In pfSense 2.4.4-p2 and 2.4.4-p3 if it is possible to trick an authenticated administrator into clicking on a button on a phishing page an attacker can leverage XSS to upload arbitrary executable code via diag_command.php and rrd_fetch_json.php (timePeriod parameter) to a server. Then the remote attacker can run any command with root privileges on that server.


Web Port 1.19.1 allows XSS via the /access/setup type parameter.


out/out.GroupMgr.php in SeedDMS 5.1.11 has Stored XSS by making a new group with a JavaScript payload as the \GROUP\ Name.


SolarWinds Network Performance Monitor (Orion Platform 2018 NPM 12.3 NetPath 1.1.3) allows XSS by authenticated users via a crafted onerror attribute of a VIDEO element in an action for an ALERT.


On Apache JSPWiki up to version 2.11.0.M4 a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki related to the remember parameter on some of the JSPs which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.


An issue was discovered in TeamPass 2.1.27.35. From the sources/items.queries.php \Import items\ feature it is possible to load a crafted CSV file with an XSS payload.


An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via SoftwareListView.do with the parameter swType or swComplianceType.


The Nine application through 4.5.3a for Android allows XSS via an event attribute and arbitrary file loading via a src attribute if the application has the READ_EXTERNAL_STORAGE permission.


Web Port 1.19.1 allows XSS via the /log type parameter.


An issue was discovered in the Teclib News plugin through 1.5.2 for GLPI. It allows a stored XSS attack via the $_POST'name' parameter.


An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do userConfigID parameter.


An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SiteLookup.do search field.


A reflected XSS on a user page was detected on one of the JetBrains TeamCity pages. The issue was fixed in TeamCity 2018.2.2.


An issue was discovered in GitLab Community and Enterprise Edition 8.9 through 11.11. Wiki Pages contained a lack of input validation which resulted in a persistent XSS vulnerability.


Horde Trean as used in Horde Groupware Webmail Edition through 5.2.22 and other products allows CSRF as demonstrated by the treanBookmarkTags parameter to the trean/ URI on a webmail server. NOTE: treanBookmarkTags could for example be a stored XSS payload.


Sandline Centraleyezer (On Premises) allows Stored XSS using HTML entities in the name field of the Category section.


Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account and perform XSS on users loading that script. Fixed in 1.32.2 1.31.2 1.30.2 and 1.27.6.


Gridea v0.8.0 has an XSS vulnerability through which the Nodejs module can be called to achieve arbitrary code execution as demonstrated by child_process.exec and the \<img src=# onerror='eval(new Buffer(\ substring.


An

issue

was

discovered

in

the

wp-code-highlightjs

plugin

through

for

WordPress.

wp-admin/options-general.php?page=wp-code-highlight-js

allows

CSRF

as

demonstrated

by

an

XSS

payload

in

the

parameter.


In remarkable 1.7.1 lib/parser_inline.js mishandles URL filtering which allows attackers to trigger XSS via unprintable characters as demonstrated by a \\x0ejavascript: URL.


An issue was discovered in Zoho ManageEngine ServiceDesk Plus 10.5. There is XSS via the WorkOrder.do search field.


In Apache POI up to 4.1.0 when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.


The Edison Mail application through 1.7.1 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute if the application has the READ_EXTERNAL_STORAGE permission.


In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24 by sending a DHCP discover request containing a malicious hostname field an attacker may execute stored XSS attacks against this device. When the malicious DHCP request is received the device will generate a log entry containing the malicious hostname. This log entry may then be viewed at Advanced settings->Administration->Logs to trigger the exploit. Although this value is inserted into a textarea tag converted to all-caps and limited in length attacks are still possible.


An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SearchN.do search field.


The Chartkick gem through 3.1.0 for Ruby allows XSS.


The Spark application through 2.0.2 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute if the application has the READ_EXTERNAL_STORAGE permission.


through

and

through

allows

XSS.


TP-Link TL-WR840N v5 00000005 devices allow XSS via the network name. The attacker must log into the router by breaking the password and going to the admin login page by THC-HYDRA to get the network name. With an XSS payload the network name changed automatically and the internet connection was disconnected. All the users become disconnected from the internet.


An issue was discovered in GitLab Enterprise Edition 11.7 through 11.11. The epic details page contained a lack of input validation and output encoding issue which resulted in a persistent XSS vulnerability on child epics.


An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The save_quiz_score functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers which are stored in the database and later shown in the WordPress backend for all users with at least Subscriber rights. Because the plugin does not properly validate and sanitize this data a malicious payload in either the name or email field is executed directly within the backend at /wp-admin/admin.php?page=slickquiz across all users with the privileges of at least Subscriber.


XSS exists in Shave before 2.5.3 because output encoding is mishandled during the overwrite of an HTML element.


An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the SolutionSearch.do searchText parameter.


Craft CMS before 3.1.31 does not properly filter XML feeds and thus allowing XSS.


The TypeApp application through 1.9.5.35 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute if the application has the READ_EXTERNAL_STORAGE permission.


In NETGEAR Nighthawk X10-R900 prior to 1.0.4.24 an attacker may execute stored XSS attacks against this device by supplying a malicious X-Forwarded-For header while performing an incorrect login attempt. The value supplied by this header will be inserted into administrative logs found at Advanced settings->Administration->Logs and may trigger when the page is viewed. Although this value is inserted into a textarea tag the attack simply needs to supply a closing textarea tag.


There is XSS in BoostIO Boostnote 0.11.15 via a label named mermaid as demonstrated by a crafted SRC attribute of an IFRAME element.


XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low but affected systems are recommended to upgrade immediately.)


On Apache JSPWiki up to version 2.11.0.M4 a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki related to InfoContent.jsp which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.


Shopware before 5.5.8 has XSS via the Query String to the backend/Login or backend/Login/load/ URI.


SilverStripe through 4.3.3 has Flash Clipboard Reflected XSS.


There is XSS in browser/components/MarkdownPreview.js in BoostIO Boostnote 0.11.15 via a label named flowchart sequence gallery or chart as demonstrated by a crafted SRC attribute of an IFRAME element a different vulnerability than CVE-2019-12136.


A number of stored XSS vulnerabilities have been identified in the web configuration feature in ENTTEC Datagate Mk2 70044_update_05032019-482 that could allow an unauthenticated threat actor to inject malicious code directly into the application. This affects for example the Profile Description field in JSON data to the Profile Editor.


An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the SearchN.do search field.


In MicroStrategy Web before 10.1 patch 10 stored XSS is possible in the FLTB parameter due to missing input validation.


An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via the RCSettings.do rdsName parameter.


The Newton application through 10.0.23 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute if the application has the READ_EXTERNAL_STORAGE permission.


On Apache JSPWiki up to version 2.11.0.M4 a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki related to the plain editor which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.


CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager \Name\ field which is reachable via a \Create a new Template\ action to the Design Manager.


In Jenkins 2.196 and earlier LTS 2.176.3 and earlier the f:combobox form control interpreted its item labels as HTML resulting in a stored XSS vulnerability exploitable by users with permission to define its contents.


CentOS Web Panel (CWP) 0.9.8.789 is vulnerable to Stored/Persistent XSS for the \Name Server 1\ and \Name Server 2\ fields via a \DNS Functions\ \Edit Nameservers IPs\ action.


CMS Made Simple 2.2.10 has XSS via the moduleinterface.php Name field which is reachable via an \Add a new Profile\ action to the File Picker.


CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.793 (Free/Open Source Version) and 0.9.8.753 (Pro) is vulnerable to Stored/Persistent XSS for Admin Email fields on the \CWP Settings > \Edit Settings\ screen. By changing the email ID to any XSS Payload and clicking on Save Changes the XSS Payload will execute.


An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8 11.8.x before 11.8.4 and 11.9.x before 11.9.2. It allows persistent XSS in the merge request \resolve conflicts\ page.


There is Stored XSS in Verodin Director 3.5.3.0 and earlier via input fields of certain tooltips and on the Tags Sequences and Actors pages.


Total.js

CMS

has

XSS

related

to

(item.message)

and

(column.format).


GForge Advanced Server 6.4.4 allows XSS via the commonsearch.php words parameter as demonstrated by a snippet/search/?words= substring.


PHPCMS 9.6.x through 9.6.3 has XSS via the mailbox (aka E-mail) field on the personal information screen.


In Apache Allura prior to 1.11.0 a vulnerability exists for stored XSS on the user dropdown selector when creating or editing tickets. The XSS executes when a user engages with that dropdown on that page.


In Symfony before 2.7.51 2.8.x before 2.8.50 3.x before 3.4.26 4.x before 4.1.12 and 4.2.x before 4.2.7 HTTP Methods provided as verbs or using the override header may be treated as trusted input but they are not validated possibly causing SQL injection or XSS. This is related to symfony/http-foundation.


A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3 which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin but further analysis showed that multiple plugins were vulnerable.


On Apache JSPWiki up to version 2.11.0.M4 a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki related to the WYSIWYG editor which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.


In Eclipse Jetty version 9.2.26 and older 9.3.25 and older and 9.4.15 and older the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.


openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-found component.


Snipe-IT before 4.6.14 has XSS as demonstrated by log_meta values and the user's last name in the API.


In Jenkins 2.196 and earlier LTS 2.176.3 and earlier the f:expandableTextBox form control interpreted its content as HTML when expanded resulting in a stored XSS vulnerability exploitable by users with permission to define its contents (typically Job/Configure).


Wolf CMS v0.8.3.1 is affected by cross site scripting (XSS) in the module Add Snippet (/?/admin/snippet/add). This allows an attacker to insert arbitrary JavaScript as user input which will be executed whenever the affected snippet is loaded.


On Apache JSPWiki up to version 2.11.0.M4 a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki related to the Page Revision History which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.


A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file preview features of the application. An authenticated attacker can upload an HTML file containing JavaScript code and afterwards a file preview URL can be used to access the uploaded file. If a malicious user shares an uploaded HTML file containing JavaScript code with another user of the application and tricks an authenticated victim into accessing a URL that results in the HTML code being interpreted by the web browser then the included JavaScript code is executed under the context of the victim user session.


A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3 which could lead to session hijacking.


