Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/options-general.php.


Cross site scripting (XSS) vulnerability in the markup_clean_href function in inc/conv.php in BlogoText through 3.7.6 allows remote attackers to inject arbitrary JavaScript via a comment.


Cross - site scripting (XSS) vulnerability in UrBackup Server before 2.1.20 allows remote attackers to inject arbitrary web script or HTML via the action parameter.


Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL due to use of unsanitized $_SERVER'PHP_SELF' to generate URLs.


Cross site scripting (XSS) vulnerability in the Spiffy Calendar plugin before 3.3.0 for WordPress allows remote attackers to inject arbitrary JavaScript via the yr parameter.


Cross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field.


Cross Site Scripting (XSS) exists on the Foxconn FEMTO AP-FC4064-T AP_GT_B38_5.8.3lb15-W47 LTE Build 15 via the configuration of a user account. An attacker can execute arbitrary script on an unsuspecting user's browser.


Cross Site Scripting (XSS) exists in PHP Scripts Mall Learning and Examination Management System Script 2.3.1 via a crafted message.


Cross Site Scripting (XSS) exists in PHP Scripts Mall Bitcoin MLM Software 1.0.2 via a profile field.


Cross Site Scripting (XSS) exists in PHP Scripts Mall Alibaba Clone Script 1.0.2 via a profile parameter.


Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.


Cross Site Scripting (XSS) exists in PHP Scripts Mall Lawyer Search Script 1.0.2 via a profile update parameter.


Cross Site Scripting (XSS) exists in PHP Scripts Mall Facebook Clone Script.


Cross Site Scripting (XSS) exists in PHP Scripts Mall Slickdeals / DealNews / Groupon Clone Script 3.0.2 via a User Profile Field parameter.


Cross Site Scripting (XSS) exists in PHP Scripts Mall Multi religion Responsive Matrimonial 4.7.2 via a user profile update parameter.


Cross Site Scripting (XSS) exists in the review section in PHP Scripts Mall Hot Scripts Clone Script Classified 3.1 via the title or description field.


Cross Site Scripting (XSS) exists in Tiki before 12.13 15.6 17.2 and 18.1.


Cross

Site

Scripting

(XSS)

exists

in

MetInfo

via

because

mishandles

input

data.


Cross Site Scripting (XSS) vulnerability in Enhancesoft osTicket before v1.12.6 via the queue-name parameter in include/class.queue.php.


Cross Site Scripting (XSS) vulnerability in NukeViet cms 4.4.0 via the editor in the News module.


Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.2 when adding a blog and then editing an image file.


Cross Site Scripting (XSS) vulnerability in phpList 3.5.3 via the login name field in Manage Administrators when adding a new admin.


Cross Site Scripting (XSS) in Monica before 2.19.1 via the journal page.


Cross Site Scripting (XSS) vulnerability in the kk Star Ratings plugin before 4.1.5.


Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and \Keyword\ in URL Filter.


Cross Site Scripting (XSS) in Group Office CRM 6.4.196 via the SET_LANGUAGE parameter.


Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System with Admin Panel 1.0.


Cross Site Scripting (XSS) in the contact page of Group Office CRM 6.4.196 by uploading a crafted svg file.


Cross Site Scripting (XSS) vulnerability in CMS Made Simple 2.2.14 in \Extra\ via 'News > Article\ feature.


Cross Site Scripting (XSS) vulnerability in UltimateKode Neo Billing - Accounting Invoicing And CRM Software up to version 3.5 which allows remote attackers to inject arbitrary web script or HTML.


Cross Site Scripting (XSS) vulneraiblity in LimeSurvey 4.2.5 on textbox via the Notifications & data feature.


Cross Site Scripting (XSS) vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature.


Cross Site Scripting (XSS) vulnerability in the Larsens Calender plugin Version <= 1.2 for WordPress allows remote attackers to execute arbitrary web script via the \titel\ column on the \Eintrage hinzufugen\ tab.


Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.


Cross Site Scripting (XSS) vulnerabiity exists in LavaLite CMS 5.8.0 via the Menu Blocks feature which can be bypassed by using HTML event handlers such as \ontoggle \.


Cross Site Scripting (XSS) vulnerability in Evolution CMS 2.0.2 via the Document Manager feature.


Cross Site Scripting (XSS) vulnerability in NavigateCMS 2.9 when performing a Create or Edit via the Tools feature.


Cross

Site

Scripting

(XSS)

vulnerability

in

PHP-Fusion

via

'New

Shout'

in


Cross Site Scripting (XSS) vulnerability in Textpattern CMS 4.8.1 via Custom fields in the Menu Preferences feature.


Cross Site Scripting (XSS) vulnerability in NavigateCMS NavigateCMS 2.9 via the name=\wrong_path_redirect\ feature.


Cross Site Scripting (XSS) vulnerability in Aryanic HighMail (High CMS) versions 2020 and before allows remote attackers to inject arbitrary web script or HTML via 'user' to LoginForm.


Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the \payment gateway\ column on transactions tab.


Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.7 allows remote malicious users to inject arbitrary web script or HTML via an unsanitized \f\ variable in app\\vars\\vars_textarea.php.


Cross Site Scripting (XSS) vulnerability in HisiPHP 2.0.8 via the group name in addgroup.html.


Cross Site Scripting (XSS) in X2engine X2CRM v7.1 and older allows remote attackers to obtain sensitive information by injecting arbitrary web script or HTML via the \First Name\ and \Last Name\ fields in \/index.php/contacts/create page\


Cross Site Scripting (XSS) vulnerabilty in IPFire 2.23 via the IPfire web UI in the mail.cgi.


Cross Site Scripting (XSS) vulnerability in PublicCMS 4.0 to get an admin cookie when the Administrator reviews submit case.


Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php.


Cross Site Scripting (XSS) vulnerability exists in ManageEngine OPManager <=12.5.174 when the API key contains an XML-based XSS payload.


Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2 allows an attacker to inject arbitrary web script or HTML via the op parameter.


Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the signature field to /settings/profile.


Cross Site Scripting (XSS vulnerability exists in WUZHI CMS 4.1.0 via the mailbox username in index.php.


Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post content field to /post/editing.


Cross Site Scripting (XSS) vulnerability in INSMA Wifi Mini Spy 1080P HD Security IP Camera 1.9.7 B via all fields in the FTP settings page to the \goform/formSetFtpCfg\ settings page.


Cross Site Scripting (XSS) vulnerability exists in zzcms 2019 XSS via a modify action in user/adv.php.


Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the post header field to /post/editing.


Cross

Site

Scripting

(XSS)

vlnerability

exists

in

WUZHI

CMS

up

to

and

including

in

the

config

function

in


Cross Site Scripting (XSS) vulnerability in mblog 3.5 via the nickname field to /settings/profile.


Cross Site Scripting (XSS) vulnerability in craftcms 3.1.31 allows remote attackers to inject arbitrary web script or HTML via /admin/settings/sites/new.


Cross Site Scripting (XSS) vulnerabiity in YzmCMS 5.2 via the site_code parameter in admin/index/init.html.


Cross Site Scripting (XSS) vulnerabililty in WebPort <=1.19.1 via the description parameter to script/listcalls.


Cross Site Scripting (XSS) vulnerability exists in UKCMS v1.1.10 via data in the index function in Single.php


Cross Site Scripting (XSS) vulnerability exists in DamiCMS v6.0.6 via the title parameter in the doadd function in LabelAction.class.php.


Cross Site Scripting (XSS) vulneraibility in Roundcube mail .4.4 via database host and user in /installer/test.php.


Cross Site Scripting (XSS) vulnerability exists in bycms v3.0.4 via the title parameter in the edit function in Document.php.


Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template.


Cross Site Scripting (XSS) vulnerability exists in qdPM 9.1 in the Heading field found in the Login Page page under the General menu via a crafted website name by doing an authenticated POST HTTP request to /qdPM_9.1/index.php/configuration.


Cross Site Scripting (XSS) vulnerability exists in PopojiCMS 2.0.1 in admin.php?mod=menumanager--------- edit menu.


Cross Site Scripting (XSS) vulnerability in WebPort <=1.19.1via the connection name parameter in type-conn.


Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the upurl function in Page.php.


Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.


Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.


Cross Site Scripting (XSS) vulnerability exists in Alfresco Alfresco Community Edition v5.2.0 via the action parameter in the alfresco/s/admin/admin-nodebrowser API. Fixed in v6.2


Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the act parameter in bbs/move_update.php.


Cross Site Scripting (XSS) vulnerability exists in YUNUCMS 1.1.9 via the param parameter in the insertContent function in ContentModel.php.


Cross

Site

Scripting

(XSS)

vulnerability

in

umeditor

via


Cross Site Scripting (XSS) vulnerabilty exists in BigTree-CMS 4.4.3 in the tag name field found in the Tags page under the General menu via a crafted website name by doing an authenticated POST HTTP request to admin/tags/create.


Cross Site Scripting (XSS) vulnerability exists in PbootCMS v1.3.7 via the title parameter in the mod function in SingleController.php.


Cross Site Scripting (XSS) vulnerability in HuCart 5.7.4 via nickname in index.php.


Cross Site Scripting (XSS) vulnerability in GetSimpleCMS <= 3.3.15 in admin/changedata.php via the redirect_url parameter and the headers_sent function.


Cross Site Scripting (XSS) vulnerability in the \To Remote CSV\ component under \Open\ Menu in Flexmonster Pivot Table & Charts 2.7.17.


