cluster Shell Commands Menu the XSS Payload will be rendered and executed.


The Elementor plugin before 2.8.5 for WordPress suffers from a reflected XSS vulnerability on the elementor-system-info page. These can be exploited by targeting an authenticated user.


XSS exists in the shortcode functionality of the GistPress plugin before 3.0.2 for WordPress via the includes/class-gistpress.php id parameter. This allows an attacker with the WordPress Contributor role to execute arbitrary JavaScript code with the privileges of other users (e.g. ones who have the publish_posts capability).


Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field.


Hitron CODA-4582U 7.1.1.30 devices allow XSS via a Managed Device name on the Wireless > Access Control > Add Managed Device screen.


We have recently released new version of AirMax AirOS firmware v6.3.0 for TI XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI XW and XM boards according to the description below:Multiple end-points with parameters vulnerable to reflected cross site scripting (XSS) allowing attackers to abuse the user' session information and/or account takeover of the admin user.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.


In Kronos Web Time and Attendance (webTA) 4.1.x and later 4.x versions before 5.0 there is a Stored XSS vulnerability by setting the Application Banner input field of the /ApplicationBanner page as an authenticated administrator.


Fiserv Accurate Reconciliation 2.19.0 fixed in 3.0.0 or higher allows XSS via the logout.jsp timeOut parameter.


The installations for ABB System 800xA Information Manager versions 5.1 6.0 to 6.0.3.2 and 6.1 wrongly contain an auxiliary component. An attacker is able to use this for an XSS-like attack to an authenticated local user which might lead to execution of arbitrary code.


Digi

TransPort

and

devices

allow

stored

XSS

in

the

web

application.


Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report.


Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via an uploaded document when the attacker has write access to a project.


In IceWarp Webmail Server through 11.4.4.1 there is XSS in the /webmail/ color parameter.


htmlfile in lib/transport/htmlfile.js in SockJS before 0.3.0 is vulnerable to Reflected XSS via the /htmlfile c (aka callback) parameter.


Composr 10.0.30 allows Persistent XSS via a Usergroup name under the Security configuration.


An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.


There is an Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in php webpages of Tiki-Wiki Groupware. Tiki-Wiki CMS all versions through 20.0 allows malicious users to cause the injection of malicious code fragments (scripts) into a legitimate web page.


A

Improper

Neutralization

of

Input

During

Web

Page

Generation

vulnerability

in

open-build-service

allows

remote

attackers

to

store

arbitrary

JS

code

to

cause

XSS.

This

issue

affects:

openSUSE

open-build-service

versions

prior

to


A stored XSS vulnerability in Kronos Web Time and Attendance (webTA) affects 3.8.x and later 3.x versions before 4.0 via multiple input fields (Login Message Banner Message and Password Instructions) of the com.threeis.webta.H261configMenu servlet via an authenticated administrator.


In Boostnote 0.12.1 exporting to PDF contains opportunities for XSS attacks.


DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for '$_POST'pageparam_insert_name'' variable in dbhcms\\mod\\mod.page.edit.php line 227 A remote authenticated with admin user can exploit this vulnerability to hijack other users.


Reflected XSS in Medintux v2.16.000 CCAM.php by manipulating the mot1 parameter can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page.


Cross

Site

Scripting

(XSS)

in

MyBB

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

\Title\

field

found

in

the

\Add

New

Forum\

page

by

doing

an

authenticated

POST

HTTP

request

to

'/Upload/admin/index.php?module=forum-management&action=add'.


DBHcms v1.2.0 has a stored XSS vulnerability as there is no htmlspecialchars function for '$_POST'pageparam_insert_description'' variable in dbhcms\\mod\\mod.page.edit.php line 227 A remote authenticated with admin user can exploit this vulnerability to hijack other users.


Automated Logic Corporation (ALC) WebCTRL System 6.5 and prior allows remote attackers to execute any JavaScript code via a XSS payload for the first parameter in a GET request.