In Symfony before 2.7.51 2.8.x before 2.8.50 3.x before 3.4.26 4.x before 4.1.12 and 4.2.x before 4.2.7 validation messages are not escaped which can lead to XSS when user input is included. This is related to symfony/framework-bundle.


CMS Made Simple 2.2.10 has XSS via the 'moduleinterface.php' Name field which is reachable via an \Add Category\ action to the \Site Admin Settings - News module\ section.


The HTMLSanitizer class in html-sanitizer.ts in all released versions of the Aurelia framework 1.x repository is vulnerable to XSS. The sanitizer only attempts to filter SCRIPT elements which makes it feasible for remote attackers to conduct XSS attacks via (for example) JavaScript code in an attribute of various other elements. An attacker might also exploit a bug in how the SCRIPT string is processed by splitting and nesting them for example.


It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the \Activity\ page enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity which would execute arbitrary JavaScript code when viewed in a browser. All versions of pki-core are believed to be vulnerable.


CMS Made Simple 2.2.10 has XSS via the myaccount.php \Email Address\ field which is reachable via the \My Preferences -> My Account\ section.


Sitemagic CMS v4.4 has XSS in SMFiles/FrmUpload.class.php via the filename parameter.


A vulnerability was found in all pki-core 10.x.x versions where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.


The WP Statistics plugin through 12.6.2 for WordPress has XSS allowing a remote attacker to inject arbitrary web script or HTML via the Referer header of a GET request.


The \Blog\ \Forum\ \Contact Us\ screens of the template \ecommerce\ application bundled in Apache OFBiz are weak to Stored XSS attacks. Mitigation: Upgrade to 16.11.06 or manually apply the following commits on branch 16.11: 1858438 1858543 1860595 and 1860616


An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When creating a trial account it is possible to inject XSS in the Alias field allowing the attacker to retrieve the admin's cookie and take over the account.


A vulnerability was found in all pki-core 10.x.x version where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.


A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3 which could lead to session hijacking.


Jenkins 2.196 and earlier LTS 2.176.3 and earlier did not escape the reason why a queue items is blcoked in tooltips resulting in a stored XSS vulnerability exploitable by users able to control parts of the reason a queue item is blocked such as label expressions not matching any idle executors.


Yellowfin Smart Reporting All Versions Prior to 7.3 is affected by: Incorrect Access Control - Privileges Escalation. The impact is: Victim attacked and access admin functionality through their browser and control browser. The component is: MIAdminStyles.i4. The attack vector is: Victims are typically lured to a web site under the attacker's control; the XSS vulnerability on the target domain is silently exploited without the victim's knowledge. The fixed version is: 7.4 and later.


Ilias 5.3 before 5.3.12; 5.2 before 5.2.21 is affected by: Cross Site Scripting (XSS) - CWE-79 Type 2: Stored XSS (or Persistent). The impact is: Execute code in the victim's browser. The component is: Assessment / TestQuestionPool. The attack vector is: Cloze Test Text gap (attacker) / Corrections view (victim). The fixed version is: 5.3.12.


Gitea 1.7.2 1.7.3 is affected by: Cross Site Scripting (XSS). The impact is: execute JavaScript in victim's browser when the vulnerable repo page is loaded. The component is: repository's description. The attack vector is: victim must navigate to public and affected repo page.


Gitea

and

earlier

is

affected

by:

Cross

Site

Scripting

(XSS).

The

impact

is:

Attacker

is

able

to

have

victim

execute

arbitrary

JS

in

browser.

The

component

is:

go-get

URL

generation

PR

to

fix:

The

attack

vector

is:

victim

must

open

a

specifically

crafted

URL.

The

fixed

version

is:

and

later.


WebAppick

WooCommerce

Product

Feed

and

earlier

is

affected

by:

Cross

Site

Scripting

(XSS).

The

impact

is:

XSS

to

RCE

via

editing

theme

files

in

WordPress.

The

component

is:

admin/partials/woo-feed-manage-list.php:63.

The

attack

vector

is:

Administrator

must

be

logged

in.


Genetechsolutions Pie Register 3.0.15 is affected by: Cross Site Scripting (XSS). The impact is: Stealing of session cookies. The component is: File: Login. Parameters: interim-login wp-lang and supplied URL. The attack vector is: If a victim clicks a malicious link the attacker can steal his/her account. The fixed version is: 3.0.16.


phpscriptsmall.com

School

College

Portal

with

ERP

Script

and

earlier

is

affected

by:

Cross

Site

Scripting

(XSS).

The

impact

is:

Attack

administrators

and

teachers

students

and

more.

The

component

is:

/pro-school/index.php?student/message/send_reply/.

The

attack

vector

is:

<img

src=x

onerror=alert(document.domain)


HexoEditor v1.1.8-beta is affected by: XSS to code execution.


GLPI GLPI Product 9.3.1 is affected by: Cross Site Scripting (XSS). The impact is: All dropdown values are vulnerable to XSS leading to privilege escalation and executing js on admin. The component is: /glpi/ajax/getDropDownValue.php. The attack vector is: 1- User Create a ticket 2- Admin opens another ticket and click on the \Link Tickets\ feature 3- a request to the endpoint fetches js and executes it.


Premium Software CLEditor 1.4.5 and earlier is affected by: Cross Site Scripting (XSS). The impact is: An attacker might be able to inject arbitrary html and script code into the web site. The component is: jQuery plug-in. The attack vector is: the victim must open a crafted href attribute of a link (A) element.


OpenEnergyMonitor Project Emoncms 9.8.8 is affected by: Cross Site Scripting (XSS). The impact is: Theoretically low but might potentially enable persistent XSS (user could embed mal. code). The component is: Javascript code execution in \Name\ \Location\ \Bio\ and \Starting Page\ fields in the \My Account\ page. File: Lib/listjs/list.js line 67. The attack vector is: unknown victim must open profile page if persistent was possible.


ServiceStack ServiceStack Framework 4.5.14 is affected by: Cross Site Scripting (XSS). The impact is: JavaScrpit is reflected in the server response hence executed by the browser. The component is: the query used in the GET request is prone. The attack vector is: Since there is no server-side validation and If Browser encoding is bypassed the victim is affected when opening a crafted URL. The fixed version is: 5.2.0.


Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing Alert pop-up on page Redirecting to another phishing site Executing browser exploits. The component is: Snippets.


Zammad GmbH Zammad 2.3.0 and earlier is affected by: Cross Site Scripting (XSS) - CWE-80. The impact is: Execute java script code on users browser. The component is: web app. The attack vector is: the victim must open a ticket. The fixed version is: 2.3.1 2.2.2 and 2.1.3.


Timesheet Next Gen 1.5.3 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via a \redirect\ parameter. The component is: Web login form: login.php lines 40 and 54. The attack vector is: reflected XSS victim may click the malicious url.


ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier is affected by: Cross Site Scripting (XSS). The impact is: Redirecting the user to a phishing page or interacting with the application on behalf of the user. The component is: File: src/mod_auth_openidc.c Line: 3109. The fixed version is: 2.3.10.2.


Some enterprises require that REST API endpoints include security-related headers in REST responses. Headers such as X-Frame-Options and X-Content-Type-Options are generally advisable however some information security professionals additionally look for X-Permitted-Cross-Domain-Policies and X-XSS-Protection which are more generally applicable to HTML endpoint to be included too. These headers were not included in Couchbase Server 5.5.0 and 5.1.2 . They are now included in version 6.0.2 in responses from the Couchbase Server Views REST API (port 8092).


Alkacon

OpenCMS

and

before

is

affected

by

stored

cross

site

scripting

(XSS)

in

the

module

New

User

(/opencms/system/workplace/admin/accounts/user_new.jsp).

This

allows

an

attacker

to

insert

arbitrary

JavaScript

as

user

input

(First

Name

or

Last

Name)

which

will

be

executed

whenever

the

affected

snippet

is

loaded.


On D-Link DI-524 V2.06RU devices multiple Stored and Reflected XSS vulnerabilities were found in the Web Configuration: /spap.htm /smap.htm and /cgi-bin/smap as demonstrated by the cgi-bin/smap RC parameter.


GAuth 0.9.9 beta has stored XSS that shows a popup repeatedly and discloses cookies.


Subrion CMS 4.2.1 allows _core/en/contacts/ XSS via the name email or phone parameter.


Zotonic before version 0.47 has mod_admin XSS.


I Librarian 4.10 has XSS via the notes.php notes parameter.


In Eclipse BIRT versions 1.0 to 4.7 the Report Viewer allows Reflected XSS in URL parameter. Attacker can execute the payload in victim's browser context.


The MailPoet plugin before 3.23.2 for WordPress allows remote attackers to inject arbitrary web script or HTML using extra parameters in the URL (Reflective Server-Side XSS).


CMS Made Simple 2.2.10 has XSS via the m1_name parameter in \Add Article\ under Content -> Content Manager -> News.


In PrestaShop 1.7.5.2 the shop_country parameter in the install/index.php installation script/component is affected by Reflected XSS. Exploitation by a malicious actor requires the user to follow the initial stages of the setup (accepting terms and conditions) before executing the malicious link.


In EasyToRecruit (E2R) before 2.11 the upload feature and the Candidate Profile Management feature are prone to Cross Site Scripting (XSS) injection in multiple locations.


Reflected XSS on Micro Focus Enterprise Developer and Enterprise Server all versions prior to version 3.0 Patch Update 20 version 4.0 Patch Update 12 and version 5.0 Patch Update 2. The vulnerability could be exploited to redirect a user to a malicious page or forge certain types of web requests.


An issue was discovered in app/webroot/js/misp.js in MISP before 2.4.107. There is persistent XSS via image names in titles as demonstrated by a screenshot.


An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9 11.9.x before 11.9.10 and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped which could potentially lead to XSS issues.


An issue was discovered in Joomla! before 3.9.6. The debug views of com_users do not properly escape user supplied data which leads to a potential XSS attack vector.


The FileManager in InfinitumIT DirectAdmin through v1.561 has XSS via CMD_FILE_MANAGER CMD_SHOW_USER and CMD_SHOW_RESELLER; an attacker can bypass the CSRF protection with this and take over the administration panel.