Crossi Site Scripting (XSS) vulnerability in PbootCMS 2.0.3 in admin.php.


Cross Site Scripting (XSS) vulnerability exists in EyouCMS1.3.6 in the basic_information area.


Cross Site Scripting (XSS) vulnerability in the Showtime2 Slideshow module in CMS Made Simple (CMSMS) 2.2.4.


Cross Site Scripting (XSS) vulnerability in ECShop 4.0 due to security filtering issues in the user.php file we can use the html entity encoding to bypass the security policy of the safety.php file triggering the xss vulnerability.


Cross Site Scripting (XSS) vulnerability in the Remote JSON component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.


Cross Site Scripting (XSS) vulnerability in GetSimpleCMS 3.4.0a in admin/edit.php.


Cross Site Scripting (XSS) vulnerability in the To OLAP (XMLA) component Under the Connect menu in Flexmonster Pivot Table & Charts 2.7.17.


Cross Site Scripting (XSS) vulnerability in Remote Report component under the Open menu in Flexmonster Pivot Table & Charts 2.7.17.


Cross Site Scripting (XSS) vulnerability in Gophish through 0.10.1 via a crafted landing page or email template.


Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the Host field on the send profile form.


Cross Site Scripting (XSS) vulnerability in wcms 0.3.2 allows remote attackers to inject arbitrary web script and HTML via the pagename parameter to wex/html.php.


Cross Site Scripting (XSS) vulnerability in Gophish before 0.11.0 via the IMAP Host field on the account settings page.


Cross Site Scripting (XSS) vulnerability in the Registration page of the admin panel in PHPGurukul User Registration & Login and User Management System With admin panel 2.1.


Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot action.


Cross Site Scripting (XSS) vulnerability in Kentico before 12.0.75.


Cross Site Scripting (XSS) vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column.


Cross Site Scripting (XSS) vulnerability in Beetel router 777VR1 can be exploited via the NTP server name in System Time and \Keyword\ in URL Filter.


Cross Site Scripting (XSS) in Webmail Calender in IceWarp WebClient 10.3.5 allows remote attackers to inject arbitrary web script or HTML via the \p4\ field.


Cross Site Scripting (XSS) in Configuration page in SKYWORTH GN542VF Hardware Version 2.0 and Software Version 2.0.0.16 allows authenticated attacker to inject their own script into the page via DDNS Configuration Section.


Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.


Cross Site Scripting (XSS) vulnerability exists in Eyoucms v1.4.7 and earlier via the addonfieldext parameter.


Cross Site Scripting (XSS) in LavaLite 5.8.0 via the Address field.


Cross Site Scripting (XSS) vulnerability exists in VMware vRealize Log Insight prior to 8.1.0 due to improper Input validation.


Cross Site Scripting (XSS) exists in Piwigo before 2.8.3 via a crafted search expression to include/functions_search.inc.php.


Cross Site Scripting (XSS) in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments.


Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value in the view user (user.php) because proper filtration is omitted.


A stored cross site scripting vulnerability in Jenkins Maven Release Plugin 0.14.0 and earlier allowed attackers to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.


A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins.


A stored cross site scripting have been identified at the comments in the report creation due to an obsolote version of tinymce editor. In order to exploit this vulnerability the attackers needs an account with enough privileges to view and edit reports.


A Stored Cross Site Scripting vulnerability via Malicious File Upload exists in multiple pages of IceHrm 30.0.0.OS that allows for arbitrary execution of JavaScript commands.


A stored cross site scripting (XSS) vulnerability in the /sys/attachment/uploaderServlet component of Landray EKP V12.0.9.R.20160325 allows attackers to execute arbitrary web scripts or HTML via a crafted SVG SHTML or MHT file.


A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c_Images of dotCMS 21.05.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' and 'Filename' parameters.


A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Student Attendance Management System 1.0 via the couse filed in index.php.


A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel.


A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel.


A Stored Cross Site Scripting (XSS) vunerability exists in Sourcecodeste Vehicle Parking Management System affected version 1.0 is via the add-vehicle.php endpoint.


A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel.


A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the User List Section in login panel.


A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel.


A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel.


A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel.


A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login panel.


A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Settings Section in login panel.


A Stored Cross Site Scripting (XSS) issue exists in Convos-Chat before 6.32.


A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Online Enrollment Management System in PHP and PayPal Free Source Code 1.0 in the Add-Users page via the Name parameter.


A Stored Cross Site Sripting (XSS) vulnerability exists in DzzOffice 2.02.1 via the settingnew parameter.


A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in room_list.


A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in room_types.


A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the specialization parameter in doctors.php


A stored cross site scripting (XSS) vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to execute a malicious payload on vulnerable systems.


A stored cross site scripting (XSS) vulnerability in NeDi before 1.7Cp3 allows remote attackers to inject arbitrary web script or HTML via User-Chat.php.


A stored cross site scripting (XSS) vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML.


A stored cross site scripting (XSS) vulnerability in the 'Global Lists\ feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.


A stored cross site scripting (XSS) vulnerability in the 'Users Alerts' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' parameter.


A stored cross site scripting (XSS) vulnerability in the 'Users Access Groups' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.


A stored cross site scripting (XSS) vulnerability in the 'Entities List' feature of Rukovoditel 2.7.2 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Name' parameter.


A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \Edit Values\ field under the \Configure Attributes\ module.


A stored cross site scripting (XSS) vulnerability in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload in the \admin\ parameter under the \Manage administrators\ module.


A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \Add a list\ field under the \Import Emails\ module.


A

stored

cross

site

scripting

(XSS)

vulnerability

in

of

PHP-Fusion

allows

authenticated

attackers

to

execute

arbitrary

web

scripts

or

HTML

via

a

crafted

payload

entered

into

the

\Registration\

field.


A stored cross site scripting (XSS) vulnerability in Monstra CMS version 3.0.4 allows attackers to execute arbitrary web scripts or HTML via crafted a payload entered into the \Site Name\ field under the \Site Settings\ module.


A stored cross site scripting (XSS) vulnerability in the \Import Subscribers\ feature in phplist 3.5.4 and below allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.


A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \List Description\ field under the \Edit A List\ module.


A stored cross site scripting (XSS) vulnerability in administration/settings_main.php of PHP-Fusion 9.03.50 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \Site footer\ field.


A stored cross site scripting (XSS) vulnerability in the \Import emails\ module in phplist 3.5.4 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.


A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \Send test\ field under the \Start or continue campaign\ module.


A stored cross site scripting (XSS) vulnerability in phplist 3.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the \Configure categories\ field under the \Categorise Lists\ module.


A stored cross site scripting (XSS) vulnerability in /administration/setting_security.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload.


A stored cross site scripting (XSS) vulnerability in /admin/snippets.php of GetSimple CMS 3.4.0a allows attackers to execute arbitrary web scripts or HTML via crafted payload in the Edit Snippets module.


A stored cross site scripting (XSS) vulnerability in /admin.php?mod=user&act=addnew of PopojiCMS 1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the E-Mail field.


A stored cross site scripting (XSS) vulnerability in the web_attr_2 field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.


A stored cross site scripting (XSS) vulnerability in the web_copyright field of Eyoucms v1.4.1 allows authenticated attackers to execute arbitrary web scripts or HTML.


A stored-self XSS exists in Croogo through v3.0.5 allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/blocks/blocks/edit/8.


A stored-self XSS exists in Croogo through v3.0.5 allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/menus/menus/edit/3.


A stored-self XSS exists in Croogo through v3.0.5 allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/file-manager/attachments/edit/4.


A stored-self XSS exists in ATutor through v2.2.4 allowing an attacker to execute HTML or JavaScript code in a vulnerable Real Name field to /mods/_core/users/admins/my_edit.php.


A

stored-self

XSS

exists

in

of

ZoneMinder

through

allowing

an

attacker

to

execute

HTML

or

JavaScript

code

in

a

vulnerable

field

via

a

crafted

Zone

NAME

to

the

index.php?view=zones&action=zoneImage&mid=1

URI.


A stored-self XSS exists in web/skins/classic/views/controlcaps.php of ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code in a vulnerable field via a long NAME or PROTOCOL to the index.php?view=controlcaps URI.


A stored-self XSS exists in LightCMS v1.3.4 allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/SensitiveWords.


DomainMOD through 4.11.01 has XSS via the assets/edit/ip-address.php ipid parameter.


DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields.


DomainMOD through 4.11.01 has XSS via the assets/edit/host.php Web Host Name or Web Host URL field.


DomainMOD through 4.11.01 has XSS via the assets/edit/registrar-account.php raid parameter.


DomainMOD through 4.11.01 has XSS via the admin/ssl-fields/add.php notes field for Custom SSL Fields.


DomainMOD through 4.11.01 has XSS via the assets/add/account-owner.php Owner name field.


DomainMOD through 4.11.01 has XSS via the assets/add/dns.php Profile Name or notes field.


DomainMOD through 4.11.01 has XSS via the admin/dw/add-server.php DisplayName HostName or UserName field.


DomainMOD through 4.11.01 has XSS via the assets/add/registrar-accounts.php UserName Reseller ID or notes field.


DomainMOD through 4.11.01 has XSS via the assets/add/registrar.php notes field for the Registrar.


Online Ticket Booking has XSS via the admin/eventlist.php cast parameter.


