An issue was discovered in Hyland org.alfresco:share through 7.0.0.2 and org.alfresco:community-share through 7.0. An evasion of the XSS filter for HTML input validation in the Alfresco Share User Interface leads to stored XSS that could be exploited by an attacker (given that he has privileges on the content collaboration features).


Veritas NetBackup OpsCenter Analytics 9.1 allows XSS via the NetBackup Master Server Name Display Name NetBackup User Name or NetBackup Password field during a Settings/Configuration Add operation.


A reflected Cross Site Scripting (XSS) vulnerability exists in Premiumdatingscript 4.2.7.7 via the aerror_description parameter in assets/sources/instagram.php script.


An issue was discovered in Socomec REMOTE VIEW PRO 2.0.41.4. Improper validation of input into the username field makes it possible to place a stored XSS payload. This is executed if an administrator views the System Event Log.


Nextcloud is an open-source self-hosted productivity platform. Prior to versions 20.0.13 21.0.5 and 22.2.0 a file traversal vulnerability makes an attacker able to download arbitrary SVG images from the host system including user provided files. This could also be leveraged into a XSS/phishing attack an attacker could upload a malicious SVG file that mimics the Nextcloud login form and send a specially crafted link to victims. The XSS risk here is mitigated due to the fact that Nextcloud employs a strict Content-Security-Policy disallowing execution of arbitrary JavaScript. It is recommended that the Nextcloud Server be upgraded to 20.0.13 21.0.5 or 22.2.0. There are no known workarounds aside from upgrading.


Zenario CMS 9.0.54156 is vulnerable to Cross Site Scripting (XSS) via upload file to *.SVG. An attacker can send malicious files to victims and steals victim's cookie leads to account takeover. The person viewing the image of a contact can be victim of XSS.


TadTools special page parameter does not properly restrict the input of specific characters thus remote attackers can inject JavaScript syntax without logging in and further perform reflective XSS attacks.


MediaWiki before 1.36.2 allows XSS. Month related MediaWiki messages are not escaped before being used on the Special:Search results page.


In Ericsson ECM before 18.0 it was observed that Security Management Endpoint in User Profile Management Section is vulnerable to stored XSS via a name leading to session hijacking and full account takeover.


OX App Suite 7.10.4 and earlier allows XSS via a crafted distribution list (payload in the common name) that is mishandled in the scheduling view.


react-draft-wysiwyg (aka React Draft Wysiwyg) before 1.14.6 allows a javascript: URi in a Link Target of the link decorator in decorators/Link/index.js when a draft is shared across users leading to XSS.


An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related query parameters allowed for XSS on certain PageForms-managed MediaWiki pages.


SIS SIS-REWE Go before 7.7 SP17 allows XSS: rewe/prod/web/index.php (affected parameters are config version win db pwd and user) and /rewe/prod/web/rewe_go_check.php (version and all other parameters).


The media2click (aka 2 Clicks for External Media) extension 1.x before 1.3.3 for TYPO3 allows XSS by a backend user account.


Settings.aspx?view=About in Directum 5.8.2 allows XSS via the HTTP User-Agent header.


Stored XSS in Remote Clinic v2.0 in /medicines due to Medicine Name Field.


OX App Suite 7.10.4 and earlier allows XSS via a crafted contact object (payload in the position or company field) that is mishandled in the App Suite UI on a smartphone.


cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581).


Cross site scripting (XSS) vulnerability in McAfee Data Loss Prevention (DLP) ePO extension prior to 11.7.100 allows a remote attacker to highjack an active DLP ePO administrator session by convincing the logged in administrator to click on a carefully crafted link in the case management part of the DLP ePO extension.


An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables a malicious actor could introduce XSS payloads into various layers.


The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. This issue impacts versions 6.5 and below. This issue works by passing in a basic XSS payload to a vulnerable GET parameter that is reflected in the output without sanitization.


XSS in the client account page in SuiteCRM before 7.11.19 allows an attacker to inject JavaScript via the name field


In LibreNMS < 21.3.0 a stored XSS vulnerability was identified in the API Access page due to insufficient sanitization of the $api->description variable. As a result arbitrary Javascript code can get executed.


Adiscon

LogAnalyzer

and

allow

login.php

XSS.


Chevereto before 3.17.1 allows Cross Site Scripting (XSS) via an image title at the image upload stage.


An unauthenticated XSS vulnerability exists in several IoT devices from CHIYU Technology including BF-630 BF-450M BF-430 BF-431 BF631-W BF830-W Webpass BF-MINI-W and SEMAC due to a lack of sanitization when the HTTP 404 message is generated.