Reflected XSS in Vtiger CRM v7.2.0 in vtigercrm/index.php? through the view parameter can result in an attacker performing malicious actions to users who open a maliciously crafted link or third-party web page.


qdPM

is

vulnerable

to

Cross

Site

Scripting

(XSS)

via


Cross

Site

Scripting

(XSS)

in

MyBB

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

\Description\

field

found

in

the

\Add

New

Forum\

page

by

doing

an

authenticated

POST

HTTP

request

to


DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for 'menu_description' variable in dbhcms\\mod\\mod.menus.edit.php line 83 and in dbhcms\\mod\\mod.menus.view.php line 111 A remote authenticated with admin user can exploit this vulnerability to hijack other users.


Cross Site Scripting (XSS) vulnerabilty exists in Hucart CMS 5.7.4 is via the mes_title field. The first user inserts a malicious script into the header field of the outbox and sends it to other users. When other users open the email the malicious code will be executed.


Cross Site Scriptiong (XSS) vulnerability in GetSimpleCMS <=3.3.15 via the timezone parameter to settings.php.


Cross Siste Scripting (XSS) vulnerablity in Halo 0.4.3 via the X-forwarded-for Header parameter.


Cross Sie Scripting (XSS) vulnerability in Halo 0.4.3 via CommentAuthorUrl.


The WPJobBoard plugin 5.5.3 for WordPress allows Persistent XSS via the Add Job form as demonstrated by title and Description.


Subversion ALM for the enterprise before 8.8.2 allows reflected XSS at multiple locations.


Zulip Desktop before 4.0.3 loaded untrusted content in an Electron webview with web security disabled which can be exploited for XSS in a number of ways. This especially affects Zulip Desktop 2.3.82.


SquaredUp allowed Stored XSS before version 4.6.0. A user was able to create a dashboard that executed malicious content in iframe or by uploading an SVG that contained a script.


Graph Builder in SAS Visual Analytics 8.5 allows XSS via a graph template that is accessed directly.


Joplin through 1.0.184 allows Arbitrary File Read via XSS.


fauzantrif eLection 2.0 has XSS via the Admin Dashboard -> Settings -> Election -> \message if election is closed\ field.


IBL Online Weather before 4.3.5a allows unauthenticated reflected XSS via the redirect page.


An issue was discovered in chat.php in LiveZilla Live Chat 8.0.1.3 (Helpdesk). A blind JavaScript injection lies in the name parameter. Triggering this can fetch the username and passwords of the helpdesk employees in the URI. This leads to a privilege escalation from unauthenticated to user-level access leading to full account takeover. The attack fetches multiple credentials because they are stored in the database (stored XSS). This affects the mobile/chat URI via the lgn and psswrd parameters.


Iteris Vantage Velocity Field Unit 2.4.2 devices have multiple stored XSS issues in all parameters of the Start Data Viewer feature of the /cgi-bin/loaddata.py script.


An issue was discovered in the pricing-table-by-supsystic plugin before 1.8.2 for WordPress. It allows XSS.


Multiple stored XSS vulnerabilities exist in the 10Web Photo Gallery plugin before 1.5.46 WordPress. Successful exploitation of this vulnerability would allow a authenticated admin user to inject arbitrary JavaScript code that is viewed by other users.


Octech Oempro 4.7 through 4.11 allow stored XSS by an authenticated user. The FolderName parameter of the Media.CreateFolder command is vulnerable.


OX Guard 2.10.3 and earlier allows XSS.


There were XSS vulnerabilities discovered and reported in the Dispatch application affecting name and description parameters of Incident Priority Incident Type Tag Type and Incident Filter. This vulnerability can be exploited by an authenticated user.


Cross Site scripting vulnerability on Micro Focus Enterprise Server and Enterprise developer affecting all versions prior to version 5.0 Patch Update 8. The vulnerability could allow an attacker to trigger administrative actions when an administrator viewed malicious data left by the attacker (stored XSS) or followed a malicious link (reflected XSS).


In SilverStripe through 4.5 malicious users with a valid Silverstripe CMS login (usually CMS access) can craft profile information which can lead to XSS for other users through specially crafted login form URLs.


Jeedom through 4.0.38 allows XSS.


Zulip Server before 2.1.3 allows XSS via the modal_link feature in the Markdown functionality.


Codoforum 4.8.8 allows self-XSS via the title of a new topic.


A stored XSS vulnerability exists in the Modula Image Gallery plugin before 2.2.5 for WordPress. Successful exploitation of this vulnerability would allow an authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.