The ultimate-member plugin before 2.0.54 for WordPress has XSS.


The ultimate-member plugin before 2.0.52 for WordPress has XSS during an account upgrade.


The ultimate-member plugin before 2.0.52 for WordPress has XSS related to UM Roles create and edit operations.


The ultimate-member plugin before 1.3.18 for WordPress has XSS via text input.


The ultimate-member plugin before 2.0.4 for WordPress has XSS.


The ultimate-member plugin before 1.3.40 for WordPress has XSS on the login form.


The wp-live-chat-support plugin before 7.1.05 for WordPress has XSS.


The wp-live-chat-support plugin before 7.1.03 for WordPress has XSS.


The wp-live-chat-support plugin before 6.2.02 for WordPress has XSS.


OpenCart 3.x when the attacker has login access to the admin panel allows stored XSS within the Source/HTML editing feature of the Categories Product and Information pages.


Open-Xchange GmbH OX App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).


In Apache Archiva before 2.2.4 it may be possible to store malicious XSS code into central configuration entries i.e. the logo URL. The vulnerability is considered as minor risk as only users with admin role can change the configuration or the communication between the browser and the Archiva server must be compromised.


A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface.


The SSI printenv command in Apache Tomcat 9.0.0.M1 to 9.0.0.17 8.5.0 to 8.5.39 and 7.0.0 to 7.0.93 echoes user provided data without escaping and is therefore vulnerable to XSS. SSI is disabled by default. The printenv command is intended for debugging and is unlikely to be present in a production website.


Greenbone Security Assistant (GSA) before 8.0.2 and Greenbone OS (GOS) before 5.0.10 allow XSS during 404 URL handling in gsad.


LuCI in OpenWrt 18.06.0 through 18.06.4 allows stored XSS via a crafted SSID.


The Web Client in Cerberus FTP Server Enterprise before 10.0.19 and 11.x before 11.0.4 allows XSS via an SVG document.


NetBox through 2.6.2 allows an Authenticated User to conduct an XSS attack against an admin via a GFM-rendered field as demonstrated by /dcim/sites/add/ comments.


Mitigates a stored/reflected XSS issue in ArcSight Logger versions prior to 6.7.


All versions up to V20.18.40.R7.B1of ZTE NetNumen DAP product have an XSS vulnerability. Due to the lack of correct validation of client data in WEB applications which results in users being hijacked.


The OUGC Awards plugin before 1.8.19 for MyBB allows XSS via a crafted award reason that is mishandled on the awards page or in a user profile.


A DOM based XSS vulnerability has been identified in the Netstorage component of Open Enterprise Server (OES) allowing a remote attacker to execute javascript in the victims browser by tricking the victim into clicking on a specially crafted link. This affects OES versions OES2015SP1 OES2018 and OES2018SP1. Older versions may be affected but were not tested as they are out of support.


The ConfigurePortalPages.jspa resource in Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the searchOwnerUserName parameter.


A flaw was found in Moodle versions 3.6 to 3.6.1 3.5 to 3.5.3 3.4 to 3.4.6 3.1 to 3.1.15 and earlier unsupported versions. The 'manage groups' capability did not have the 'XSS risk' flag assigned to it but does have that access in certain places. Note that the capability is intended for use by trusted users and is only assigned to teachers and managers by default.


A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.


Cross Site Scripting (XSS) vulnerability in McAfee Network Security Manager (NSM) Prior to 9.1 Update 5 allows an authenticated administrator to embed an XSS in the administrator interface via a specially crafted custom rule containing HTML.


A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3 openshift-enterprise-3.4 through 3.7 and openshift-enterprise-3.9 through 3.11. An attacker could use this flaw to steal authorization data by getting them to click on a malicious link.


MyBB 1.8.19 has XSS in the resetpassword function.


All versions up to V1.19.20.02 of ZTE OTCP product are impacted by XSS vulnerability. Due to XSS when an attacker invokes the security management to obtain the resources of the specified operation code owned by a user the malicious script code could be transmitted in the parameter. If the front end does not process the returned result from the interface properly the malicious script may be executed and the user cookie or other important information may be stolen.


openQA

before

commit

was

vulnerable

to

XSS

in

the

distri

and

version

parameter.

This

was

reported

through

the

bug

bounty

program

of

Offensive

Security


A vulnerability was found in quay-2 where a stored XSS vulnerability has been found in the super user function of quay. Attackers are able to use the name field of service key to inject scripts and make it run when admin users try to change the name.


ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/method/ URI.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


In Support Incident Tracker (SiT!) 3.67 the id parameter is affected by XSS on all endpoints that use this parameter a related issue to CVE-2012-2235.


ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the addresses/ URI.


ilchCMS 2.1.23 allows XSS via the index.php/partner/index Banner parameter.


The CTHthemes CityBook before 2.3.4 TownHub before 1.0.6 and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat widget/page message form.


Certain

NETGEAR

devices

are

affected

by

reflected

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by stored XSS. This affects RBR50 before 2.3.5.30 RBS50 before 2.3.5.30 and RBK50 before 2.3.5.30.


In Nagios XI 5.6.9 XSS exists via the nocscreenapi.php host hostgroup or servicegroup parameter or the schedulereport.php hour or frequency parameter. Any authenticated user can attack the admin user.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


NETGEAR RAX40 devices before 1.0.3.62 are affected by stored XSS.


Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp username parameter.


NETGEAR WAC510 devices before 8.0.1.3 are affected by stored XSS.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before

NOTE:

this

may

be

a

result

of

an

incomplete

fix

for


An issue was discovered in WSO2 API Manager 2.6.0 WSO2 IS as Key Manager 5.7.0 and WSO2 Identity Server 5.8.0. If there is a claim dialect configured with an XSS payload in the dialect URI and a user picks up this dialect's URI and adds it as the service provider claim dialect while configuring the service provider that payload gets executed. The attacker also needs to have privileges to log in to the management console and to add and configure claim dialects.


ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the user/ URI as demonstrated by a crafted e-mail address.


An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via isTrustStore to Manage Store Contents.


On Netis DL4323 devices XSS exists via the urlFQDN parameter to form2url.cgi (aka the Keyword field of the URL Blocking Configuration).


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

reflected

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via alias to Manage Store Contents.


The Auth0 wp-auth0 plugin 3.11.x before 3.11.3 for WordPress allows XSS via a wle parameter associated with wp-login.php.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


On Netis DL4323 devices pingrtt_v6.html has XSS (Ping6 Diagnostic).


The FooGallery plugin 1.8.12 for WordPress allow XSS via the post_title parameter.


ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the project/ URI.


An issue was discovered in WSO2 API Manager 2.6.0 WSO2 IS as Key Manager 5.7.0 and WSO2 Identity Server 5.8.0. When a custom claim dialect with an XSS payload is configured in the identity provider basic claim configuration that payload gets executed if a user picks up that dialect's URI as the provisioning claim in the advanced claim configuration of the same Identity Provider. The attacker also needs to have privileges to log in to the management console and to add and update identity provider configurations.


** DISPUTED ** Bolt 3.7.0 if Symfony Web Profiler is used allows XSS because unsanitized search?search= input is shown on the _profiler page. NOTE: this is disputed because profiling was never intended for use in production. This is related to CVE-2018-12040.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Gila CMS before 1.11.6 allows CSRF with resultant XSS via the admin/themes URI leading to compromise of the admin account.


ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the api/ URI.


An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input malicious JavaScript can be executed throughout the application. A malicious payload can be injected within the Custom Workflow component and inserted via the Create New Workflow field. As a result the payload is executed via the navigation bar throughout the application.


In Support Incident Tracker (SiT!) 3.67 the Short Application Name and Application Name inputs in the config.php page are affected by XSS.


ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the address/ URI.


Feldtech easescreen Crystal 9.0 Web-Services 9.0.1.16265 allows Stored XSS via the Debug-Log and Display-Log components. This could be exploited when an attacker sends an crafted string for FTP authentication.


Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp driver parameter.


TopList before 2019-09-03 allows XSS via a title.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

and

before


NETGEAR R9000 devices before 1.0.4.26 are affected by stored XSS.


ServiceNow IT Service Management Kingston through Patch 14-1 London through Patch 7 and Madrid before patch 4 allow stored XSS via crafted sysparm_item_guid and sys_id parameters in an Incident Request to service_catalog.do.


ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php cs parameter.


An issue was discovered in the Readdle Documents app before 6.9.7 for iOS. The application's file-transfer web server improperly displays directory names leading to Stored XSS which may be used to steal a user's data. This requires user interaction because there is no known direct way for an attacker to create a crafted directory name on a victim's device. However a crafted directory name can occur if a victim extracts a ZIP archive that was provided by an attacker.


An issue was discovered in WSO2 API Manager 2.6.0. A reflected XSS attack could be performed in the inline API documentation editor page of the API Publisher by sending an HTTP GET request with a harmful docName request parameter.


cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).


Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0.


Certain NETGEAR devices are affected by stored XSS. This affects RBR50 before 2.3.5.30 RBS50 before 2.3.5.30 and RBK50 before 2.3.5.30.


An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via search to the Users/Group search page.


cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).


In PHP Scripts Mall advanced-real-estate-script 4.0.9 the search-results.php searchtext parameter is vulnerable to XSS.


On Netis DL4323 devices XSS exists via the form2userconfig.cgi username parameter (User Account Configuration).


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


ilchCMS 2.1.23 allows XSS via the index.php/partner/index Name parameter.