Failure to correctly handle null bytes when processing HTML entities resulted in Firefox incorrectly parsing these entities. This could have led to HTML comment text being treated as HTML which could have led to XSS in a web application under certain conditions. It could have also led to HTML entities being masked from filters - enabling the use of entities to mask the actual characters of interest from filters. This vulnerability affects Firefox < 70 Thunderbird < 68.2 and Firefox ESR < 68.2.


Applaud HCM 4.0.42+ uses HTML tag fields for HTML inputs in a form. This leads to an XSS vulnerability with a payload starting with the <iframe./> substring.


XSS on the PIX-Link Repeater/Router LV-WR09 with firmware v28K.MiniRouter.20180616 allows attackers to steal credentials without being connected to the network. The attack vector is a crafted ESSID.


/servlets/ajax_file_upload?fieldName=binary3

in

dotCMS

allows

XSS

and

HTML

Injection.


Zimbra Collaboration before 8.8.12 Patch 1 has persistent XSS.


Due to an error while parsing page content it is possible for properly sanitized user input to be misinterpreted and lead to XSS hazards on web sites in certain circumstances. This vulnerability affects Firefox ESR < 60.8 Firefox < 68 and Thunderbird < 60.8.


Pagure before 5.6 allows XSS via the templates/blame.html blame view.


The File Manager in CMS Made Simple through 2.2.10 has Reflected XSS via the \New name\ field in a Rename action.


The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins.


OX App Suite 7.10.0 to 7.10.2 allows XSS.


Stored XSS was discovered in Carel pCOWeb prior to B1.2.4 as demonstrated by the config/pw_snmp.html \System contact\ field.


An

issue

was

discovered

in

in

MISP

before

There

is

persistent

XSS

via

link

type

attributes

with

links.


Stored XSS was discovered in AUO Solar Data Recorder before 1.3.0 via the protect/config.htm addr parameter.


The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings such as the yuzo_related_post_css_and_style setting.


The MigratePriorityScheme resource in Jira before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the priority icon url of an issue priority.


Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow XSS.


Dolibarr ERP/CRM 9.0.1 was affected by stored XSS within uploaded files. These vulnerabilities allowed the execution of a JavaScript payload each time any regular user or administrative user clicked on the malicious link hosted on the same domain. The vulnerabilities could be exploited by low privileged users to target administrators. The viewimage.php page did not perform any contextual output encoding and would display the content within the uploaded file with a user-requested MIME type.


In clearFilter() in utilities.php in Cacti before 1.2.3 no escaping occurs before printing out the value of the SNMP community string (SNMP Options) in the View poller cache leading to XSS.


In Pulse Secure Pulse Connect Secure (PCS) 8.3.x before 8.3R7.1 and 9.0.x before 9.0R3 an XSS issue has been found on the Application Launcher page.


I Librarian 4.10 has XSS via the export.php export_files parameter.


Some HTML elements such as <title> and <textarea> can contain literal angle brackets without treating them as markup. It is possible to pass a literal closing tag to .innerHTML on these elements and subsequent content after that will be parsed as if it were outside the tag. This can lead to XSS if a site does not filter user input as strictly for these elements as it does for other elements. This vulnerability affects Firefox < 69 Thunderbird < 68.1 Thunderbird < 60.9 Firefox ESR < 60.9 and Firefox ESR < 68.1.


A potential XSS exists in Self Service Password Reset in Micro Focus NetIQ Software all versions prior to version 4.4. The vulnerability could be exploited to enable an XSS attack.


The user defined DNS name in Zoho ManageEngine Firewall Analyzer before 12.3 Build 123224 is vulnerable to stored XSS attacks.


In osTicket before 1.12 XSS exists via /upload/file.php /upload/scp/users.php?do=import-users and /upload/scp/ajax.php/users/import if an agent manager user uploads a crafted .csv file to the User Importer because file contents can appear in an error message. The XSS can lead to local file inclusion.


Persistent XSS has been found in the OneShield Policy (Dragon Core) framework before 5.1.10. Remote adversaries can inject malicious JavaScript into textboxes decorated with type string which is subsequently stored to the applicable data store. This can be exploited remotely by both authenticated and unauthenticated users.


Serendipity before 2.1.5 has XSS via EXIF data that is mishandled in the templates/2k11/admin/media_choose.tpl Editor Preview feature or the templates/2k11/admin/media_items.tpl Media Library feature.


A persistent XSS issue was discovered in app/View/Helper/CommandHelper.php in MISP before 2.4.107. JavaScript can be included in the discussion interface and can be triggered by clicking on the link.


An issue was discovered in Quest KACE Systems Management Appliance before 9.1. The script at /service/kbot_service_notsoap.php is vulnerable to unauthenticated reflected XSS when user-supplied input to the METHOD GET parameter is processed by the web application. Since the application does not properly validate and sanitize this parameter it is possible to place arbitrary script code into the context of the same page.


The Live:Text Box macro in the Old Street Live Input Macros app before 2.11 for Confluence has XSS leading to theft of the Administrator Session Cookie.


Ignite Realtime Openfire before 4.4.1 has reflected XSS via an LDAP setup test.


The

shapepress-dsgvo

plugin

before

for

WordPress

has

wp-admin/admin-ajax.php?action=admin-common-settings&admin_email=

XSS.


Status Board 1.1.81 has reflected XSS via dashboard.ts.


The CRM Plugin before 4.2.4 for Redmine allows XSS via crafted vCard data.


An issue was discovered in the LifterLMS plugin through 3.34.5 for WordPress. The upload_import function in the class.llms.admin.import.php script is prone to an unauthenticated options import vulnerability that could lead to privilege escalation (administrator account creation) website redirection and stored XSS.


An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filename to the file-upload feature of the event simulator component.


WebTorrent before 0.107.6 allows XSS in the HTTP server via a title or file name.


The zoho-salesiq plugin before 1.0.9 for WordPress has stored XSS.


The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS.


The icegram plugin before 1.10.29 for WordPress has ig_cat_list XSS.


The custom-404-pro plugin before 3.2.8 for WordPress has reflected XSS a different vulnerability than CVE-2019-14789.


An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1.


DWSurvey

through

has

reflected

XSS

via

the

design/qu-multi-fillblank!answers.action

surveyId

parameter.


The easy-pdf-restaurant-menu-upload plugin before 1.1.2 for WordPress has XSS.


Bolt before 3.6.10 has XSS via an image's alt or title field.


CodiMD 1.3.1 when Safari is used allows XSS via an IFRAME element with allow-top-navigation in the sandbox attribute in conjunction with a data: URL.


Multiple stored XSS vulnerabilities in Sentrifugo 3.2 could allow authenticated users to inject arbitrary web script or HTML.


Kimai v2 before 1.1 has XSS via a timesheet description.


The review resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a missing branch.


Insufficient sanitization during device search in Netdisco 2.042010 allows for reflected XSS via manipulation of a URL parameter.


Bolt before 3.6.10 has XSS via createFolder or createFile in Controller/Async/FilesystemManager.php.


laracom (aka Laravel FREE E-Commerce Software) 1.4.11 has search?q= XSS.


Status Board 1.1.81 has reflected XSS via logic.ts.


In the MobileFrontend extension for MediaWiki XSS exists within the edit summary field of the watchlist feed. This affects REL1_31 REL1_32 and REL1_33.


The import-users-from-csv-with-meta plugin before 1.14.0.3 for WordPress has XSS.


The the-events-calendar plugin before 4.8.2 for WordPress has XSS via the tribe_paged URL parameter.


The

photoblocks-grid-gallery

plugin

before

for

WordPress

has

wp-admin/admin.php?page=photoblocks-edit&id=

XSS.


An issue was discovered in GitLab Community and Enterprise Edition 8.1 through 12.2.1. Certain areas displaying Markdown were not properly sanitizing some XSS payloads.


The Kunena extension before 5.1.14 for Joomla! allows XSS via BBCode.


Missing escaping of HTML in the Updater of Nextcloud 15.0.5 allowed a reflected XSS when starting the updater from a malicious location.


Bolt before 3.6.10 has XSS via a title that is mishandled in the system log.


The give plugin before 2.4.7 for WordPress has XSS via a donor name.


The onesignal-free-web-push-notifications plugin before 1.17.8 for WordPress has XSS via the subdomain parameter.


SITOS six Build v6.2.1 allows a user to change their password and recovery email address without requiring them to confirm the change with their old password. This would allow an attacker with access to the victim's account (e.g. via XSS or an unattended workstation) to change that password and address.


The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field.


Former before 4.2.1 has XSS via a checkbox value.


The woo-variation-gallery plugin before 1.1.29 for WordPress has XSS.


DfE School Experience before v16333-GA has XSS via a teacher training URL.


In Zimbra Collaboration before 8.8.15 Patch 1 there is a non-persistent XSS vulnerability.


LibreNMS v1.54 has XSS in the Create User Inventory Add Device Notifications Alert Rule Create Maintenance and Alert Template sections of the admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account.


The ultimate-faqs plugin before 1.8.22 for WordPress has XSS.


The breadcrumbs-by-menu plugin before 1.0.3 for WordPress has XSS.


The 360-product-rotation plugin before 1.4.8 for WordPress has reflected XSS.


FUEL CMS 1.4.4 has XSS in the Create Blocks section of the Admin console. This could lead to cookie stealing and other malicious actions. This vulnerability can be exploited with an authenticated account but can also impact unauthenticated visitors.


The webp-express plugin before 0.14.8 for WordPress has stored XSS.


An issue was discovered in PRiSE adAS 1.7.0. The newentityID parameter is not properly escaped leading to a reflected XSS in the error message.


The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature as demonstrated by the orderby or searchpublish_date parameter.


Intesync Solismed 3.3sp has XSS.


The simple-mail-address-encoder plugin before 1.7 for WordPress has reflected XSS.


Missing sanitization in the iOS App 2.24.4 causes an XSS when opening malicious HTML files.


Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 before 10500 are vulnerable to XSS injected by a workstation local administrator. Using the installed program names of the computer as a vector the local administrator can execute code on the Manage Engine ServiceDesk administrator side. At \Asset Home > Server > <workstation> > software\ the administrator of ManageEngine can control what software is installed on the workstation. This table shows all the installed program names in the Software column. In this field a remote attacker can inject malicious code in order to execute it when the ManageEngine administrator visualizes this page.