Multiple storage XSS vulnerabilities were discovered on BF-430 BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi if.cgi dhcpc.cgi ppp.cgi.


Sipwise C5 NGCP WWW Admin version 3.6.7 up to and including platform version NGCP CE 3.0 has multiple authenticated stored and reflected XSS vulnerabilities when input passed via several parameters to several scripts is not properly sanitized before being returned to the user: Stored XSS in callforward/time/set/save (POST tsetname); Reflected XSS in addressbook (GET filter); Stored XSS in addressbook/save (POST firstname lastname company); and Reflected XSS in statistics/versions (GET lang).


PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the add-expense.php Item parameter.


The OpenID Connect server implementation for MITREid Connect through 1.3.3 contains a Server Side Request Forgery (SSRF) vulnerability. The vulnerability arises due to unsafe usage of the logo_uri parameter in the Dynamic Client Registration request. An unauthenticated attacker can make a HTTP request from the vulnerable server to any address in the internal network and obtain its response (which might for example have a JavaScript payload for resultant XSS). The issue can be exploited to bypass network boundaries obtain sensitive data or attack other hosts in the internal network.


The Favorites component before 1.0.2 for Nagios XI 5.8.0 is vulnerable to XSS.


LMA ISIDA Retriever 5.2 is vulnerable to XSS via query'text'.


OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and the dl parameter is used.


EPrints 3.4.2 exposes a reflected XSS opportunity in the via a cgi/cal URI.


The number range searcher component in Jira Server and Jira Data Center before version 8.5.14 from version 8.6.0 before version 8.13.6 and from version 8.14.0 before version 8.16.1 allows remote attackers inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.


In nopCommerce 4.30 a Reflected XSS issue in the Discount Coupon component allows remote attackers to inject arbitrary web script or HTML through the Filters/CheckDiscountCouponAttribute.cs discountcode parameter.


The CardLayoutConfigTable component in Jira Server and Jira Data Center before version 8.5.15 and from version 8.6.0 before version 8.13.7 and from version 8.14.0 before 8.17.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.


An issue was discovered in Joomla! 3.0.0 through 3.9.26. HTML was missing in the executable block list of MediaHelper::canUpload leading to XSS attack vectors.


OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.


EditworkflowScheme.jspa in Jira Server and Jira Data Center before version 8.5.14 and from version 8.6.0 before version 8.13.6 and from 8.14.0 before 8.16.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability.


EPrints 3.4.2 exposes a reflected XSS opportunity in the dataset parameter to the cgi/dataset_dictionary URI.


Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.


An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page


A potential security vulnerability has been identified in HPE Superdome Flex Servers. The vulnerability could be remotely exploited to allow Cross Site Scripting (XSS) because the Session Cookie is missing an HttpOnly Attribute. HPE has provided a firmware update to resolve the vulnerability in HPE Superdome Flex Servers.


LivingLogic

before

allows

XSS

via

feedback.htm

or

feedback.wihtm.


PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS via the user-profile.php Full Name field.


Jenzabar 9.2.x through 9.2.2 allows /ics?tool=search&query= XSS.


An XSS issue was discovered in SmartFoxServer 2.17.0. Input passed to the AdminTool console is not properly sanitized before being returned to the user. This can be exploited to execute arbitrary HTML code in a user's browser session in context of an affected site.


An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send a plain text e-mail message with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php because bespoke use of \\x00\\x00\\x00 and \\x01\\x01\\x01 interferes with XSS defenses.


Modules/input/Views/schedule.php in Emoncms through 10.2.7 allows XSS via the node parameter.


LivingLogic

before

allows

XSS

via

login.htm

login.wihtm

or

login-form.htm.


LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the \No results found for\ message in the search bar.


An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the imagelist view of com_media leads to a XSS vulnerability.


An issue was discovered in Joomla! 3.0.0 through 3.9.27. Inadequate escaping in the rules field of the JForm API leads to a XSS vulnerability.


An issue was discovered in Argo CD before 1.8.4. Browser XSS protection is not activated due to the missing XSS protection header.


** DISPUTED ** A stored XSS issue exists in henriquedornas 5.2.17 via online live chat. NOTE: Third parties report that no such product exists. That henriquedornas is the web design agency and 5.2.17 is simply the PHP version running on this hosts.