Open edX Ironwood.1 allows support/certificates?course_id= reflected XSS.


Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in Issue Navigator Basic Search. The affected versions are before version 7.13.9 and from version 8.0.0 before 8.4.2.


Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies.


ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the blog/ URI.


In Support Incident Tracker (SiT!) 3.67 the search_id parameter in the search_incidents_advanced.php page is affected by XSS.


The CTHthemes CityBook before 2.3.4 TownHub before 1.0.6 and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing Address Listing Latitude Listing Longitude Email Address Description Name Job or Position Description Service Name Address Latitude Longitude Phone Number or Website.


Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp serverURL parameter.


An issue was discovered in Viki Vera 4.9.1.26180. An attacker could set a user's last name to an XSS Payload and read another user's cookie and use that to login to the application.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

and

before


ilchCMS 2.1.23 allows XSS via the index.php/partner/index Link parameter.


An XSS issue was discovered in TreasuryXpress 19191105. Due to the lack of filtering and sanitization of user input malicious JavaScript can be executed by the application's administrator(s). A malicious payload can be injected within the Multi Approval security component and inserted via the Note field. As a result the payload is executed by the application's administrator(s).


Open edX Ironwood.1 allows support/certificates?user= reflected XSS.


The attachment-uploading feature in Atlassian Confluence Server from version 6.14.0 through version 6.14.3 and version 6.15.0 before version 6.15.5 allows remote attackers to achieve stored cross-site- scripting (SXSS) via a malicious attachment with a modified `mimeType` parameter.


TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the index.php reqURI parameter. NOTE: this issue exists because of an incomplete fix for CVE-2019-19491.


An issue was discovered on NETGEAR WNR1000V4 1.1.0.54 devices. Multiple pages (setup.cgi and adv_index.htm) within the web management console are vulnerable to stored XSS as demonstrated by the configuration of the UI language.


Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).


ERPNext 11.1.47 allows reflected XSS via the PATH_INFO to the contact/ URI.


In Support Incident Tracker (SiT!) 3.67 Load Plugins input in the config.php page is affected by XSS. The XSS payload is for example executed on the about.php page.


The CTHthemes CityBook before 2.3.4 TownHub before 1.0.6 and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search query.


Certain NETGEAR devices are affected by stored XSS. This affects RBR50 before 2.3.5.30 RBS50 before 2.3.5.30 and RBK50 before 2.3.5.30.


Ignite Realtime Openfire 4.4.1 allows XSS via the setup/setup-datasource-standard.jsp password parameter.


An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configuration/general settings page. A remote attacker can inject arbitrary JavaScript code in the vlanguage_switch parameter (within multipart/form-data) which is reflected back within a user's browser without proper output encoding.


An XSS issue was discovered in the Laborator Neon theme 2.0 for WordPress via the data/autosuggest-remote.php q parameter.


The Postie plugin 1.9.40 for WordPress allows XSS as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SVG element.


ganglia-web (aka Ganglia Web Frontend) through 3.7.5 allows XSS via the header.php ce parameter.


On Netis DL4323 devices XSS exists via the form2Ddns.cgi username parameter (DynDns settings of the Dynamic DNS Configuration).


Gila CMS before 1.11.6 has reflected XSS via the admin/content/postcategory id parameter which is mishandled for g_preview_theme.


The awesome-support plugin 5.8.0 for WordPress allows XSS via the post_title parameter.


Auth0 Lock before 11.21.0 allows XSS when additionalSignUpFields is used with an untrusted placeholder.


An XSS issue was discovered in Ignite Realtime Openfire 4.4.4 via cacheName to SystemCacheDetails.jsp.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

and

before


In Archery before 1.3 inserting an XSS payload into a project name (either by creating a new project or editing an existing one) will result in stored XSS on the vulnerability-scan scheduling page.


On Netis DL4323 devices XSS exists via the form2Ddns.cgi hostname parameter (Dynamic DNS Configuration).


XSS

exists

in

SAMSUNG

SyncThru

Web

Service

in

\/sws/leftmenu.sws\

in

multiple

parameters:


An issue was discovered in PHP Scripts Mall API Based Travel Booking 3.4.7. There is Reflected XSS via the flight-results.php d2 parameter.


Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'events' (events.php) insecurely displays the limit parameter value without applying any proper output filtration. This issue exists because of the function sortHeader() in functions.php which insecurely returns the value of the limit query string parameter without applying any filtration.


An issue was discovered in Joomla! before 3.9.3. Inadequate filtering on URL fields in various core components could lead to an XSS vulnerability.


XSS exists in Enphase Envoy R3.*.* via the profileName parameter to the /home URI on TCP port 8888.


A stored-self XSS exists in Croogo through v3.0.5 allowing an attacker to execute HTML or JavaScript code in a vulnerable Title field to /admin/taxonomy/vocabularies.


CentOS-WebPanel.com (aka CWP) CentOS Web Panel through 0.9.8.763 is vulnerable to Stored/Persistent XSS for the \Package Name\ field via the add_package module parameter.


An issue was discovered in Joomla! before 3.9.3. Inadequate parameter handling in JavaScript code (core.js writeDynaList) could lead to an XSS attack vector.


Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitorV4LCapturesPerFrame' parameter value in the view monitor (monitor.php) because proper filtration is omitted.


A stored-self XSS exists in Croogo through v3.0.5 allowing an attacker to execute HTML or JavaScript code in a vulnerable Blog field to /admin/nodes/nodes/add/blog.


Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'options' (options.php) does no input validation for the WEB_TITLE HOME_URL HOME_CONTENT or WEB_CONSOLE_BANNER value allowing an attacker to execute HTML or JavaScript code. This relates to functions.php.


cgi-bin/qcmap_web_cgi on JioFi 4G M2S 1.0.2 devices has XSS and HTML injection via the mask POST parameter.


XSS

exists

in

SAMSUNG

SyncThru

Web

Service

in

\/sws.application/information/networkinformationView.sws\

in

the

tabName

parameter.


_includes\\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists.


Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitorLinkedMonitors' parameter value in the view monitor (monitor.php) because proper filtration is omitted.


SUAP V2 allows XSS during the update of user information.


XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone \/netflow/jspui/index.jsp\ file in the view GET parameter or any of these POST parameters: autorefTime section snapshot viewOpt viewAll view or groupSelName. The latter is related to CVE-2009-3903.


X-Cart V5 is vulnerable to XSS via the CategoryFilter2 parameter.


Reflected XSS exists in ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code in the view 'filter' as it insecurely prints the 'filterName' (aka Filter name) value on the web page without applying any proper filtration.


SmarterTools SmarterMail 16.x before build 6995 has stored XSS. JavaScript code could be executed on the application by opening a malicious email or when viewing a malicious file attachment.


XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in \/sws.login/gnb/loginView.sws\ in multiple parameters: contextpath and basedURL.


Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Host' parameter value in the view console (console.php) because proper filtration is omitted. This relates to the index.php?view=monitor Host Name field.


There

is

stored

cross

site

scripting

(XSS)

in

Galileo

CMS

Remote

authenticated

users

could

inject

arbitrary

web

script

or

HTML

via

in

(aka

the

PAGE

TITLE

Field).


Axios Italia Axios RE 1.7.0/7.0.0 devices have XSS via the RELogOff.aspx Error_Parameters parameter. In some situations the XSS would be on the family.axioscloud.it cloud service; however the vendor also supports \Sissi in Rete (con server)\ for offline operation.


POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filterQueryterms0val' parameter value in the view filter (filter.php) because proper filtration is omitted.


XSS

exists

in

Zoho

ManageEngine

Netflow

Analyzer

Professional

in

the

Administration

zone

\/netflow/jspui/linkdownalertConfig.jsp\

file

in

the

task

parameter.


Rukovoditel through 2.4.1 allows XSS via a URL that lacks a module=users%2flogin substring.


XSS exists in SAMSUNG X7400GX SyncThru Web Service V6.A6.25 V11.01.05.25_08-21-2015 in \/sws/swsAlert.sws\ in multiple parameters: flag frame func and Nfunc.


Rukovoditel before 2.4.1 allows XSS.


Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view _monitor_filters.php contains takes in input from the user and saves it into the session and retrieves it later (insecurely). The values of the MonitorName and Source parameters are being displayed without any output filtration being applied. This relates to the view=cycle value.


typora through 0.9.64 has XSS with resultant remote command execution during inline rendering of a mathematical formula.


cgi-bin/qcmap_web_cgi on JioFi 4 jmr1140 Amtel_JMR1140_R12.07 devices has POST based reflected XSS via the Page parameter. No sanitization is performed for user input data.


An issue was discovered in Joomla! before 3.9.3. Inadequate checks at the Global Configuration helpurl settings allowed stored XSS.


Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code via a vulnerable 'eid' (aka Event ID) parameter value in the view download (download.php) because proper filtration is omitted.


Cantemo Portal before 3.2.13 3.3.x before 3.3.8 and 3.4.x before 3.4.9 has XSS. Leveraging this vulnerability would enable performing actions as users including administrative users. This could enable account creation and deletion as well as deletion of information contained within the app.


XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone \/netflow/jspui/editProfile.jsp\ file in the userName parameter.


An issue was discovered in SIDU 6.0. Because the database name is not strictly filtered the attacker can insert a name containing an XSS Payload leading to stored XSS.


app/Core/Paginator.php in Kanboard before 1.2.8 has XSS in pagination sorting.