REDCap before 9.3.0 allows XSS attacks against non-administrator accounts on the Data Import Tool page via a CSV data import file.


The /plugins/servlet/branchreview resource in Atlassian Fisheye and Crucible before version 4.7.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the reviewedBranch parameter.


openITCOCKPIT before 3.7.1 has reflected XSS aka RVID 3-445b21.


The wp-ultimate-recipe plugin before 3.12.7 for WordPress has stored XSS.


The easy-digital-downloads plugin before 2.9.16 for WordPress has XSS related to IP address logging.


CyberChef

before

allows

XSS

in


The my-calendar plugin before 3.1.10 for WordPress has XSS.


The wp-slimstat plugin before 4.8.1 for WordPress has XSS.


Improper neutralization of file names conversation names and board names in Nextcloud Server 16.0.3 Nextcloud Talk 6.0.3 and Nextcloud Deck 0.6.5 causes an XSS when linking them with each others in a project.


selectize-plugin-a11y before 1.1.0 has XSS via the msg field.


The easy-property-listings plugin before 3.4 for WordPress has XSS.


The \HTML Include and replace macro\ plugin before 1.5.0 for Confluence Server allows a bypass of the includeScripts=false XSS protection mechanism via vectors involving an IFRAME element.


The import-users-from-csv-with-meta plugin before 1.14.1.3 for WordPress has XSS via imported data.


Nagios Log Server before 2.0.8 allows Reflected XSS via the username on the Login page.


Jooby before 1.6.4 has XSS via the default error handler.


The JobCareer theme before 2.5.1 for WordPress has stored XSS.


django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline.


An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create User. A malicious attacker can modify the firstName and lastName to contain JavaScript code.


An issue was discovered in EspoCRM before 5.6.6. There is stored XSS due to lack of filtration of user-supplied data in Create Task. A malicious attacker can modify the parameter name to contain JavaScript code.


Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the asset account name. The JavaScript code is executed during a visit to the audit account statistics page.


JetBrains Upsource before 2019.1.1412 was not properly escaping HTML tags in a code block comments leading to XSS.


studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.


The woocommerce-product-addon plugin before 18.4 for WordPress has XSS via an import of a new meta data structure.


SuiteCRM

and

before

and

has

XSS.


OX App Suite 7.10.1 and 7.10.2 allows XSS.


The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectangle_name or rectangle_opacity parameter.


cPanel before 82.0.2 has Self XSS in the cPanel and webmail master templates (SEC-506).


An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed on the Preference page as well as while sending an email when a malicious payload was inserted inside the Email Signature in the Preference page. The attacker could insert malicious JavaScript inside his email signature which fires when the victim replies or forwards the mail thus helping him steal victims' cookies (hence compromising their accounts).


An issue was discovered in PRiSE adAS 1.7.0. Log data are not properly escaped leading to persistent XSS in the administration panel.


The

mq-woocommerce-products-price-bulk-edit

(aka

Woocommerce

Products

Price

Bulk

Edit)

plugin

for

WordPress

allows

XSS

via

the

wp-admin/admin-ajax.php?action=update_options

parameter.


SugarCRM

Enterprise

allows

mobile/error-not-supported-platform.html?desktop_url=

XSS.


XSS exists in WEB STUDIO Ultimate Loan Manager 2.0 by adding a branch under the Branches button that sets the notes parameter with crafted JavaScript code.


An issue was discovered in ZenTao 11.5.1. There is an XSS (stored) vulnerability that leads to the capture of other people's cookies via the Rich Text Box.


An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is a post-authentication admin.cgi?action= XSS vulnerability on the management interface.


cPanel before 82.0.2 has stored XSS in the WHM Tomcat Manager interface (SEC-504).


Veeam ONE Reporter 9.5.0.3201 allows XSS via a crafted Description(config) field to addDashboard or editDashboard in CommonDataHandlerReadOnly.ashx.


An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a attacker sends an attachment to admin with malicious JavaScript in the filename. This JavaScript executed when an admin selects the particular file from the list of all attachments. The attacker could inject the JavaScript inside the filename and send it to users thus helping him steal victims' cookies (hence compromising their accounts).


The 10Web Photo Gallery plugin before 1.5.23 for WordPress has authenticated stored XSS.


cosenary Instagram-PHP-API (aka Instagram PHP API V2) as used in the UserPro plugin through 4.9.32 for WordPress has XSS via the example/success.php error_description parameter.


verdaccio before 3.12.0 allows XSS.


** DISPUTED ** Evolution CMS 2.0.x allows XSS via a description and new category location in a template. NOTE: the vendor states that the behavior is consistent with the \access policy in the administration panel.\


cPanel before 78.0.18 has stored XSS in the BoxTrapper Queue Listing (SEC-493).


An issue was discovered in EspoCRM before 5.6.6. Stored XSS exists due to lack of filtration of user-supplied data in Create Case. A malicious attacker can modify the firstName and lastName to contain JavaScript code.


An issue was discovered in Cloudera Manager 5.x before 5.16.2 6.0.x before 6.0.2 and 6.1.x before 6.1.1. Malicious impala queries can result in Cross Site Scripting (XSS) when viewed within this product.


Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the transaction description field. The JavaScript code is executed during deletion of a transaction link.


DWSurvey

through

has

stored

XSS

via

the

design/my-survey-design!copySurvey.action

surveyName

parameter.


studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template editing.


Firefly III 4.7.17.3 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the bill name field. The JavaScript code is executed during rule-from-bill creation.


The wp-database-backup plugin before 5.1.2 for WordPress has XSS.


The

Tribulant

Newsletters

plugin

before

for

WordPress

allows

XSS

via

the

wp-admin/admin-ajax.php?action=newsletters_load_new_editor

contentarea

parameter.


iCMS 7.0.15 allows admincp.php?app=apps XSS via the keywords parameter.


The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter.


In app/webroot/js/event-graph.js in MISP 2.4.111 a stored XSS vulnerability exists in the event-graph view when a user toggles the event graph view. A malicious MISP event must be crafted in order to trigger the vulnerability.


The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter.


Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions.


The

toggle-the-title

(aka

Toggle

The

Title)

plugin

for

WordPress

has

XSS

via

the

wp-admin/admin-ajax.php?action=update_title_options

isAutoSaveValveChecked

or

isDisableAllPagesValveChecked

parameter.


pandao Editor.md 1.5.0 allows XSS via an attribute of an ABBR or SUP element.


The FV Flowplayer Video Player plugin before 7.3.14.727 for WordPress allows email subscription XSS.


cPanel before 82.0.2 has stored XSS in the WHM Modify Account interface (SEC-512).


An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed inside the title and breadcrumb of a newly formed entity available to all the users. A malicious user can inject JavaScript in these values of an entity thus stealing user cookies when someone visits the publicly accessible link.


XSS in the DHCP lease-status table in Billion Smart Energy Router SG600R2 Firmware v3.02.rc6 allows an attacker to inject arbitrary HTML/JavaScript code to achieve client-side code execution via crafted DHCP request packets to etc_ro/web/internet/dhcpcliinfo.asp.


JetBrains YouTrack versions before 2019.2.53938 had a possible XSS through issue attachments when using the Firefox browser.


Xavier PHP Management Panel 3.0 is vulnerable to Reflected POST-based XSS via the username parameter when registering a new user at admin/includes/adminprocess.php. If there is an error when registering the user the unsanitized username will reflect via the error page. Due to the lack of CSRF protection on the admin/includes/adminprocess.php endpoint an attacker is able to chain the XSS with CSRF in order to cause remote exploitation.


The

woo-variation-swatches

(aka

Variation

Swatches

for

WooCommerce)

plugin

for

WordPress

allows

XSS

via

the

wp-admin/admin.php?page=woo-variation-swatches-settings

tab

parameter.


Firefly III 4.7.17.5 is vulnerable to stored XSS due to the lack of filtration of user-supplied data in the liability name field. The JavaScript code is executed upon an error condition during a visit to the account show page.


The

\CP

Contact

Form

with

PayPal\

plugin

before

for

WordPress

has

XSS

in

the

publishing

wizard

via

the

wp-admin/admin.php?page=cp_contact_form_paypal.php&pwizard=1

parameter.


An issue was discovered in Frappe Framework 10 11 before 11.1.46 and 12. There exists an XSS vulnerability.


An issue was discovered in EspoCRM before 5.6.9. Stored XSS was executed when a victim clicks on the Edit Dashboard feature present on the Homepage. An attacker can load malicious JavaScript inside the add tab list feature which would fire when a user clicks on the Edit Dashboard button thus helping him steal victims' cookies (hence compromising their accounts).


EspoCRM version 5.6.4 is vulnerable to stored XSS due to lack of filtration of user-supplied data in the api/v1/Document functionality for storing documents in the account tab. An attacker can upload a crafted file that contains JavaScript code in its name. This code will be executed when a user opens a page of any profile with this.


The FilterPickerPopup.jspa resource in Jira before version 7.13.7 and from version 8.0.0 before version 8.3.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.


An issue was discovered in EspoCRM before 5.6.9. Stored XSS in the body of an Article was executed when a victim opens articles received through mail. This Article can be formed by an attacker using the Knowledge Base feature in the tab list. The attacker could inject malicious JavaScript inside the body of the article thus helping him steal victims' cookies (hence compromising their accounts).


Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx.


Opengear console server firmware releases prior to 4.5.0 have a stored XSS vulnerability related to serial port logging. If a malicious user of an external system (connected to a serial port on an Opengear console server) sends crafted text to a serial port (that has logging enabled) the text will be replayed when the logs are viewed. Exploiting this vulnerability requires access to the serial port and/or console server.


JetBrains YouTrack versions before 2019.1.52584 had a possible XSS in the issue titles.


An issue was discovered on Mitsubishi Electric ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. A number of stored cross-site script (XSS) vulnerabilities allow an attacker to inject malicious code directly into the application. An example input variable vulnerable to stored XSS is SerialInitialModemString in the index.php page.


In

the

MobileFrontend

extension

through

for

MediaWiki

XSS

exists

within

the

edit

summary

field

in


The \CP Contact Form with PayPal\ plugin before 1.2.98 for WordPress has XSS in CSS edition.