Insufficient script validation of the admin page enables XSS which causes unauthorized users to steal admin privileges. When uploading file in a specific menu the verification of the files is insufficient. It allows remote attackers to upload arbitrary files disguising them as image files.


An issue was discovered in MDaemon before 20.0.4. There is Reflected XSS in Webmail (aka WorldClient). It can be exploited via a GET request. It allows performing any action with the privileges of the attacked user.


A stored XSS issue exists in Appspace 6.2.4. After a user is authenticated and enters an XSS payload under the groups section of the network tab it is stored as the group name. Whenever another member visits that group this payload executes.


The Contact page in Monica 2.19.1 allows stored XSS via the Description field.


The Contact page in Monica 2.19.1 allows stored XSS via the Nickname field.


The Contact page in Monica 2.19.1 allows stored XSS via the Middle Name field.


A Stored Cross Site Scripting(XSS) Vulnerability was discovered in PEEL SHOPPING 9.3.0 and 9.4.0 which are publicly available. The user supplied input containing polyglot payload is echoed back in javascript code in HTML response. This allows an attacker to input malicious JavaScript which can steal cookie redirect them to other malicious website etc.


The Contact page in Monica 2.19.1 allows stored XSS via the Last Name field.


The Contact page in Monica 2.19.1 allows stored XSS via the First Name field.


A persistent cross site scripting (XSS) vulnerability in the Add Categories module of Vehicle Parking Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Category field.


Foxit PDF SDK For Web through 7.5.0 allows XSS. There is arbitrary JavaScript code execution in the browser if a victim uploads a malicious PDF document containing embedded JavaScript code that abuses app.alert (in the Acrobat JavaScript API).


Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action drop down and hovering over the Campaigns button. Contact first and last name can be populated from different sources such as UI API 3rd party syncing forms etc.


For Mautic versions prior to 3.3.4/4.0.0 there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter \bundle \ in the URL could allow an attacker to execute Javascript code. The attacker would be required to convince or trick the target into clicking a password reset URL with the vulnerable parameter utilized.


ZendTo before 6.06-4 Beta allows XSS during the display of a drop-off in which a filename has unexpected characters.


Advanced Order Export before 3.1.8 for WooCommerce allows XSS a different vulnerability than CVE-2020-11727.


Clansphere CMS 2011.4 allows unauthenticated reflected XSS via \language\ parameter.


Dolphin CMS 7.4.2 is vulnerable to stored XSS via the Page Builder \width\ parameter.


resources/public/js/orchestrator.js in openark orchestrator before 3.2.4 allows XSS via the orchestrator-msg parameter.


The admin panel in BlackCat CMS 1.3.6 allows stored XSS (by an admin) via the Display Name field to backend/preferences/ajax_save.php.


An issue was discovered in the comrak crate before 0.9.1 for Rust. XSS can occur because the protection mechanism for data: and javascript: URIs is case-sensitive allowing (for example) Data: to be used in an attack.


Askey

devices

allow

curWebPage

XSS.


MyBB before 1.8.25 allows stored XSS via nested email tags with MyCode (aka BBCode).


An issue was discovered in Craft CMS before 3.6.0. In some circumstances a potential XSS vulnerability existed in connection with front-end forms that accepted user uploads.


Faraday Edge before 3.7 allows XSS via the network/create/ page and its network name parameter.


Accellion FTA 9_12_432 and earlier is affected by stored XSS via a crafted POST request to a user endpoint. The fixed version is FTA_9_12_444 and later.


Clansphere CMS 2011.4 allows unauthenticated reflected XSS via \module\ parameter.


In the \Time in Status\ app before 4.13.0 for Jira remote authenticated attackers can cause Stored XSS.


Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can only be leveraged by an authenticated user with permission to create or edit assets.


Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via the queue name of the live-poll feature when Internet Explorer is used.


An issue was discovered in Mediat 1.4.1. There is a Reflected XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML without authentication via the 'return' parameter in login.php.


An issue was discovered in Gris CMS v0.1. There is a Persistent XSS vulnerability which allows remote attackers to inject arbitrary web script or HTML via admin/dashboard.


LiquidFiles 3.4.15 has stored XSS through the \send email\ functionality when sending a file via email to an administrator. When a file has no extension and contains malicious HTML / JavaScript content (such as SVG with HTML content) the payload is executed upon a click. This is fixed in 3.5.


A blind XSS vulnerability exists in Web-School ERP V 5.0 via (Add Events) in event name and description fields. An attacker can inject a JavaScript code that will be stored in the page. If any visitor sees the event then the payload will be executed and sends the victim's information to the attacker website.