Self - Stored XSS exists in ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code in the view 'group' as it insecurely prints the 'Group Name' value on the web page without applying any proper filtration.


Wowza

Streaming

Engine

and

earlier

from

multiple

authenticated

XSS

vulnerabilities

via

the

field

in

of

the

Server

Setup

configuration

or

the

host

field

in

of

the

login

form.

This

issue

was

resolved

in

Wowza

Streaming

Engine


XSS and/or a Client Side URL Redirect exists in OpenText Documentum Webtop 5.3 SP2. The parameter startat in \/webtop/help/en/default.htm\ is vulnerable.


XSS

exists

in

Zoho

ManageEngine

Netflow

Analyzer

Professional

in

the

Administration

zone

file

in

the

autorefTime

or

graphTypes

parameter.


Subrion CMS v4.2.1 allows XSS via the panel/phrases/ VALUE parameter.


An issue was discovered in the Cross Reference Add-on 36 for Google Docs. Stored XSS in the preview boxes in the configuration panel may allow a malicious user to use both label text and references text to inject arbitrary JavaScript code (via SCRIPT elements event handlers etc.). Since this code is stored by the plugin the attacker may be able to target anyone who opens the configuration panel of the plugin.


An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. This can be exploited via CSRF.


Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code via a vulnerable 'scale' parameter value in the view frame (frame.php) via /js/frame.js.php because proper filtration is omitted.


Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the view 'state' (aka Run State) (state.php) does no input validation to the value supplied to the 'New State' (aka newState) field allowing an attacker to execute HTML or JavaScript code.


PHP Scripts Mall Chartered Accountant : Auditor Website 2.0.1 has Stored XSS in the Profile Update page via the My Name field.


Self - Stored XSS exists in ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code in the view 'log' as it insecurely prints the 'Log Message' value on the web page without applying any proper filtration. This relates to the view=logs value.


An issue was discovered in Waimai Super Cms 20150505. admin.php?m=Member&a=adminaddsave has XSS via the username or password parameter.


Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 as the form action on multiple views utilizes $_SERVER'PHP_SELF' insecurely mishandling any arbitrary input appended to the webroot URL without any proper filtration leading to XSS.


typora through 0.9.63 has XSS with resultant remote command execution during block rendering of a mathematical formula.


An issue was discovered in Joomla! before 3.9.3. A combination of specific web server configurations in connection with specific file types and browser-side MIME-type sniffing causes an XSS attack vector.


Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 while editing an existing monitor field named \signal check color\ (monitor.php). There exists no input validation or output filtration leaving it vulnerable to HTML Injection and an XSS attack.


An issue was discovered in PHP Scripts Mall Investment MLM Software 2.0.2. Stored XSS was found in the the My Profile Section. This is due to lack of sanitization in the Edit Name section.


InvoicePlane 1.5 has stored XSS via the index.php/invoices/ajax/save invoice_password parameter aka the \PDF password\ field to the \Create Invoice\ option. The XSS payload is rendered at an index.php/invoices/view/## URI. NOTE: this is different from CVE-2018-12255.


XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone \/netflow/jspui/addMailSettings.jsp\ file in the gF parameter.


In the Parallax Scroll (aka adamrob-parallax-scroll) plugin before 2.1 for WordPress includes/adamrob-parralax-shortcode.php allows XSS via the title text. (\parallax\ has a spelling change within the PHP filename.)


Reflected - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3 allowing an attacker to execute HTML or JavaScript code via a vulnerable 'newMonitorMethod' parameter value in the view monitor (monitor.php) because proper filtration is omitted.


XSS exists in Ericsson Active Library Explorer (ALEX) 14.3 in multiple parameters in the \/cgi-bin/alexserv\ servlet as demonstrated by the DB FN fn or id parameter.


XSS

exists

in

Zoho

ManageEngine

Netflow

Analyzer

Professional

in

the

Administration

zone

\/netflow/jspui/linkdownalertConfig.jsp\

file

in

the

groupDesc

groupName

groupID

or

task

parameter.


invenio-communities before 1.0.0a20 allows XSS.


invenio-previewer before 1.0.0a12 allows XSS.


stacktable.js

before

allows

XSS.


Dependency-Track before 3.5.1 allows XSS.


invenio-records before 1.2.2 allows XSS.


Parallels Plesk Panel 9.5 allows XSS in target/locales/tr-TR/help/index.htm? via the \fileName\ parameter.


Sourcecodester Restaurant Management System 1.0 allows XSS via the Last Name field of a member.


XSS exists in Lavalite CMS 5.7 via the admin/profile name or designation field.


When logged in as an admin user the Title input field (under Reports) within Untangle NG firewall 14.2.0 is vulnerable to stored XSS.


XSS in the Video Downloader component before 1.5 of Avast Secure Browser 77.1.1831.91 and AVG Secure Browser 77.0.1790.77 allows websites to execute their code in the context of this component. While Video Downloader is technically a browser extension it is granted a very wide set of privileges and can for example access cookies and browsing history spy on the user while they are surfing the web and alter their surfing experience in almost arbitrary ways.


The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019.


An issue was discovered in GitLab Community and Enterprise Edition 10.5 through 12.4 in link validation for RDoc wiki pages feature. It has XSS.


In Advantech Spectre RT Industrial Routers ERT351 5.1.3 and prior the affected product does not neutralize special characters in the error response allowing attackers to use a reflected XSS attack.


Systematic IRIS Standards Management (ISM) v2.1 SP1 89 is vulnerable to unauthenticated reflected Cross Site Scripting (XSS). A user input (related to dialog information) is reflected directly in the web page allowing a malicious user to conduct a Cross Site Scripting attack against users of the application.


WSO2 IS as Key Manager 5.7.0 allows stored XSS in download-userinfo.jag because Content-Type is mishandled.


A stored XSS issue was discovered in DAViCal through 1.1.8. It does not adequately sanitize output of various fields that can be set by unprivileged users making it possible for JavaScript stored in those fields to be executed by another (possibly privileged) user. Affected database fields include Username Display Name and Email.


ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the (1) User Edit or (2) User Add form (3) name field in the Role Add form (4) name or number field in the Edit Group form (5) tagKey or tagValue field in the Recording Rules Configuration or (6) txt_69735:/VemailAddress/value or txt_75767:/VemailFrom/value field in callrec/config.


When logged in as an admin user the Untangle NG firewall 14.2.0 is vulnerable to reflected XSS at multiple places and specific user input fields.


In TypeStack class-validator 0.10.2 validate() input validation can be bypassed because certain internal attributes can be overwritten via a conflicting name. Even though there is an optional forbidUnknownValues parameter that can be used to reduce the risk of this bypass this option is not documented and thus most developers configure input validation in the vulnerable default manner. With this vulnerability attackers can launch SQL Injection or XSS attacks by injecting arbitrary malicious input. NOTE: a software maintainer agrees with the \is not documented\ finding but suggests that much of the responsibility for the risk lies in a different product.


in

the

package

before

for

pfSense

on

FreeBSD

allows

a

user

with

an

XSS

payload

as

password

or

username

to

execute

arbitrary

javascript

code

on

a

victim

browser.


Sourcecodester Restaurant Management System 1.0 allows XSS via the \send a message\ screen.


A DOM based XSS vulnerability has been identified on the WatchGuard XMT515 through 12.1.3 allowing a remote attacker to execute JavaScript in the victim's browser by tricking the victim into clicking on a crafted link. The payload was tested in Microsoft Internet Explorer 11.418.18362.0 and Microsoft Edge 44.18362.387.0 (Microsoft EdgeHTML 18.18362).


A reflected XSS issue was discovered in DAViCal through 1.1.8. It echoes the action parameter without encoding. If a user visits an attacker-supplied link the attacker can view all data the attacked user can view as well as perform all actions in the name of the user. If the user is an administrator the attacker can for example add a new admin user to gain full access to the application.


CoreHR Core Portal before 27.0.7 allows stored XSS.


Persistent XSS in /course/modedit.php of Moodle through 3.7.2 allows authenticated users (Teacher and above) to inject JavaScript into the session of another user (e.g. enrolled student or site administrator) via the introeditortext parameter. NOTE: the discoverer and vendor disagree on whether Moodle customers have a reasonable expectation that anyone authenticated as a Teacher can be trusted with the ability to add arbitrary JavaScript (this ability is not documented on Moodle's Teacher_role page). Because the vendor has this expectation they have stated \this report has been closed as a false positive and not a bug.\


Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploited to expose session credentials and other information via the users web browser.


WSO2 IS as Key Manager 5.7.0 allows unauthenticated reflected XSS in the dashboard user profile.


Digi AnywhereUSB 14 allows XSS via a link for the Digi Page.


po-admin/route.php?mod=post&act=edit

in

PopojiCMS

allows

stored

XSS.


templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL as demonstrated by Internet Explorer.


In Ant Design Pro 4.0.0 reflected XSS in the user/login redirect GET parameter affects the authorization component leading to execution of JavaScript code in the login after-action script.


Microstrategy Library in MicroStrategy before 2019 before 11.1.3 has reflected XSS.


Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting (XSS) vulnerability as it fails to validate user input. The affected components (index.php upgrade.php) allow for JavaScript injection within both GET or POST requests via a crafted URL or via the UpgradeMode POST parameter.


oauth/oauth2/v1/saml/ in Abacus OAuth Login 2019_01_r4_20191021_0000 before prior to R4 (20.11.2019 Hotfix) allows Reflected Cross Site Scripting (XSS) via an error message.