SecureAuth.aspx in SecureAuth IdP 9.3.0 suffers from a client-side template injection that allows for script execution in the same manner as XSS.


A stored XSS vulnerability exists in the Envira Photo Gallery plugin through 1.7.6 for WordPress. Successful exploitation of this vulnerability would allow a authenticated low-privileged user to inject arbitrary JavaScript code that is viewed by other users.


Octech Oempro 4.7 through 4.11 allow XSS by an authenticated user. The parameter CampaignName in Campaign.Create is vulnerable.


An issue was discovered on Xirrus XR520 XR620 XR2436 and XH2-120 devices. The cgi-bin/ViewPage.cgi user parameter allows XSS.


in

in

GDPR

Cookie

Consent

(cookie-law-info)

and

below

plugin

for

WordPress

allows

authenticated

stored

XSS

and

privilege

escalation.


There is a XSS in the user login page in zzcms 2019. Users can inject js code by the referer header via user/login.php


lara-google-analytics.php in Lara Google Analytics plugin through 2.0.4 for WordPress allows authenticated stored XSS.


controller/controller-comments.php in WP GDPR plugin through 2.1.1 has unauthenticated stored XSS.


Pega Platform before 8.4.0 has a XSS issue via stream rule parameters used in the request header.


Zulip Desktop before 5.4.3 allows XSS because string escaping is mishandled during composition of the HTML for the user interface.


osTicket before 1.14.3 allows XSS via a crafted filename to DraftAjaxAPI::_uploadInlineImage() in include/ajax.draft.php.


Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the \t\ GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.


XSS on the PIX-Link Repeater/Router LV-WR07 with firmware v28K.Router.20170904 allows attackers to steal credentials without being connected to the network. The attack vector is a crafted ESSID as demonstrated by the wireless.htm SET2 parameter.


An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager 2.2.0 API Manager Analytics 2.2.0 API Microgateway 2.2.0 Data Analytics Server 3.2.0 Enterprise Integrator through 6.6.0 IS as Key Manager 5.5.0 Identity Server 5.5.0 and 5.8.0 Identity Server Analytics 5.5.0 and IoT Server 3.3.0 and 3.3.1.


A remote stored xss vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.


Go before 1.14.8 and 1.15.x before 1.15.1 allows XSS because text/html is the default for CGI/FCGI handlers that lack a Content-Type header.


Users of the HAPI FHIR Testpage Overlay 5.0.0 and below can use a specially crafted URL to exploit an XSS vulnerability in this module allowing arbitrary JavaScript to be executed in the user's browser. The impact of this vulnerability is believed to be low as this module is intended for testing and not believed to be widely used for any production purposes.


The Table Filter and Charts for Confluence Server app before 5.3.25 (for Atlassian Confluence) allow remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) through the provided Markdown markup to the \Table from CSV\ macro.


Trace Financial Crest Bridge <6.3.0.02 contains a stored XSS vulnerability which was fixed in 6.3.0.03.


The Chamber Dashboard Business Directory plugin 3.2.8 for WordPress allows XSS.


An issue was discovered in Joomla! before 3.9.21. Lack of escaping in mod_latestactions allows XSS attacks.


A Reflected XSS vulnerability was discovered in Ignite Realtime Openfire version 4.5.1. The XSS vulnerability allows remote attackers to inject arbitrary web script or HTML via the GET request \searchName\ \searchValue\ \searchDescription\ \searchDefaultValue\ \searchPlugin\ \searchDescription\ and \searchDynamic\ in server-properties.jsp and security-audit-viewer.jsp


Etoile Web Design Ultimate Appointment Booking & Scheduling WordPress Plugin v1.1.9 and lower does not sanitize the value of the \Appointment_ID\ GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.


Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by a persistent XSS vulnerability that allows users to upload malicious JavaScript via the file upload component. This vulnerability could be abused by an unauthenticated attacker to execute XSS attacks against other Magento users. This vulnerability requires a victim to browse to the uploaded file.


SmartStream Transaction Lifecycle Management (TLM) Reconciliation Premium (RP) <3.1.0 allows XSS. This was fixed in TLM RP 3.1.0.