Open-School

and

Community

Edition

allows

XSS

via

the

osv/index.php?r=students/guardians/create

id

parameter.


An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. Stored XSS exists in setup/install.php. It was observed that no input sanitization was provided in the firstname and lastname fields of the application. The insertion of malicious queries in those fields leads to the execution of those queries. This can further lead to cookie stealing or other malicious actions.


The

limb-gallery

(aka

Limb

Gallery)

plugin

for

WordPress

has

XSS

via

the

wp-admin/admin-ajax.php?action=grsGalleryAjax&grsAction=shortcode

task

parameter


An issue was discovered in osTicket before 1.10.7 and 1.12.x before 1.12.1. The Ticket creation form allows users to upload files along with queries. It was found that the file-upload functionality has fewer (or no) mitigations implemented for file content checks; also the output is not handled properly causing persistent XSS that leads to cookie stealing or malicious actions. For example a non-agent user can upload a .html file and Content-Disposition will be set to inline instead of attachment.


Firefly III 4.7.17.4 is vulnerable to multiple stored XSS issues due to the lack of filtration of user-supplied data in the transaction description field and the asset account name. The JavaScript code is executed during a convert transaction action.


An issue was discovered in PRiSE adAS 1.7.0. Certificate data are not properly escaped. This leads to XSS when submitting a rogue certificate.


In SilverStripe asset-admin 4.0 there is XSS in file titles managed through the CMS.


An issue was discovered in PRiSE adAS 1.7.0. The OPENSSO module does not properly escape output on error leading to reflected XSS.


pandao Editor.md 1.5.0 allows XSS via the Javascript: string.


1CRM On-Premise Software 8.5.7 allows XSS via a payload that is mishandled during a Run Report operation.


explorer.js in Amazon AWS JavaScript S3 Explorer (aka aws-js-s3-explorer) v2 alpha before 2019-08-02 allows XSS in certain circumstances.


An issue was discovered in Openfind Mail2000 6.0 and 7.0 Webmail. XSS can occur via an '<object data=\data:text/html' substring in an e-mail message (The vendor subsequently patched this).


The Wordfence plugin 7.2.3 for WordPress allows XSS via a unique attack vector.


The \Forminator Contact Form Poll & Quiz Builder\ plugin before 1.6 for WordPress has XSS via a custom input field of a poll.


FiberHome an5506-04-f RP2669 devices have XSS.


jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving the '<EMBED SRC=\data:image/svg+xml' substring.


An issue was discovered in Mahara 17.10 before 17.10.8 18.04 before 18.04.4 and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting (XSS) due to not escaping it when viewing the collection's SmartEvidence overview page (if that feature is turned on). This can be exploited by any logged-in user.


XSS

exists

in

WUZHI

CMS

via

index.php?m=content&f=postinfo&v=listing&set_iframe=XSS

to


An XSSI (cross-site inclusion) vulnerability in Jupyter Notebook before 5.7.6 allows inclusion of resources on malicious pages when visited by users who are authenticated with a Jupyter server. Access to the content of resources has been demonstrated with Internet Explorer through capturing of error messages though not reproduced with other browsers. This occurs because Internet Explorer's error messages can include the content of any invalid JavaScript that was encountered.


An

XSS

vulnerability

was

discovered

in

MOPCMS

through

There

is

persistent

XSS

that

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

formname

parameter

in

a

mod=column

request

as

demonstrated

by

the

/mopcms/X0AZgf(index).php?mod=column&ac=list&menuid=28&ac=add&menuid=29

URI.


XSS

exists

in

WUZHI

CMS

via

index.php?m=core&f=map&v=baidumap&x=XSS&y=XSS

to


PRTG Network Monitor v7.1.3.3378 allows XSS via the /public/login.htm errormsg or loginurl parameter. NOTE: This product is discontinued.


An issue was discovered in Joomla! before 3.9.4. The item_title layout in edit views lacks escaping leading to XSS.


Ability Mail Server 4.2.6 has Persistent Cross Site Scripting (XSS) via the body e-mail body. To exploit the vulnerability the victim must open an email with malicious Javascript inserted into the body of the email as an iframe.


An issue was discovered in Joomla! before 3.9.4. The media form field lacks escaping leading to XSS.


The Web manager (aka Commander) on Korenix JetPort 5601 and 5601f devices has Persistent XSS via the Port Alias field under Serial Setting.


The

social-warfare

plugin

before

for

WordPress

has

stored

XSS

via

the

wp-admin/admin-post.php?swp_debug=load_options

parameter

as

exploited

in

the

wild

in

March

This

affects

Social

Warfare

and

Social

Warfare

Pro.


On

Zyxel

ZyWALL

ZyWALL

ZyWALL

devices

the

security

firewall

login

page

is

vulnerable

to

Reflected

XSS

via

the

unsanitized

parameter.


XSS

exists

in

WUZHI

CMS

via

index.php?m=message&f=message&v=add&username=XSS

to


An issue was discovered in b3log Symphony (aka Sym) before v3.4.7. XSS exists via the userIntro and userNickname fields to processor/SettingsProcessor.java.


PRTG Network Monitor v7.1.3.3378 allows XSS via the /search.htm searchtext parameter. NOTE: This product is discontinued.


The

plugin

before

for

WordPress

allows

wp-admin/admin.php?page=blog2social-ship

XSS.


The wp-google-maps plugin before 7.10.43 for WordPress has XSS via the wp-admin/admin.php PATH_INFO.


PHP Scripts Mall Personal Video Collection Script 4.0.4 has Stored XSS via the \Update profile\ feature.


The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to stored XSS. A remote attacker authenticated with an administrator account could store a maliciously named file within the web application that would execute each time a user browsed to the page.


An issue was discovered in baigo CMS 2.1.1. There is a persistent XSS vulnerability that allows remote attackers to inject arbitrary web script or HTML via the optbaseBG_SITE_NAME parameter to the bg_console/index.php?m=opt&c=request URI.


VFront 0.99.5 has Reflected XSS via the admin/menu_registri.php descrizione_g parameter or the admin/sync_reg_tab.php azzera parameter.


An issue was discovered in DOYO (aka doyocms) 2.3 through 2015-05-06. It has admin.php XSS.


Stored XSS within Quadbase EspressReport ES (ERES) v7.0 update 7 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The XSS payload is stored by creating a new user account and setting the username to an XSS payload. The stored payload can then be triggered by accessing the \Set Security Levels\ or \View User/Group Relationships\ page. If the attacker does not currently have permission to create a new user another vulnerability such as CSRF must be exploited first.


Gila CMS 1.9.1 has XSS.


An issue was discovered in Joomla! before 3.9.4. The JSON handler in com_config lacks input validation leading to XSS.


XSS

exists

in

WUZHI

CMS

via

index.php?m=attachment&f=imagecut&v=init&imgurl=XSS

to


The font-organizer plugin 2.1.1 for WordPress has wp-admin/options-general.php manage_font_id XSS.


The kingcomposer plugin 2.7.6 for WordPress has wp-admin/admin.php?page=kc-mapper id XSS.


Editor.md 1.5.0 has DOM-based XSS via vectors involving the '<EMBED SRC=\data:image/svg+xml' substring.


An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/system_manage/save.html URI related to the site_code parameter.


S-CMS PHP v1.0 has XSS in 4.edu.php via the S_id parameter.


Vesta Control Panel 0.9.8-23 allows XSS via a crafted URL.


The

yop-poll

plugin

before

for

WordPress

has

wp-admin/admin.php?page=yop-polls&action=view-votes

XSS.


The \Donation Plugin and Fundraising Platform\ plugin before 2.3.1 for WordPress has wp-admin/edit.php csv XSS.


The

Quiz

And

Survey

Master

plugin

for

WordPress

allows

wp-admin/admin.php?page=mlw_quiz_results

XSS.


The

social-networks-auto-poster-facebook-twitter-g

plugin

before

for

WordPress

has

wp-admin/admin.php?page=nxssnap-reposter&action=edit

item

XSS.


DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors involving the '<EMBED SRC=\data:image/svg+xml' substring.


simple-markdown.js in Khan Academy simple-markdown before 0.4.4 allows XSS via a data: or vbscript: URI.


Mailtraq WebMail version 2.17.7.3550 has Persistent Cross Site Scripting (XSS) via the body of an e-mail message. To exploit the vulnerability the victim must open an email with malicious Javascript inserted into the body of the email as an iframe.


In st2web in StackStorm Web UI before 2.9.3 and 2.10.x before 2.10.3 it is possible to bypass the CORS protection mechanism via a \null\ origin value potentially leading to XSS.


An issue was discovered in the Harmis JE Messenger component 1.2.2 for Joomla!. It is possible to craft messages in a way that JavaScript gets executed on the side of the receiving user when the message is opened aka XSS.


In the 3.1.12 Pro version of Craft CMS XSS has been discovered in the header insertion field when adding source code at an s/admin/entries/news/new URI.


An issue was discovered in Hsycms V1.1. There is an XSS vulnerability via the name field to the /book page.


DhCms through 2017-09-18 has admin.php?r=admin/Index/index XSS.


WooCommerce before 3.5.5 allows XSS via a Photoswipe caption.


The Contact Form Email plugin before 1.2.66 for WordPress allows wp-admin/admin.php item XSS related to cp_admin_int_edition.inc.php in the \custom edition area.\


An issue was discovered in LabKey Server 19.1.0. The display name of a user is vulnerable to stored XSS that can execute on administrators from security/permissions.view security/addUsers.view or wiki/Administration/page.view in the admin panel leading to privilege escalation.


An

issue

was

discovered

in

FusionPBX

up

to

In

the

file

an

unsanitized

id

variable

coming

from

the

URL

is

reflected

in

HTML

on

occasions

leading

to

XSS.


kkcms

has

jx.php?url=

XSS.


admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.


An Improper Neutralization of Input vulnerability in the Anomaly Detection Parameter Name in Fortinet FortiWeb 6.0.5 6.2.0 and 6.1.1 may allow a remote unauthenticated attacker to perform a Cross Site Scripting attack (XSS).


An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter.