An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/add_user/UID allows stored XSS via the author parameter.


The ListingPro theme before v2.0.14.2 for WordPress has Reflected XSS via the What field on the homepage.


The CSS Hero plugin through 4.0.3 for WordPress is prone to reflected XSS via the URI in a csshero_action=edit_page request because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary JavaScript in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookies or launch other attacks.


The Work Time Calendar app before 4.7.1 for Jira allows XSS.


The

Redirects

Easy

Redirect

Manager\

plugin

before

for

WordPress

allows

users

(with

subscriber

or

greater

access)

to

modify

delete

or

inject

redirect

rules

and

exploit

XSS

with

the

/admin-ajax.php?action=eps_redirect_save

and

/admin-ajax.php?action=eps_redirect_delete

actions.

This

could

result

in

a

loss

of

site

availability

malicious

redirects

and

user

infections.

This

could

also

be

exploited

via

CSRF.


domain/section/markdown/markdown.go in Documize before 3.5.1 mishandles untrusted Markdown content. This was addressed by adding the bluemonday HTML sanitizer to defend against XSS.


Dolibarr ERP/CRM before 10.0.3 allows XSS because uploaded HTML documents are served as text/html despite being renamed to .noexe files.


The wpForo plugin 1.6.5 for WordPress allows XSS involving the wpf-dw-td-value class of dashboard.php.


IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects.


Alfresco Enterprise before 5.2.5 allows stored XSS via an uploaded HTML document.


Multiple XSS vulnerabilities exist in the Backup & Restore module \\ v14.0.10.2 through v14.0.10.7 for FreePBX as shown at /admin/config.php?display=backup on the FreePBX Administrator web site. An attacker can modify the id parameter of the backup configuration screen and embed malicious XSS code via a link. When another user (such as an admin) clicks the link the XSS payload will render and execute in the context of the victim user's account.


A Reflected XSS was found in the server selection box inside the login page at: enginemanager/loginfailed.html in Wowza Streaming Engine <= 4.x.x. This issue was resolved in Wowza Streaming Engine 4.8.0.


The Zoho CRM Lead Magnet plugin 1.6.9.1 for WordPress allows XSS via module EditShortcode or LayoutName.


nopCommerce

through

allows

XSS

in

the

SaveStoreMappings

of

the

components

and

via

Body

or

Full

to

Admin/News/NewsItemEdit/id

Admin/Blog/BlogPostEdit/id.

NOTE:

the

vendor

reportedly

considers

this

a

\feature\

because

the

affected

components

are

an

HTML

content

editor.


An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. It does not use CSRF Tokens to mitigate against CSRF; it uses the Origin header (which must match the request origin). This is problematic in conjunction with XSS: one can escalate privileges from User level to Administrator.


Atos Unify OpenScape UC Application V9 before version V9 R4.31.0 and V10 before version V10 R0.6.0 allows XSS. An attacker could exploit this by convincing an authenticated user to inject arbitrary JavaScript code in the Profile Name field. A browser would execute this stored XSS payload.


An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying certain block descriptions created by administrators. An attacker could potentially craft a specialized description then have an administrator execute scripting when configuring a layout aka XSS. This issue is mitigated by the fact that the attacker would be required to have the permission to create custom blocks which is typically an administrative task.


The Search parameter of the Software Catalogue section of Matrix42 Workspace Management 9.1.2.2765 and below accepts unfiltered parameters that lead to multiple reflected XSS issues.


In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX XSS exists in the User Management screen of the Administrator web site. An attacker with access to the User Control Panel application can submit malicious values in some of the time/date formatting and time-zone fields. These fields are not being properly sanitized. If this is done and a user (such as an admin) visits the User Management screen and views that user's profile the XSS payload will render and execute in the context of the victim user's account.


MDaemon Email Server 17.5.1 allows XSS via the filename of an attachment to an email message.


SALTO ProAccess SPACE 5.4.3.0 allows XSS.


The Scoutnet Kalender plugin 1.1.0 for WordPress allows XSS.


SCEditor 2.1.3 allows XSS.


Froala Editor before 3.2.3 allows XSS.


An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13 14 and 15 within the Debug/Test page of the Superfecta module at the admin/config.php?display=superfecta URI. This affects Superfecta through 13.0.4.7 14.x through 14.0.24 and 15.x through 15.0.2.20.


Kentico before 12.0.50 allows file uploads in which the Content-Type header is inconsistent with the file extension leading to XSS.


Northern.tech

CFEngine

Enterprise

before

and

before

and

allows

XSS.

This

is

fixed

in

and


An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. admin/list_user allows stored XSS via the auth_type parameter.


Wowza Streaming Engine before 4.8.5 allows XSS (issue 1 of 2). An authenticated user with access to the proxy license editing is able to insert a malicious payload that will be triggered in the main page of server settings. This issue was resolved in Wowza Streaming Engine 4.8.5.


An issue was discovered in Backdrop CMS 1.13.x before 1.13.5 and 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying content type names in the content creation interface. An attacker could potentially craft a specialized content type name then have an editor execute scripting when creating content aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the \Administer content types\ permission.


The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Best Day/Night field on the new listing submit page.


_get_all_file_server_paths.ajax.php (aka get_all_file_server_paths.ajax.php) in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the fileIds parameter on the page which would allow an attacker to input HTML or execute scripts on the site aka XSS.


phpMyChat-Plus 1.98 is vulnerable to reflected XSS via JavaScript injection into the password reset URL. In the URL the pmc_username parameter to pass_reset.php is vulnerable.


Dolibarr ERP/CRM before 10.0.3 has an Insufficient Filtering issue that can lead to user/card.php XSS.


The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles certain HTML attributes as demonstrated by IMG onmouseover= (impact is XSS) and IMG src=http (impact is disclosing the client's IP address). This can occur within a talk page topical header that is viewed within a mobile (MobileFrontend) context.


The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter.


The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.


IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts.


Matrix42 Workspace Management 9.1.2.2765 and below allows stored XSS via unfiltered description parameters as demonstrated by the comment field of a special order for individual software.


KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js as demonstrated by view.html?q= with a '\sampling\:{\value\:\<script>' substring.


An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. An admin can change their password without providing the current password by using interfaces outside the Change Password screen. Thus requiring the admin to enter an Old Password value on the Change Password screen does not enhance security. This is problematic in conjunction with XSS.


A HTTP Response Splitting vulnerability was identified in the Web Settings Component of Web File Manager in Rumpus FTP Server 8.2.9.1. A successful exploit can result in stored XSS website defacement etc. via ExtraHTTPHeader to RAPR/WebSettingsGeneralSet.html.


Symantec Endpoint Detection and Response (SEDR) prior to 4.3.0 may be susceptible to a cross site scripting (XSS) issue. XSS is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users. An XSS vulnerability may be used by attackers to potentially bypass access controls such as the same-origin policy.


The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based tokens or to launch other attacks.


In \Xray Test Management for Jira\ prior to version 3.5.5 remote authenticated attackers can cause XSS in the generic field entry point via the Generic Test Definition field of a new Generic Test issue.


Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP address as a domain entry in the DNS service of the router via crafted hostnames in DHCP requests causing XSS.


A Stored XSS issue in the D-Link DSL-2680 web administration interface (Firmware EU_1.03) allows an authenticated attacker to inject arbitrary JavaScript code into the info.html administration page by sending a crafted Forms/wireless_autonetwork_1 POST request.


PandoraFMS 742 suffers from multiple XSS vulnerabilities affecting the Agent Management Report Builder and Graph Builder components. An authenticated user can inject dangerous content into a data store that is later read and included in dynamic content.


Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in basic repeater settings via an SSID.


In WSO2 Enterprise Integrator 6.5.0 reflected XSS occurs when updating the message processor configuration from the source view in the Management Console.


Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.


The ListingPro theme before v2.0.14.2 for WordPress has Persistent XSS via the Good For field on the new listing submit page.


An issue was discovered in Big Switch Big Monitoring Fabric 6.2 through 6.2.4 6.3 through 6.3.9 7.0 through 7.0.3 and 7.1 through 7.1.3; Big Cloud Fabric 4.5 through 4.5.5 4.7 through 4.7.7 5.0 through 5.0.1 and 5.1 through 5.1.4; and Multi-Cloud Director through 1.1.0. An unauthenticated attacker may inject stored arbitrary JavaScript (XSS) and execute it in the content of authenticated administrators.


In \Xray Test Management for Jira\ prior to version 3.5.5 remote authenticated attackers can cause XSS in the Pre-Condition Summary entry point via the summary field of a Create Pre-Condition action for a new Test Issue.


Ayision Ays-WR01 v28K.RPT.20161224 devices allow stored XSS in wireless settings.


For ABB eSOMS versions 4.0 to 6.0.2 the X-XSS-Protection HTTP response header is not set in responses from the web server. For older web browser not supporting Content Security Policy this might increase the risk of Cross Site Scripting.


In Intland codeBeamer ALM 9.5 and earlier there is stored XSS via the Trackers Title parameter.


Dolibarr ERP/CRM 3.0 through 10.0.3 allows XSS via the qty parameter to product/fournisseurs.php (product price screen).


A Cookie based reflected XSS exists in the Web File Manager of Rumpus FTP Server 8.2.9.1 related to RumpusLoginUserName and snp.