An issue was discovered in certain WSO2 products. The Try It tool allows Reflected XSS. This affects API Manager through 3.1.0 API Manager Analytics 2.5.0 IS as Key Manager through 5.10.0 Identity Server through 5.10.0 Identity Server Analytics through 5.6.0 and IoT Server 3.1.0.


eonweb in EyesOfNetwork before 5.3-7 does not properly escape the username on the /module/admin_logs page which might allow pre-authentication stored XSS during login/logout logs recording.


Grafana before 7.1.0-beta 1 allows XSS via a query alias for the ElasticSearch datasource.


CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user can get cookies from every authenticated user who visits the website.


There is a cross site scripting vulnerability on CmsWing 1.3.7. This vulnerability (stored XSS) is triggered when visitors access the article module.


An Authenticated Persistent XSS vulnerability was discovered in the Best Support System tested version v3.0.4.


TechKshetra Info Solutions Pvt. Ltd Savsoft Quiz 5.5 and earlier has XSS which can result in an attacker injecting the XSS payload in the User Registration section and each time the admin visits the manage user section from the admin panel the XSS triggers and the attacker can steal the cookie via crafted payload.


There is a cross site scripting vulnerability on CmsWing 1.3.7. This vulnerability (stored XSS) is triggered when an administrator accesses the content management module.


WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the \role\ GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL.


Trace Financial CRESTBridge <6.3.0.02 contains a stored XSS vulnerability which was fixed in 6.3.0.03.


An issue was discovered in the gon gem before gon-6.4.0 for Ruby. MultiJson does not honor the escape_mode parameter to escape fields as an XSS protection mechanism. To mitigate json_dumper.rb in gon now does escaping for XSS by default without relying on MultiJson.


The moodlenetprofile user profile field required extra sanitizing to prevent a stored XSS risk. This affects versions 3.9 to 3.9.1. Fixed in 3.9.2.


** DISPUTED ** Nifty Project Management Web Application 2020-08-26 allows XSS via Add Task that is rendered upon a Project Home visit. Note: It has been argued that this is not reproducible. \The original issue was that the task would be created and an alert would be shown on the screen. Now the task would be created but the alert won't be executed as those attributes are now stripped.\


SimplePHPscripts News Script PHP Pro 2.3 is affected by a Cross Site Scripting (XSS) vulnerability via the editor_name parameter.


The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper input validation aka XSS.


ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php.


webTareas

through

allows

XSS

in

clients/editclient.php

extensions/addextension.php

administration/departments.php

administration/locations.php

projects/editproject.php

and

general/newnotifications.php.


PHPGurukul

hospital-management-system-in-php

allows

XSS

via

admin/patient-search.php

doctor/search.php

book-appointment.php

doctor/appointment-history.php

or

admin/appointment-history.php.


In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4 XSS related to jQuery can occur. The attacker creates a message with javascript:payload xss and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> tag (or it does not have a href attribute or it's empty etc.). The actual result is that the object contains an <a href =\javascript... that executes when clicked.


The Blubrry subscribe-sidebar (aka Subscribe Sidebar) plugin 1.3.1 for WordPress allows subscribe_sidebar.php&status= reflected XSS.


eramba c2.8.1 and Enterprise before e2.19.3 allows XSS via a crafted filename for a file attached to an object. For example the filename has a complete XSS payload followed by the .png extension.


PHPGurukul hostel-management-system 2.1 allows XSS via Guardian Name Guardian Relation Guardian Contact no Address or City.


A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags leading to a cross-site-scripting (XSS) vulnerability.


** UNSUPPORTED WHEN ASSIGNED ** webinc/js/info.php on D-Link DIR-816L 2.06.B09_BETA and DIR-803 1.04.B02 devices allows XSS via the HTTP Referer header. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: this is typically not exploitable because of URL encoding (except in Internet Explorer) and because a web page cannot specify that a client should make an additional HTTP request with an arbitrary Referer header.


Stored XSS in InterMind iMind Server through 3.13.65 allows any user to hijack another user's session by sending a malicious file in the chat.


Projectworlds Visitor Management System in PHP 1.0 allows XSS. The file myform.php does not perform input validation on the request parameters. An attacker can inject javascript payloads in the parameters to perform various attacks such as stealing of cookies sensitive information etc.