WordPress before 5.2.3 allows XSS in media uploads because wp_ajax_upload_attachment is mishandled.


The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS due to improper encoding and insertion of an HTTP GET parameter into HTML. The filter function on the page listing all detected broken links can be exploited by providing an XSS payload in the s_filter GET parameter in a filter_id=search request. NOTE: this is an end-of-life product.


has

XSS

in

via

a

name

field

to

/contact.html.


In Joomla! 3.x before 3.9.12 inadequate escaping allowed XSS attacks using the logo parameter of the default templates.


Gophish through 0.8.0 allows XSS via a username.


LimeSurvey

before

allows

reflected

XSS

for

escalating

privileges

from

a

low-privileged

account

to

for

example

SuperAdmin.

This

occurs

in


In NCH Express Accounts Accounting v7.02 persistent cross site scripting (XSS) exists in Invoices/Sales Orders/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Sales Orders/Items/Customers/Quotes fields parameter to inject arbitrary JavaScript.


Jenkins buildgraph-view Plugin 1.8 and earlier does not escape the description of builds shown in its view resulting in a stored XSS vulnerability exploitable by users able to change build descriptions.


SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.


On DrayTek Vigor2925 devices with firmware 3.8.4.3 XSS exists via a crafted WAN name on the General Setup screen. NOTE: this is an end-of-life product.


A CSRF vulnerability exists in NETSAS ENIGMA NMS version 65.0.0 and prior that could allow an attacker to be able to trick a victim into submitting a malicious manage_files.cgi request. This can be triggered via XSS or an IFRAME tag included within the site.


Liferay Portal through 7.2.0 GA1 allows XSS via a journal article title to journal_article/page.jsp in journal/journal-taglib.


The insert-php (aka Woody ad snippets) plugin before 2.2.8 for WordPress allows authenticated XSS via the winp_item parameter.


Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.885 exists via the cmd_arg parameter. This can be exploited by a local attacker who supplies a crafted filename within a directory visited by the victim.


LimeSurvey before v3.17.14 allows stored XSS for escalating privileges from a low-privileged account to for example SuperAdmin. The attack uses a survey group in which the title contains JavaScript that is mishandled upon group deletion.


Jenkins Mission Control Plugin 0.9.16 and earlier does not escape job display names and build names shown on its view resulting in a stored XSS vulnerability exploitable by attackers able to change these properties.


WordPress before 5.2.3 allows XSS in post previews by authenticated users.


Ogma CMS 0.5 has XSS via creation of a new blog.


The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Menu inc/class-easyfancybox.php due to improper encoding of arbitrarily submitted settings parameters. This occurs because there is no inline styles output filter.


In htdocs/societe/card.php in Dolibarr 10.0.1 the value of the User-Agent HTTP header is copied into the HTML document as plain text between tags leading to XSS.


An

issue

was

discovered

in

ThinkSAAS

There

is

XSS

via

the

content

to

the

index.php?app=group&ac=comment&ts=do&js=1

URI

as

demonstrated

by

a

crafted

SVG

document

in

the

SRC

attribute

of

an

EMBED

element.


Portainer before 1.22.1 has XSS (issue 1 of 2).


HRworks FLOW 3.36.9 allows XSS via the purpose of a travel-expense report.


WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS.


ScadaBR 1.0CE and 1.1.x through 1.1.0-RC has XSS via a request for a nonexistent resource as demonstrated by the dwr/test/ PATH_INFO.


In Pannellum from 2.5.0 through 2.5.4 URLs were not sanitized for data URIs (or vbscript:) allowing for potential XSS attacks. Such an attack would require a user to click on a hot spot to execute and would require an attacker-provided configuration. The most plausible potential attack would be if pannellum.htm was hosted on a domain that shared cookies with the targeted site's user authentication; an <iframe> could then be embedded on the attacker's site using pannellum.htm from the targeted site which would allow the attacker to potentially access information from the targeted site as the authenticated user (or worse if the targeted site did not have adequate CSRF protections) if the user clicked on a hot spot in the attacker's embedded panorama viewer. This was patched in version 2.5.5.


DOMPurify before 2.0.1 allows XSS because of innerHTML mutation XSS (mXSS) for an SVG element or a MATH element as demonstrated by Chrome and Safari.


NIUSHOP V1.11 has XSS via the index.php?s=/admin URI.


The breadcrumbs contributed module through 0.2.0 for Padrino Framework allows XSS via a caption.


WordPress before 5.2.3 allows XSS in stored comments.


WordPress users with lower privileges (like contributors) can inject JavaScript code in the block editor using a specific payload which is executed within the dashboard. This can lead to XSS if an admin opens the post in the editor. Execution of this attack does require an authenticated user. This has been patched in WordPress 5.3.1 along with all the previous WordPress versions from 3.7 to 5.3 via a minor release. Automatic updates are enabled by default for minor releases and we strongly recommend that you keep them enabled.


An

issue

was

discovered

in

Manager

before

and

before

before

FreePBX

In

the

Manager

module

form

(html\\admin\\modules\\manager\\views\\form.php)

an

unsanitized

managerdisplay

variable

coming

from

the

URL

is

reflected

in

HTML

leading

to

XSS.

It

can

be

requested

via

GET

request

to

/config.php?type=tool&display=manager.


WordPress before 5.2.3 allows reflected XSS in the dashboard.


Centreon before 2.8.30 18.x before 18.10.8 and 19.x before 19.04.5 allows XSS via myAccount alias and name fields.


Cybele Thinfinity VirtualUI 2.5.17.2 allows HTTP response splitting via the mimetype parameter within a PDF viewer request as demonstrated by an example.pdf?mimetype= substring. The victim user must load an application request to view a PDF containing the malicious payload. This results in a reflected XSS payload being executed.


The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to improper encoding of several configuration options in the admin area and the displayed cookie consent message. This affects Font Color Background Color and the Disable Cookie text. An attacker with high privileges can attack other users.


admin/infolist_add.php in PHPMyWind 5.6 has stored XSS.


s-cms V3.0 has XSS in index.php?type=text via the S_id parameter.


In NCH Express Invoice v7.12 persistent cross site scripting (XSS) exists via the Invoices/Items/Customers/Quotes input field. An authenticated unprivileged user can add/modify the Invoices/Items/Customers fields parameter to inject arbitrary JavaScript.


Afterlogic Aurora through 8.3.9-build-a3 has XSS that can be leveraged for session hijacking by retrieving the session cookie from the administrator login.


An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS in the Appearance modifier.


An issue was discovered in Devise Token Auth through 1.1.2. The omniauth failure endpoint is vulnerable to Reflected Cross Site Scripting (XSS) through the message parameter. Unauthenticated attackers can craft a URL that executes a malicious JavaScript payload in the victim's browser. This affects the fallback_render method in the omniauth callbacks controller.


Sakai through 12.6 allows XSS via a chat user name.


A DOM based XSS in GFI Kerio Control v9.3.0 allows embedding of malicious code and manipulating the login page to send back a victim's cleartext credentials to an attacker via a login/?reason=failure&NTLM= URI.


A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers wp-json/visualizer/v1/update-chart with no access control and classes/Visualizer/Render/Page/Data.php lacks output sanitization.


An issue was discovered in ZrLog 2.1.1. There is a Stored XSS vulnerability in the article_edit area.


Jenkins Pipeline Aggregator View Plugin 1.8 and earlier does not escape information shown on its view resulting in a stored XSS vulnerability exploitable by attackers able to affects view content such as job display name or pipeline stage names.


WordPress before 5.2.3 allows XSS in shortcode previews.


On DrayTek Vigor2925 devices with firmware 3.8.4.3 Incorrect Access Control exists in loginset.htm and can be used to trigger XSS. NOTE: this is an end-of-life product.


In WordPress before 5.3.1 authenticated users with lower privileges (like contributors) can inject JavaScript code in the block editor which is executed within the dashboard. It can lead to an admin opening the affected post in the editor leading to XSS.


The documentation XML-RPC server in Python through 2.7.16 3.x through 3.6.9 and 3.7.x through 3.7.4 has XSS via the server_title field. This occurs in Lib/DocXMLRPCServer.py in Python 2.x and in Lib/xmlrpc/server.py in Python 3.x. If set_server_title is called with untrusted input arbitrary JavaScript can be delivered to clients that visit the http URL for this server.


In JetBrains YouTrack through 2019.2.56594 stored XSS was found on the issue page.


Portainer before 1.22.1 has XSS (issue 2 of 2).


In the api-bearer-auth plugin before 20190907 for WordPress the server parameter is not correctly filtered in the swagger-config.yaml.php file and it is possible to inject JavaScript code aka XSS.


An

issue

was

discovered

in

Contactmanager

before

before

and

before

for

FreePBX

In

the

Contactmanager

class

(html\\admin\\modules\\contactmanager\\Contactmanager.class.php)

an

unsanitized

group

variable

coming

from

the

URL

is

reflected

in

HTML

on

occasions

leading

to

XSS.

It

can

be

requested

via

a

GET

request

to

/admin/ajax.php?module=contactmanager.


Footy Tipping Software AFL Web Edition 2019 allows XSS.


S-CMS v1.5 has XSS in tpl.php via the member/member_login.php from parameter.


Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cross site scripting (XSS) vulnerability when generating an HTML report from a malicious heap dump. The user must chose todownload open the malicious heap dump and generate an HTML report for the problem to occur. The heap dump could be specially crafted or could come from a crafted application or from an application processing malicious data. The vulnerability is present whena report is generated and opened from the Memory Analyzer graphical user interface or when a report generated in batch mode is then opened in Memory Analyzer or by a web browser. The vulnerability could possibly allow code execution on the local system whenthe report is opened in Memory Analyzer.


totemodata 3.0.0_b936 has XSS via a folder name.


Comtech H8 Heights Remote Gateway 2.5.1 devices allow XSS and HTML injection via the Site Name (aka SiteName) field.


The animate-it plugin before 2.3.5 for WordPress has XSS.


in

the

download-plugins-dashboard

plugin

through

for

WordPress

has

multiple

unauthenticated

stored

XSS

issues.


D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface leading to common injection.


Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.


The Blog2Social plugin before 5.9.0 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the b2s_id parameter. The component is: views/b2s/post.calendar.php. The attack vector is: When the Administrator is logged in a reflected XSS may execute upon a click on a malicious URL.