The Web application on Rittal CMC PU III 7030.000 V3.00 V3.11.00_2 to V3.15.70_4 devices fails to sanitize user input on the system configurations page. This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts) as the content is always displayed after and before login. Persistent XSS allows an attacker to modify displayed content or to change the victim's information. Successful exploitation requires access to the web management interface either with valid credentials or a hijacked session.


The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter.


log_file_viewer.php in MFScripts YetiShare 3.5.2 through 4.5.3 does not sanitize or encode the output from the lFile parameter on the page which would allow an attacker to input HTML or execute scripts on the site aka XSS.


In userman 13.0.76.43 through 15.0.20 in Sangoma FreePBX XSS exists in the user management screen of the Administrator web site i.e. the/admin/config.php?display=userman URI. An attacker with sufficient privileges can edit the Display Name of a user and embed malicious XSS code. When another user (such as an admin) visits the main User Management screen the XSS payload will render and execute in the context of the victim user's account.


In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 when mathematical expressions in results are displayed directly arbitrary JavaScript execution can occur aka XSS. This was addressed by introducing MathJax as a new mathematics rendering engine. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots such as 0.3.6-SNAPSHOT.


Dolibarr CRM/ERP 10.0.3 allows viewimage.php?file= Stored XSS due to JavaScript execution in an SVG image for a profile picture.


An XSS Injection vulnerability exists in Sangoma FreePBX and PBXact 13 14 and 15 within the Call Event Logging report screen in the cel module at the admin/config.php?display=cel URI via date fields. This affects cel through 13.0.26.9 14.x through 14.0.2.14 and 15.x through 15.0.15.4.


Post-authentication Stored XSS in Team Password Manager through 7.93.204 allows attackers to steal other users' credentials by creating a shared password with HTML code as the title.


An issue was discovered in Serpico (aka SimplE RePort wrIting and CollaboratiOn tool) 1.3.0. The User Type on the admin/list_user page allows stored XSS via the type parameter.


GitBook through 2.6.9 allows XSS via a local .md file.


An issue was discovered in Backdrop CMS 1.14.x before 1.14.2. It doesn't sufficiently filter output when displaying file type descriptions created by administrators. An attacker could potentially craft a specialized description then have an administrator execute scripting when viewing the list of file types aka XSS. This vulnerability is mitigated by the fact that an attacker must have a role with the \Administer file types\ permission.


An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page aka XSS.


The web interface of the D-Link DVA-5592 20180823 is vulnerable to XSS because HTML form parameters are directly reflected.


HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419) HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server potentially vulnerable to stored XSS in wireless configuration page


It has been reported that XSS is possible in Forcepoint Email Security versions 8.5 and 8.5.3. It is strongly recommended that you apply the relevant hotfix in order to remediate this issue.


PHP Scripts Mall Citysearch / Hotfrog / Gelbeseiten Clone Script 2.0.1 has Reflected XSS via the srch parameter as demonstrated by restaurants-details.php.


An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in com_contact leads to a stored XSS vulnerability.


An issue was discovered in Joomla! before 3.9.2. Inadequate escaping in mod_banners leads to a stored XSS vulnerability.


An issue was discovered in the User IP History Logs (aka IP_History_Logs) plugin 1.0.2 for MyBB. There is XSS via the admin/modules/tools/ip_history_logs.php useragent field.


XSS exists in JPress v1.0.4 via Markdown input or Markdown input with the code input option.


An issue was discovered in ZoneMinder v1.32.3. Reflected XSS exists in web/skins/classic/views/plugin.php via the zm/index.php?view=plugin pl parameter.


An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation and output encoding that results in a persistent XSS.


In Liferay Portal before 7.1 CE GA4 an XSS vulnerability exists in the SimpleCaptcha API when custom code passes unsanitized input into the \url\ parameter of the JSP taglib call <liferay-ui:captcha url=\<%= url %>\ /> or <liferay-captcha:captcha url=\<%= url %>\ />. Liferay Portal out-of-the-box behavior with no customizations is not vulnerable.


typora through 0.9.9.20.3 beta has XSS with resultant remote command execution via the left outline bar.


An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8 11.6.x before 11.6.6 and 11.7.x before 11.7.1. It allows XSS (issue 1 of 2). Markdown fields contain a lack of input validation and output encoding when processing KaTeX that results in a persistent XSS.


An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration helpurl settings allowed stored XSS.


HP Color LaserJet Pro M280-M281 Multifunction Printer series (before v. 20190419) HP LaserJet Pro MFP M28-M31 Printer series (before v. 20190426) may have an embedded web server potentially vulnerable to reflected XSS in wireless configuration page.


Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).


On BIG-IP 14.0.0-14.0.0.2 13.0.0-13.1.1.3 12.1.0-12.1.3.7 and 11.6.0-11.6.3.2 a reflected Cross Site Scripting (XSS) vulnerability is present in an undisclosed page of the BIG-IP TMUI (Traffic Management User Interface) also known as the BIG-IP configuration utility.


CRLF Injection in pypiserver 1.2.5 and below allows attackers to set arbitrary HTTP headers and possibly conduct XSS attacks via a %0d%0a in a URI.


The Premium WP Suite Easy Redirect Manager plugin 28.07-17 for WordPress has XSS via a crafted GET request that is mishandled during log viewing at the templates/admin/redirect-log.php URI.


An issue was discovered in Joomla! before 3.9.2. Inadequate checks of the Global Configuration Text Filter settings allowed stored XSS.


The wpape APE GALLERY plugin 1.6.14 for WordPress has stored XSS via the classGallery.php getCategories function.


An issue was discovered in YUNUCMS V1.1.8. app/index/controller/Show.php has an XSS vulnerability via the index.php/index/show/index cw parameter.


A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.2.0 to 5.6.10 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the \param\ parameter of the error process HTTP requests.


An input validation and output encoding issue was discovered in the GitLab email notification feature which could result in a persistent XSS. This was addressed in GitLab 12.1.2 12.0.4 and 11.11.6.


XSS in buttle npm package version 0.2.0 causes execution of attacker-provided code in the victim's browser when an attacker creates an arbitrary file on the server.


Some web components in the ArubaOS software are vulnerable to HTTP Response splitting (CRLF injection) and Reflected XSS. An attacker would be able to accomplish this by sending certain URL parameters that would trigger this vulnerability.


A potential security vulnerability has been identified in HP2910al-48G version W.15.14.0016. The attack exploits an xss injection by setting the attack vector in one of the switch persistent configuration fields (management URL location contact). But admin privileges are required to configure these fields thereby reducing the likelihood of exploit. HPE Aruba has provided firmware updates to resolve the vulnerability in HP 2910-48G al Switch. Please update to W.15.14.0017.


An input validation and output encoding issue was discovered in the GitLab CE/EE wiki pages feature which could result in a persistent XSS. This vulnerability was addressed in 12.1.2 12.0.4 and 11.11.6.


Multiple XSS vulnerabilities were discovered in OverIT Geocall 6.3 before build 2:346977.


A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4 under SSL VPN web portal may allow an attacker to execute unauthorized malicious script code via the \err\ parameter of the error process HTTP requests.


There is a reflection XSS vulnerability in the HedEx products. Remote attackers send malicious links to users and trick users to click. Successfully exploit cloud allow the attacker to initiate XSS attacks. Affects HedEx Lite versions earlier than V200R006C00SPC007.


Splunk

Web

in

Splunk

Enterprise

before

before

before

before

before

and

before

and

Splunk

Light

before

has

Persistent

XSS

aka


In MiniCMS V1.10 stored XSS was found in mc-admin/page-edit.php (content box) which can be used to get a user's cookie.


The Opera Mini application through 16.0.14 for iOS has a UXSS vulnerability that can be triggered by performing navigation to a javascript: URL.


phpBB version 3.2.7 allows the stealing of an Administration Control Panel session id by leveraging CSRF in the Remote Avatar feature. The CSRF Token Hijacking leads to stored XSS


** DISPUTED ** Firefly III before 4.7.17.1 is vulnerable to stored XSS due to lack of filtration of user-supplied data in a budget name. The JavaScript code is contained in a transaction and is executed on the tags/show/$tag_number$ tag summary page. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability.


A XSS found in Advan VD-1 firmware versions up to 230. VD-1 responses a path error message when a requested resource was not found in page cgibin/ssi.cgi. It leads to a reflected XSS because the error message does not escape properly.


Because of a lack of sanitization around error messages multiple Reflective XSS issues exist in iTop through 2.6.0 via the param_file parameter to webservices/export.php webservices/cron.php or env-production/itop-backup/backup.php. By default any XSS sent to the administrator can be transformed to remote command execution because of CVE-2018-10642 (still working through 2.6.0) The Reflective XSS can also become a stored XSS within the same account because of another vulnerability.


The Appointment Hour Booking plugin 1.1.44 for WordPress allows XSS via the E-mail field as demonstrated by email_1.


SyGuestBook A5 Version 1.2 allows stored XSS because the isValidData function in include/functions.php does not properly block XSS payloads as demonstrated by a crafted use of the onerror attribute of an IMG element.


Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the title field in the /common/ticket_associated_tickets.php service desk ticket functionality) that allows an authenticated user to execute arbitrary JavaScript in a service desk user's browser.