The filter in the tag manager required extra sanitizing to prevent a reflected XSS risk. This affects 3.9 to 3.9.1 3.8 to 3.8.4 3.7 to 3.7.7 3.5 to 3.5.13 and earlier unsupported versions. Fixed in 3.9.2 3.8.5 3.7.8 and 3.5.14.


SilverStripe through 4.6.0-rc1 has an XXE Vulnerability in CSSContentParser. A developer utility meant for parsing HTML within unit tests can be vulnerable to XML External Entity (XXE) attacks. When this developer utility is misused for purposes involving external or user submitted data in custom project code it can lead to vulnerabilities such as XSS on HTML output rendered through this custom code. This is now mitigated by disabling external entities during parsing. (The correct CVE ID year is 2020 CVE-2020-25817 not CVE-2021-25817).


In SourceCodester Online Bus Booking System 1.0 there is XSS through the name parameter in book_now.php.


Reflected Cross Site scripting vulnerability on Micro Focus Filr product affecting version 4.2.1. The vulnerability could be exploited to perform Reflected XSS attack.


The web application of Kyocera printer (ECOSYS M2640IDW) is affected by Stored XSS vulnerability discovered in the addition a new contact in \Machine Address Book\. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions


Wordpress Plugin Store / AccessPress Themes WP Floating Menu V1.3.0 is affected by: Cross Site Scripting (XSS) via the id GET parameter.


The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due to improper input validation aka XSS. Successful exploitation could allow an attacker to view user conference information.


The web console for Mimosa B5 B5c and C5x firmware through 2.8.0.2 is vulnerable to stored XSS in the set_banner() function of /var/www/core/controller/index.php. An unauthenticated attacker may set the contents of the /mnt/jffs2/banner.txt file stored on the device's filesystem to contain arbitrary JavaScript. The file contents are then used as part of a welcome/banner message presented to unauthenticated users who visit the login page for the web console. This vulnerability does not occur in the older 1.5.x firmware versions.


An XSS issue exists in the question-pool file-upload preview feature in ILIAS 6.4.


An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.


Wordpress Plugin Store / Mike Rooijackers Recall Products V0.8 is affected by: Cross Site Scripting (XSS) via the 'Recall Settings' field in admin.php. An attacker can inject JavaScript code that will be stored and executed.


The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement as demonstrated by CosmosSocialProfile::getUserGroups.


The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS) related to loginizer_login_failed and lz_valid_ip.


In BigBlueButton before 2.2.28 (or earlier) uploaded presentations are sent to clients without a Content-Type header which allows XSS as demonstrated by a .png file extension for an HTML document.


The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certain varieties of games were created within MediaWiki their names or titles could be manipulated to generate stored XSS within the RandomGameUnit extension.


The cm-download-manager plugin before 2.8.0 for WordPress allows XSS.


Strapi before 3.2.5 has stored XSS in the wysiwyg editor's preview feature.


Nagios XI before 5.7.5 is vulnerable to XSS in Dashboard Tools (Edit Dashboard).


Nagios XI before 5.7.5 is vulnerable to XSS in Account Information (Email field).


The debug-meta-data plugin 1.1.2 for WordPress allows XSS.


A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.


The Relish (Verve Connect) VH510 device with firmware before 1.0.1.6L0516 allows XSS via URLBlocking Settings SNMP Settings and System Log Settings.


NeoPost Mail Accounting Software Pro 5.0.6 allows php/Commun/FUS_SCM_BlockStart.php?code= XSS.


phpRedisAdmin before 1.13.2 allows XSS via the login.php username parameter.


Genexis Platinum-4410 P4410-V2-1.28 devices allow stored XSS in the WLAN SSID parameter. This could allow an attacker to perform malicious actions in which the XSS popup will affect all privileged users.


Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).


Nagios XI before 5.7.5 is vulnerable to XSS in the Deployment tool (add agent).


cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566).


XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML an attacker can elicit an XSS attack via jQuery's parseHTML method which can cause image callbacks to fire even without the element being appended to the DOM.


A parsing and event loading mismatch in Firefox's SVG code could have allowed load events to fire even after sanitization. An attacker already capable of exploiting an XSS vulnerability in privileged internal pages could have used this attack to bypass our built-in sanitizer. This vulnerability affects Firefox < 83 Firefox ESR < 78.5 and Thunderbird < 78.5.


cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574).


Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

and

before


Xerox WorkCentre EC7836 before 073.050.059.25300 and EC7856 before 073.020.059.25300 devices allow XSS via Description pages.


Project Worlds Online Examination System 1.0 is affected by Cross Site Scripting (XSS) via account.php.


Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.


The file upload functionality in qdPM 9.1 doesn't check the file description which allows remote authenticated attackers to inject web script or HTML via the attachments info parameter aka XSS. This can occur during creation of a ticket project or task.


cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564).


ObjectPlanet

Opinio

before

allows

reflected

XSS

via

the

survey/admin/surveyAdmin.do?action=viewSurveyAdmin

query

string.

(There

is

also

stored

XSS

if

input

to

survey/admin/*.do

is

accepted

from

untrusted

users.)


cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573).


An issue was discovered in Zammad before 3.4.1. There is Stored XSS via a Tags element in a TIcket.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


Scratch Addons is a WebExtension that supports both Chrome and Firefox. Scratch Addons before version 1.3.2 is vulnerable to DOM-based XSS. If the victim visited a specific website the More Links addon of the Scratch Addons extension used incorrect regular expression which caused the HTML-escaped values to be unescaped leading to XSS. Scratch Addons version 1.3.2 fixes the bug. The extension will be automatically updated by the browser. More Links addon can be disabled via the option of the extension.


An issue was discovered in Sage DPW 2020_06_x before 2020_06_002. The search field \Kurs suchen\ on the page Kurskatalog is vulnerable to Reflected XSS. If the attacker can lure a user into clicking a crafted link he can execute arbitrary JavaScript code in the user's browser. The vulnerability can be used to change the contents of the displayed site redirect to other sites or steal user credentials. Additionally users are potential victims of browser exploits and JavaScript malware.


In some cases removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83 Firefox ESR < 78.5 and Thunderbird < 78.5.


REDCap 10.3.4 contains a XSS vulnerability in the ToDoList function with parameter sort. The information submitted by the user is immediately returned in the response and not escaped leading to the reflected XSS vulnerability. Attackers can exploit vulnerabilities to steal login session information or borrow user rights to perform unauthorized acts.


phpMyAdmin before 4.9.6 and 5.x before 5.0.3 allows XSS through the transformation feature via a crafted link.


REDDOXX MailDepot 2033 (aka 2.3.3022) allows XSS via an incoming HTML e-mail message.


An issue was discovered in Hoosk CMS v1.8.0. There is a XSS vulnerability in install/index.php


HtmlSanitizer is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. In HtmlSanitizer before version 5.0.372 there is a possible XSS bypass if style tag is allowed. If you have explicitly allowed the `<style>` tag an attacker could craft HTML that includes script after passing through the sanitizer. The default settings disallow the `<style>` tag so there is no risk if you have not explicitly allowed the `<style>` tag. The problem has been fixed in version 5.0.372.


AuthRestServlet

in

Matrix

Synapse

before

is

vulnerable

to

XSS

due

to

unsafe

interpolation

of

the

session

GET

parameter.

This

allows

a

remote

attacker

to

execute

an

XSS

attack

on

the

domain

Synapse

is

hosted

on

by

supplying

the

victim

user

with

a

malicious

URL

to

the

or

/_matrix/client/unstable/auth/*/fallback/web

Synapse

endpoints.


cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569).


FUEL CMS 1.4.11 has stored XSS in Blocks/Navigation/Site variables. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account and also impact other visitors.


Sal is a multi-tenanted reporting dashboard for Munki with the ability to display information from Facter. In Sal through version 4.1.6 there is an XSS vulnerability on the machine_list view.


Vega is a visualization grammar a declarative format for creating saving and sharing interactive visualization designs. Vega in an npm package. In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression an attacker could execute arbitrary javascript on a victim's machine. This is fixed in version 5.17.3


touchbase.ai before version 2.0 is vulnerable to Open Redirect. Impacts can be many and vary from theft of information and credentials to the redirection to malicious websites containing attacker-controlled content which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first the impacts of it can be severe should it be exploitable. The issue is fixed in version 2.0.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting (XSS) in /wp-admin/post.php. If a user intercepts a request and inserts a payload in \cite\ parameter the payload will be stored in the database.


Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree and a namespace can change from HTML to MathML as demonstrated by nesting of FORM elements.


Froala Editor before 3.2.2 allows XSS via pasted content.


** UNSUPPORTED WHEN ASSIGNED ** Leostream Connection Broker 8.2.x is affected by stored XSS. An unauthenticated attacker can inject arbitrary JavaScript code via the webquery.pl User-Agent HTTP header. It is rendered by the admins the next time they log in. The JavaScript injected can be used to force the admin to upload a malicious Perl script that will be executed as root via libMisc::browser_client. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


An issue was discovered in 2sic 2sxc before 11.22. A XSS vulnerability in the sxcver parameter of dnn/ui.html allows an attacker to craft a malicious URL that executes a JavaScript payload in a victim's browser.


SAP Enterprise Threat Detection versions 1.0 2.0 does not sufficiently encode error response pages in case of errors allowing XSS payload reflecting in the response leading to reflected Cross Site Scripting.


An issue was discovered on Cayin SMP-PRO4 devices. They allow image_preview.html?filename= reflected XSS.


BigProf Online Invoicing System (OIS) through 2.6 has XSS that can be leveraged for session hijacking. An attacker can exploit the XSS vulnerability retrieve the session cookie from the administrator login and take over the administrator account via the Name field in an Add New Client action.


The

server

management

software

module

of

ZTE

has

a

storage

XSS

vulnerability.

The

attacker

inserts

some

attack

codes

through

the

foreground

login

page

which

will

cause

the

user

to

execute

the

predefined

malicious

script

in

the

browser.

This

affects


The

WikibaseMediaInfo

extension

for

MediaWiki

allows

XSS

because

of

improper

template

syntax

within

the

PropertySuggestionsWidget

template

(in

the

templates/search/PropertySuggestionsWidget.mustache+dom

file).


The Login by Auth0 plugin before 4.0.0 for WordPress allows stored XSS on multiple pages a different issue than CVE-2020-5392.


OpenTrade through 0.2.0 has a DOM-based XSS vulnerability that is executed when an administrator attempts to delete a message that contains JavaScript.


A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEB module. By inserting malicious scripts into the web module a remote attacker could trigger an XSS attack when the user browses the web page. Then the attacker could use the vulnerability to steal user cookies or destroy the page structure. This affects: eVDC ZXCLOUD-iROSV6.03.04


Nagios Log Server 2.1.3 allows XSS by visiting /profile and entering a crafted name field that is mishandled on the /admin/users page. Any malicious user with limited access can store an XSS payload in his Name. When any admin views this the XSS is triggered.


In PrestaShop 1.7.6.2 XSS can occur during addition or removal of a QuickAccess link. This is related to AdminQuickAccessesController.php themes/default/template/header.tpl and themes/new-theme/js/header.js.


A vulnerability in the web-based management interface of Bosch PRAESIDEO until and including version 4.41 and Bosch PRAESENSA until and including version 1.10 allows an authenticated remote attacker with admin privileges to mount a stored Cross-Site-Scripting (XSS) attack against another user. When the victim logs into the management interface the stored script code is executed in the context of his browser. A successful exploit would allow an attacker to interact with the management interface with the privileges of the victim. However as the attacker already needs admin privileges there is no additional impact on the management interface itself.


SAP NetWeaver Enterprise Portal (Fiori Framework Page) versions - 7.50 7.31 7.40 does not sufficiently encode user-controlled inputs and allows an attacker on a valid session to create an XSS that will be both reflected immediately and also be persisted and returned in further access to the system resulting in Cross Site Scripting.


Utilities.php in the miniorange-saml-20-single-sign-on plugin before 4.8.84 for WordPress allows XSS via a crafted SAML XML Response to wp-login.php. This is related to the SAMLResponse and RelayState variables and the Destination parameter of the samlp:Response XML element.


PCS DEXICON 3.4.1 allows XSS via the loginName parameter in login_action.jsp.


Axper Vision II 4 devices allow XSS via the DEVICE_NAME (aka Device Name) parameter to the configWebParams.cgi URI.