LavaLite through 5.7 has XSS via a crafted account name that is mishandled on the Manage Clients screen.


Nokia IMPACT < 18A: has Reflected self XSS


cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).


SonarSource SonarQube before 7.8 has XSS in project links on account/projects.


includes/options.php

in

the

motors-car-dealership-classified-listings

(aka

Motors

Car

Dealer

Classified

Ads)

plugin

through

for

WordPress

has

multiple

stored

XSS

issues.


EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter.


A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation.


includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues.


In

Apak

Wholesale

Floorplanning

Finance

and

an

attacker

can

send

an

authenticated

POST

request

with

a

malicious

payload

to

allowing

a

stored

XSS

via

the

mainForm:loanNotesnotes:0:rich_text_editor_note_text

parameter

in

the

Notes

section.

Although

versions

and

are

confirmed

to

be

affected

all

versions

with

the

vulnerable

WYSIWYG

editor

in

the

Notes

section

are

likely

affected.


There is a stored XSS in Rambox 0.6.9 that can lead to code execution. The XSS is in the name field while adding/editing a service. The problem occurs due to incorrect sanitization of the name field when being processed and stored. This allows a user to craft a payload for Node.js and Electron such as an exec of OS commands within the onerror attribute of an IMG element.


cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).


An issue was discovered in Dolibarr 10.0.2. It has XSS via the \outgoing email setup\ feature in the admin/mails.php?action=edit URI via the \Sender email for automatic emails (default value in php.ini: Undefined)\ field.


Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problemsample_input parameter to web/admin/problem/create or web/polygon/problem/update.


WordPress before 5.2.4 is vulnerable to a stored XSS attack to inject JavaScript into STYLE elements.


The quiz-master-next (aka Quiz And Survey Master) plugin before 6.3.5 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter (and/or the quiz_id parameter). The component is: admin/quiz-options-page.php. The attack vector is: When the Administrator is logged in a reflected XSS may execute upon a click on a malicious URL.


cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).


An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the FileName parameter to /FTPDiag.asp.


tonyy dormsystem through 1.3 allows DOM XSS.


The animate-it plugin before 2.3.4 for WordPress has XSS.


Rocket.Chat before 2.1.0 allows XSS via a URL on a !title line.


includes/class-coming-soon-creator.php in the igniteup plugin through 3.4 for WordPress is vulnerable to stored XSS.


A

reflected

XSS

vulnerability

was

found

in

in

the

broken-link-checker

(aka

Broken

Link

Checker)

plugin

for

WordPress.

This

allows

unauthorized

users

to

inject

client-side

JavaScript

into

an

admin-only

WordPress

page

via

the

wp-admin/tools.php?page=view-broken-links

parameter

in

a

search

action.


The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.


z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen because of mishandling on the \Operation log\ screen.


Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problemdescription parameter to web/admin/problem/create or web/polygon/problem/update.


When pasting a <style> tag from the clipboard into a rich text editor the CSS sanitizer does not escape < and > characters. Because the resulting string is pasted directly into the text node of the element this does not result in a direct injection into the webpage; however if a webpage subsequently copies the node's innerHTML assigning it to another innerHTML this would result in an XSS vulnerability. Two WYSIWYG editors were identified with this behavior more may exist. This vulnerability affects Firefox ESR < 68.4 and Firefox < 72.


Gila CMS through 1.11.4 allows blog-list.php XSS in both the gila-blog and gila-mag themes via the search parameter a related issue to CVE-2019-9647.


Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problemtitle parameter to web/polygon/problem/create or web/polygon/problem/update or web/admin/problem/create.


The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post.


In Redmine before 3.4.11 and 4.0.x before 4.0.4 persistent XSS exists due to textile formatting errors.


An issue was discovered in Dolibarr 10.0.2. It has XSS via the \outgoing email setup\ feature in the /admin/mails.php?action=edit URI via the \Send all emails to (instead of real recipients for test purposes)\ field.


The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header.


cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).


An Improper Neutralization of Input vulnerability in the description and title parameters of a Device Maintenance Schedule in FortiSIEM version 5.2.5 and below may allow a remote authenticated attacker to perform a Stored Cross Site Scripting attack (XSS) by injecting malicious JavaScript code into the description field of a Device Maintenance schedule.


An issue was discovered in Dolibarr 10.0.2. It has XSS via the \outgoing email setup\ feature in the admin/mails.php?action=edit URI via the \Email used for error returns emails (fields 'Errors-To' in emails sent)\ field.


in

Eclipse

Mojarra

as

used

in

Mojarra

for

Eclipse

before

and

Mojarra

JavaServer

Faces

before

allows

Reflected

XSS

because

a

client

window

field

is

mishandled.


cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).


An XSS vulnerability on Technicolor TC7300 STFA.51.20 devices allows remote attackers to inject arbitrary web script via the \Connected Clients\ field to /wlanAccess.asp. An intranet host can use a crafted hostname to exploit this.


The CleanTalk cleantalk-spam-protect plugin before 5.127.4 for WordPress is affected by: Cross Site Scripting (XSS). The impact is: Allows an attacker to execute arbitrary HTML and JavaScript code via the from or till parameter. The component is: inc/cleantalk-users.php and inc/cleantalk-comments.php. The attack vector is: When the Administrator is logged in a reflected XSS may execute upon a click on a malicious URL.


REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values.


laravel-bjyblog 6.1.1 has XSS via a crafted URL.


An issue was discovered in XunRuiCMS 4.3.1. There is a stored XSS in the module_category area.


Local file inclusion in brokerPerformance.php in Centreon Web before 2.8.28 allows attackers to disclose information or perform a stored XSS attack on a user.


The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explorer.


A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS.


An issue was discovered in fastadmin 1.0.0.20190705_beta. There is a public/admin/general.config/edit CSRF vulnerability as demonstrated by resultant XSS via the row[name] parameter.


b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.


Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor ClientNickNameColor Email email or email_address parameter).


Chamilo

Chamilo-lms

version

and

earlier

contains

a

Cross

Site

Scripting

(XSS)

vulnerability

in

that

can

result

in

a

message

being

sent

to

the

Administrator

with

the

XSS

to

steal

cookies.

A

ticket

can

be

created

with

a

XSS

payload

in

the

subject

field.

This

attack

appears

to

be

exploitable

via

as

the

payload

user

on

the

Subject

field.

This

makes

it

possible

to

obtain

the

cookies

of

all

users

that

have

permission

to

view

the

tickets.

This

vulnerability

appears

to

have

been

fixed

in

after

commit


phpIPAM version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in subnet-scan-telnet.php that can result in executing code in victims browser. This attack appears to be exploitable via victim visits link crafted by an attacker. This vulnerability appears to have been fixed in 1.4.


HotelDruid

has

XSS

affecting

the

nsextt

origine

and

anno

parameters

in

creaprezzi.php

personalizza.php

and


Multiple stored XSS in Vanilla Forums before 2.5 allow remote attackers to inject arbitrary JavaScript code into any message on forum.


Vulnerability in Online Store v1.0 The registration form requirements for the member email format can be bypassed by posting directly to sent_register.php allowing special characters to be included and an XSS payload to be injected.


An

issue

was

discovered

in

SchoolCMS

There

is

an

XSS

vulnerability

via

index.php?a=Index&c=Channel&m=Home&viewid=XSS.


Vulnerability in Online Store v1.0 Stored XSS in user_view.php where adidas_member_user variable is not sanitized.


An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/scheduleConfig.jsp file via these GET parameters: devSrc emailId excWeekModify filterFlag getFilter mailReport mset popup rep_schedule rep_Type schDesc schName schSource selectDeviceDone task val10 and val11.


Zimbra Collaboration 8.7.x - 8.8.11P2 contains persistent XSS.


An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/popup1.jsp file via these GET parameters: bussAlert customDev and selSource.


MDaemon

Webmail

through

before

has

XSS

(issue

of


The wikirenderer component in Jira before version 7.13.6 and from version 8.0.0 before version 8.3.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in image attribute specification.


skins/classic/views/controlcap.php in ZoneMinder before 1.32.3 has XSS via the newControl array as demonstrated by the newControlMinTiltRange parameter.


An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the third textbox (aka site logo) of \System setting->site setting\ of admin/index.php aka site_logo.


imcat 4.5 has Stored XSS via the root/run/adm.php fminstopnote parameter.


In Bootstrap before 3.4.1 and 4.3.x before 4.3.1 XSS is possible in the tooltip or popover data-template attribute.


Various templates of the Optimization plugin in Jira before version 7.13.6 and from version 8.0.0 before version 8.4.0 allow remote attackers who have permission to manage custom fields to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a custom field.


An

issue

was

discovered

in

SchoolCMS

There

is

an

XSS

vulnerability

via

index.php?a=Index&c=Channel&m=Home&id=XSS.


Vulnerability in Online Store v1.0 stored XSS in admin/user_view.php adidas_member_email variable


XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued.


OpenEMR v5.0.1-6 allows XSS.


An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box (for the website statistics code).


iart.php in XAMPP 1.7.0 has XSS a related issue to CVE-2008-3569.


An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the first textbox of \System setting->site setting\ of admin/index.php aka site_name.


An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in /netflow/jspui/userManagementForm.jsp via these GET parameters: authMeth passWord pwd1 and userName.


PHP Scripts Mall Responsive Video News Script has XSS via the Search Bar. This might for example be leveraged for HTML injection or URL redirection.


admin/default.php in PHPMyWind v5.5 has XSS via an HTTP Host header.


The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter related to haproxy_listeners.php and haproxy_listeners_edit.php.


ORY Hydra before v1.0.0-rc.3+oryOS.9 has Reflected XSS via the oauth2/fallbacks/error error_hint parameter.


An issue was discovered in Zoho ManageEngine Netflow Analyzer Professional 7.0.0.2. XSS exists in the Administration zone /netflow/jspui/selectDevice.jsp file in these GET parameters: param and rtype.


includes/database.php in ZoneMinder before 1.32.3 has XSS in the construction of SQL-ERR messages.


Zimbra Collaboration 8.7.x - 8.8.11P2 contains non-persistent XSS.