A stored XSS vulnerability in the Agent/Center component of CyberPower PowerPanel Business Edition 3.4.0 allows a privileged attacker to embed malicious JavaScript in the SNMP trap receivers form. Upon visiting the /agent/action_recipient Event Action/Recipient page the embedded code will be executed in the browser of the victim.


Unauthenticated Stored XSS in osTicket 1.10.1 allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via arbitrary file extension while creating a support ticket.


index.php?c=admin&a=index in SyGuestBook A5 Version 1.2 has stored XSS via a reply to a comment.


An issue was discovered in Sertek Xpare 3.67. The login form does not sanitize input data. Because of this a malicious agent could exploit the vulnerable function in order to prepare an XSS payload to send to the product's clients.


in

Piwigo

has

XSS

via

the

or

parameter.

This

is

exploitable

via

CSRF.


** DISPUTED ** Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript code is executed during attachments/edit/$file_id$ attachment editing. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability.


In system/workplace/ in Alkacon OpenCms 10.5.4 and 10.5.5 there are multiple Reflected and Stored XSS issues in the management interface.


D-Link

C

devices

before

allow

XSS

as

demonstrated

by

the

parameter

the

parameter

and

the

parameter.


Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via an SVG image and HTML file) that allows an authenticated user to execute arbitrary JavaScript in an administrator's browser.


In MiniCMS V1.10 stored XSS was found in mc-admin/post-edit.php via the tags box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296 CVE-2018-16233 and CVE-2018-20520.


Multiple Stored XSS vulnerabilities were found in the Xerox Web Application used by the Phaser 3320 V53.006.16.000 and other printers. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions.


In MyT 1.5.1 the Userusername parameter has XSS.


In antSword before 2.1.0 self-XSS in the database configuration leads to code execution via modules/database/asp/index.js modules/database/custom/index.js modules/database/index.js or modules/database/php/index.js.


Blinger.io v.1.0.2519 is vulnerable to Blind/Persistent XSS. An attacker can send arbitrary JavaScript code via a built-in communication channel such as Telegram WhatsApp Viber Skype Facebook Vkontakte or Odnoklassniki. This is mishandled within the administration panel for conversations/all conversations/inbox conversations/unassigned and conversations/closed.


The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Stored XSS. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions.


In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5 there is XSS in the search engine.


** DISPUTED ** Firefly III before 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript code is executed during attachments/view/$file_id$ attachment viewing. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability.


Quest KACE Systems Management Appliance Server Center 9.1.317 has an XSS vulnerability (via the sam_detail_titled.php SAM_TYPE parameter) that allows an attacker to create a malicious link in order to attack authenticated users.


A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.


Stored XSS in EspoCRM before 5.6.4 allows remote attackers to execute malicious JavaScript and inject arbitrary source code into the target pages. The attack begins by storing a new stream message containing an XSS payload. The stored payload can then be triggered by clicking a malicious link on the Notifications page.


In Sitecore 9.0 rev 171002 Persistent XSS exists in the Media Library and File Manager. An authenticated unprivileged user can modify the uploaded file extension parameter to inject arbitrary JavaScript.


XSS exists in Ping Identity Agentless Integration Kit before 1.5.


In MiniCMS V1.10 stored XSS was found in mc-admin/post-edit.php via the content box. An attacker can use it to get a user's cookie. This is different from CVE-2018-10296 CVE-2018-16233 CVE-2018-20520 and CVE-2019-13186.


KEYNTO Team Password Manager 1.5.0 allows XSS because data saved from websites is mishandled in the online vault.


The Rencontre plugin before 3.1.3 for WordPress allows XSS via inc/rencontre_widget.php.


PHPWind 9.1.0 has XSS vulnerabilities in the c and m parameters of the index.php file.


MatrixSSL 4.2.1 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or a remote attacker able to measure the duration of hundreds to thousands of signing operations to compute the private key used. The issue occurs because crypto/pubkey/ecc_math.c scalar multiplication leaks the bit length of the scalar.


In MiniCMS V1.10 stored XSS was found in mc-admin/conf.php (comment box) which can be used to get a user's cookie.


Sahi Pro 8.0.0 has a script manager arena located at _s_/dyn/pro/DBReports with many different areas that are vulnerable to reflected XSS by updating a script's Script Name Suite Name Base URL Android iOS Scripts Run Origin Machine or Comment field. The sql parameter can be used to trigger reflected XSS.


index.php in Ovidentia 8.4.3 has XSS via tg=groups tg=maildoms&idx=create&userid=0&bgrp=y tg=delegat tg=site&idx=create tg=site&item=4 tg=admdir&idx=mdb&id=1 tg=notes&idx=Create tg=admfaqs&idx=Add or tg=admoc&idx=addoc&item=.


The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.


inc/user.class.php in GLPI before 9.4.3 allows XSS via a user picture.


RainLoop Webmail before 1.13.0 lacks XSS protection mechanisms such as xlink:href validation the X-XSS-Protection header and the Content-Security-Policy header.


** DISPUTED ** Firefly III before 4.7.17.3 is vulnerable to reflected XSS due to lack of filtration of user-supplied data in a search query. NOTE: It is asserted that an attacker must have the same access rights as the user in order to be able to execute the vulnerability.


In the Alkacon OpenCms Apollo Template 10.5.4 and 10.5.5 there is XSS in the Login form.


An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML because esc_html is not called for the \echo get_the_title()\ or \echo $term->name\ statement.


admin.php?page=account_billing in Piwigo 2.9.5 has XSS via the vat_number billing_name company or billing_address parameter. This is exploitable via CSRF.


The web application of several Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) was affected by Reflected XSS. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions.


An

issue

was

discovered

in

mxGraph

through

related

to

the

\draw.io

Diagrams\

plugin

before

for

Confluence

and

other

products.

Improper

input

validation/sanitization

of

a

color

field

leads

to

XSS.

This

is

associated

with


An issue was discovered in Zoho ManageEngine ServiceDesk Plus 9.3. There is XSS via the PurchaseRequest.do serviceRequestId parameter.


Zimbra Collaboration before 8.8.15 Patch 1 is vulnerable to a non-persistent XSS via the Admin Console.


Sandline Centraleyezer (On Premises) allows Unrestricted File Upload leading to Stored XSS. An HTML page running a script could be uploaded to the server. When a victim tries to download a CISO Report template the script is loaded.


An issue was discovered in the Purchase component of Zoho ManageEngine ServiceDesk Plus. There is XSS via the SearchN.do search field a different vulnerability than CVE-2019-12189.


An issue was discovered in GitLab Community and Enterprise Edition 8.4 through 11.11. A malicious user could execute JavaScript code on notes by importing a specially crafted project file. It allows XSS.


Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin/user.php?form=update_f&user_name= or admin/user.php?form=remove_f&user_name= or admin/config/diff.php?app= URI.


An issue was discovered in Ampache through 3.9.1. A stored XSS exists in the localplay.php LocalPlay \add instance\ functionality. The injected code is reflected in the instances menu. This vulnerability can be abused to force an admin to create a new privileged user whose credentials are known by the attacker.


XSS was discovered in SquirrelMail through 1.4.22 and 1.5.x through 1.5.2. Due to improper handling of RCDATA and RAWTEXT type elements the built-in sanitization mechanism can be bypassed. Malicious script content from HTML e-mail can be executed within the application context via crafted use of (for example) a NOEMBED NOFRAMES NOSCRIPT or TEXTAREA element.


An issue was discovered in Joomla! before 3.9.7. The subform fieldtype does not sufficiently filter or validate input of subfields. This leads to XSS attack vectors.


Samsung SCX-824 printers allow a reflected Cross-Site-Scripting (XSS) vulnerability that can be triggered by using the \print from file\ feature as demonstrated by the sws/swsAlert.sws?popupid=successMsg msg parameter.


In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.


httpGetSet/httpGet.htm on Emerson Network Power Liebert Challenger 5.1E0.5 devices allows XSS via the statusstr parameter.


The WP Statistics plugin through 12.6.5 for Wordpress has stored XSS in includes/class-wp-statistics-pages.php. This is related to an account with the Editor role creating a post with a title that contains JavaScript to attack an admin user.


DISPUTED

IdentityServer

through

has

stored

XSS

via

the

httpContext

to

the

LogForErrorContext

method

which

can

be

triggered

by

viewing

a

log.

NOTE:

the

software

maintainer

disputes

that

this

is

a

vulnerability

because

the

request

logger

is

not

part

of

IdentityServer

but

only

our

development

test

host.


An issue was discovered in Sylius products. Missing input sanitization in sylius/sylius 1.0.x through 1.0.18 1.1.x through 1.1.17 1.2.x through 1.2.16 1.3.x through 1.3.11 and 1.4.x through 1.4.3 and sylius/grid 1.0.x through 1.0.18 1.1.x through 1.1.18 1.2.x through 1.2.17 1.3.x through 1.3.12 1.4.x through 1.4.4 and 1.5.0 allows an attacker (an admin in the sylius/sylius case) to perform XSS by injecting malicious code into a field displayed in a grid with the \string\ field type. The contents are an object with malicious code returned by the __toString() method of that object.


The BlueMail application through 1.9.5.36 for Android allows XSS via an event attribute and arbitrary file loading via a src attribute if the application has the READ_EXTERNAL_STORAGE permission.


An issue was discovered in Zoho ManageEngine AssetExplorer. There is XSS via ResourcesAttachments.jsp with the parameter pageName.