MDaemon

Webmail

through

before

has

XSS

(issue

of


An issue was discovered in DiliCMS 2.4.0. There is a Stored XSS Vulnerability in the second textbox of \System setting->site setting\ of admin/index.php aka site_domain.


data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page.


node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware


The reflex-gallery plugin before 1.4.3 for WordPress has XSS.


The \Count per Day\ plugin before 3.2.6 for WordPress allows XSS via the wp-admin/?page=cpd_metaboxes daytoshow parameter.


The validator module before 1.1.0 for Node.js allows remote attackers to bypass the XSS filter via a nested tag.


D-Link

cli.cgi

XSS


Windu CMS 2.2 allows XSS via the name parameter to admin/content/edit or admin/content/add or the username parameter to admin/users.


The contact-form-plugin plugin before 3.3.5 for WordPress has XSS.


The contact-form-plugin plugin before 3.52 for WordPress has XSS.


Horde Groupware Webmail Edition has CSRF and XSS when saving search as a virtual address book


JBossWeb Bayeux has reflected XSS


Sencha Labs Connect has XSS with connect.methodOverride()


SPBAS Business Automation Software 2012 has XSS.


Open redirect vulnerability in the AbstractAuthenticationFormServlet in the Auth Core (org.apache.sling.auth.core) bundle before 1.1.4 in Apache Sling allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the resource parameter related to \a custom login form and XSS.\


smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)


WordPress Xorbin Digital Flash Clock 1.0 has XSS


PrestaShop before 1.4.11 allows Logistician translators and other low level profiles/accounts to inject a persistent XSS vector on TinyMCE.


Xorbin Analog Flash Clock 1.0 extension for Joomia has XSS


Transcend WiFiSD 1.8 has persistent XSS


PQI AirCard has persistent XSS


AultWare pwStore 2010.8.30.0 has XSS


Orange HRM 2.7.1 allows XSS via the vacancy name.


XSS Auditor in WebKit in Apple Safari before 6.0.5 does not properly rewrite URLs which allows remote attackers to trigger unintended form submissions via unspecified vectors.


The Bug Genie before 3.2.6 has Multiple XSS and HTML Injection Vulnerabilities


Perforce P4web 2011.1 and 2012.1 has multiple XSS vulnerabilities


Chamilo 1.9.4 has Multiple XSS and HTML Injection Vulnerabilities: blog.php and announcements.php.


Havalite CMS 1.1.7 has a stored XSS vulnerability


Pinboard 1.0.6 theme for Wordpress has XSS.


The XSS Auditor in Google Chrome before 25.0.1364.152 allows remote attackers to obtain sensitive HTTP Referer information via unspecified vectors.


WordPress Super Cache Plugin 1.3 has XSS.


Katello has multiple XSS issues in various entities


Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS.


Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) prior to 10.1 Minor 7 allows a remote authenticated administrator to embed a XSS in the administrator interface via specially crafted custom rules containing HTML. NSM did not correctly sanitize custom rule content in all scenarios.


The m_txtNom y m_txtCognoms parameters in TCMAN GIM v8.01 allow an attacker to perform persistent XSS attacks. This vulnerability could be used to carry out a number of browser-based attacks including browser hijacking or theft of sensitive data.


Multiple Cross Site Scripting (XSS) vulnerabilities exists in PHPGurukul Shopping v3.1 via the (1) callback parameter in (a) server_side/scripts/id_jsonp.php (b) server_side/scripts/jsonp.php and (c) scripts/objects_jsonp.php the (2) value parameter in examples_support/editable_ajax.php and the (3) PHP_SELF parameter in captcha/index.php.


Multiple Cross Site Scripting (XSS) vulnerabilities exists in Remote Clinic v2.0 in (1) patients/register-patient.php via the (a) Contact (b) Email (c) Weight (d) Profession (e) ref_contact (f) address (g) gender (h) age and (i) serial parameters; in (2) patients/edit-patient.php via the (a) Contact (b) Email (c) Weight Profession (d) ref_contact (e) address (f) serial (g) age and (h) gender parameters; in (3) staff/edit-my-profile.php via the (a) Title (b) First Name (c) Last Name (d) Skype and (e) Address parameters; and in (4) clinics/settings.php via the (a) portal_name (b) guardian_short_name (c) guardian_name (d) opening_time (e) closing_time (f) access_level_5 (g) access_level_4 (h) access_level_ 3 (i) access_level_2 (j) access_level_1 (k) currency (l) mobile_number (m) address (n) patient_contact (o) patient_address and (p) patient_email parameters.


Open

edX

through

allows

XSS

in

via

crafted

LaTeX

content

within

a

discussion.


GlobalNewFiles

is

a

MediaWiki

extension

maintained

by

Miraheze.

Prior

to

commit

number

the

username

column

of

the

GlobalNewFiles

special

page

is

vulnerable

to

a

stored

XSS.

Commit

number

contains

a

patch.

As

a

workaround

one

may

disallow

(or

other

characters

required

to

insert

html/js)

from

being

used

in

account

names

so

an

XSS

is

not

possible.


Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows stored XSS with resultant code execution because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution the attacker can rely on the ability of an admin to install widgets disclosure of the admin session ID in a Referer header and the ability of an admin to use the templating engine (e.g. Edit HTML).


Certain

MOXA

devices

allow

reflected

XSS

via

the

Config

Import

menu.

This

affects

OnCell

OnCell

and


WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the custom HTML widget. This has been patched in WordPress 5.8. It was only present during the testing/beta phase of WordPress 5.8.


Invision Community (aka IPS Community Suite or IP-Board) before 4.6.5.1 allows reflected XSS because the filenames of uploaded files become predictable through a brute-force attack against the PHP mt_rand function.


An XSS issue was discovered in ReCaptcha Solver 5.7. A response from Anti-Captcha.com RuCaptcha.com 2captcha.com DEATHbyCAPTCHA.com ImageTyperz.com or BestCaptchaSolver.com in setCaptchaCode() is inserted into the DOM as HTML resulting in full control over the user's browser by these servers.


Pimcore is an open source data & experience management platform. Prior to version 10.1.2 text-values were not properly escaped before printed in the version preview. This allowed XSS by authenticated users with access to the resources. This issue is patched in Pimcore version 10.1.2.


Multiple

Cross

Site

Scripting

(XSS)

vulnerabilities

exits

in

SEO

Panel

via

the

parameter

in

(a)

backlinks.php

(b)

analytics.php

(c)

log.php

(d)

overview.php

(e)

pagespeed.php

(f)

rank.php

(g)

review.php

(h)

saturationchecker.php

(i)

and

(j)

reports.php;

the

parameter

in

(a)

backlinks.php

(b)

analytics.php

(c)

log.php

(d)

overview.php

(e)

pagespeed.php

(f)

rank.php

(g)

review.php

(h)

saturationchecker.php

(i)

(j)

webmaster-tools.php

and

(k)

reports.php;

the

parameter

in

(a)

analytics.php

(b)

review.php

(c)

and

(d)

webmaster-tools.php;

and

the

pageno

parameter

in

(a)

alerts.php

(b)

log.php

(c)

keywords.php

(d)

proxy.php

(e)

searchengine.php

and

(f)

siteauditor.php.


Pimcore is an open source data & experience management platform. Prior to version 10.1.2 an authenticated user could add XSS code as a value of custom metadata on assets. There is a patch for this issue in Pimcore version 10.1.2. As a workaround users may apply the patch manually.


remark-html is an open source nodejs library which compiles Markdown to HTML. In affected versions the documentation of remark-html has mentioned that it was safe by default. In practice the default was never safe and had to be opted into. That is user input was not sanitized. This means arbitrary HTML can be passed through leading to potential XSS attacks. The problem has been patched in 13.0.2 and 14.0.1: `remark-html` is now safe by default and the implementation matches the documentation. On older affected versions pass `sanitize: true` if you cannot update.


Eyoucms 1.5.4 lacks sanitization of input data allowing an attacker to inject malicious code into `filename` param to trigger Reflected XSS.


Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the (1) searchdata parameter in (a) doctor/search.php and (b) admin/patient-search.php and the (2) fromdate and (3) todate parameters in admin/betweendates-detailsreports.php.


Canon Oce Print Exec Workgroup 1.3.2 allows XSS via the lang parameter.


Improper neutralization of user input in GitLab CE/EE versions 14.3 to 14.3.6 14.4 to 14.4.4 and 14.5 to 14.5.2 allowed an attacker to exploit XSS by abusing the generation of the HTML code related to emojis


A Stored XSS via Malicious File Upload exists in Gila CMS version 2.2.0. An attacker can use this to steal cookies passwords or to run arbitrary code on a victim's browser.


A Stored XSS in merge request creation page in all versions of Gitlab EE starting from 13.7 before 14.1.7 all versions starting from 14.2 before 14.2.5 and all versions starting from 14.3 before 14.3.1 allows an attacker to execute arbitrary JavaScript code on the victim's behalf via malicious approval rule names


Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.


WordPress

is

a

free

and

open-source

content

management

system

written

in

PHP

and

paired

with

a

MySQL

or

MariaDB

database.

Impact

The

issue

allows

an

authenticated

but

low-privileged

user

(like

contributor/author)

to

execute

XSS

in

the

editor.

This

bypasses

the

restrictions

imposed

on

users

who

do

not

have

the

permission

to

post

Patches

This

has

been

patched

in

WordPress

and

will

be

pushed

to

older

versions

via

minor

releases

(automatic

updates).

It's

strongly

recommended

that

you

keep

auto-updates

enabled

to

receive

the

fix.

References

For

more

information

If

you

have

any

questions

or

comments

about

this

advisory:

Open

an

issue

in


MaianAffiliate v1.0 allows an authenticated administrative user to save an XSS to the database.


Stored XSS in PartKeepr 1.4.0 Edit section in multiple api endpoints via name parameter.


Static (Persistent) XSS Vulnerability exists in version 4.3.0 of Yclas when using the install/view/form.php script. An attacker can store XSS in the database through the vulnerable SITE_NAME parameter.


OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present because the attack risk is largely limited to a compromised account; however XSS protection is planned for a future release.


In ocProducts Composr CMS before 10.0.38 an attacker can inject JavaScript via Comcode for XSS.