An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles all the mediastatistics-header-* messages are output in HTML unescaped leading to XSS.


Composr 10.0.36 allows XSS in an XML script.


Seafile 7.0.5 (2019) allows Persistent XSS via the \share of library functionality.\


An issue was discovered on Nokia G-120W-F 3FE46606AGAB91 devices. There is Stored XSS in the administrative interface via urlfilter.cgi?add url_address.


Authenticated

reflective

XSS

in

HelpDeskTab/rcResults.asp

The

parameter

result

of

is

insecurely

returned

in

the

requested

web

page

and

can

be

used

to

perform

a

Cross

Site

Scripting

attack

Example

request:

The

same

is

true

for

the

parameter

FileName

of

/done.asp

Eaxmple

request:


SysAid 20.3.64 b14 is affected by Cross Site Scripting (XSS) via a /KeepAlive.jsp?stamp= URI.


An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist some of the rcfilters-filter-* label messages are output in HTML unescaped leading to XSS.


An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag bypassing sanitization steps and potentially allowing for XSS.


Jamf Pro before 10.28.0 allows XSS related to inventory history aka PI-009376.


ViewCommon.java in JForum2 2.7.0 allows XSS via a user signature.


An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text.


Rittal CMC PU III Web management (version V3.11.00_2) fails to sanitize user input on several parameters of the configuration (User Configuration dialog Task Configuration dialog and set logging filter dialog). This allows an attacker to backdoor the device with HTML and browser-interpreted content (such as JavaScript or other client-side scripts). The XSS payload will be triggered when the user accesses some specific sections of the application.


Multiple Cross Site Scripting (XSS) vulnerabilities exist in SourceCodester Tailor Management 1.0 via the (1) eid parameter in (a) partedit.php and (b) customeredit.php the (2) id parameter in (a) editmeasurement.php and (b) addpayment.php and the (3) error parameter in index.php.


CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor on the device with HTML content and interpreted by the browser (such as JavaScript or other client-side scripts) or to steal the session cookies of a user who has previously authenticated via a man in the middle. Successful exploitation requires access to the web service resource without authentication.


Multiple

Cross

Site

Scripting

(XSS)

vulnerabilities

exist

in

SourceCodester

CASAP

Automated

Enrollment

System

via

the

and

category

parameters

in

the

firstname

class

and

status

parameters

in

the

category

and

parameters

in

the

fname

mname

lname

address

class

gfname

gmname

glname

rship

status

transport

and

route

parameters

in

the

fname

mname

lname

address

class

fgname

gmname

glname

rship

status

transport

and

route

parameters

in

the

status

fname

and

lname

parameters

in

the

username

firstname

and

status

parameters

in

users.php

the

fname

lname

and

status

parameters

in

and

the

aprjun

class

janmar

Julsep

octdec

Students

and

users

parameters

in


A DOM-based XSS vulnerability affects SquaredUp for SCOM 5.2.1.6654. If successfully exploited this vulnerability may allow attackers to inject malicious code into a user's device.


An issue was discovered in Concrete CMS through 8.5.5. There is XSS via Markdown Comments.


SmarterTools SmarterMail 16.x before build 7866 has stored XSS. The application fails to sanitize email content thus allowing one to inject HTML and/or JavaScript into a page that will then be processed and stored by the application.


A Stored XSS exists in TinyFileManager All version up to and including 2.4.6 in /tinyfilemanager.php when the server is given a file that contains HTML and javascript in its name. A malicious user can upload a file with a malicious filename containing javascript code and it will run on any user browser when they access the server.


A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki related to the Denounce plugin which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.0 or later.


In Cloudron 6.2 the returnTo parameter on the login page is vulnerable to Reflected XSS.


A Stored XSS issue exists in the admin/users user administration form in LiveConfig 2.12.2.


Gibbon v22.0.00 suffers from a stored XSS vulnerability within the wall messages component.


An issue was discovered in Concrete CMS through 8.5.5. There is unauthenticated stored XSS in blog comments via the website field.


Airangel HSMX Gateway devices through 5.2.04 is vulnerable to stored Cross Site Scripting. XSS Payload is placed in the name column of the updates table using database access.


Projectsend version r1295 is affected by Cross Site Scripting (XSS) due to lack of sanitization when echo output data in returnFilesIds() function. A low privilege user can call this function through process.php file and execute scripting code.


The ixsso.query ActiveX Object is marked as safe for scripting which allows malicious web site operators to embed a script that remotely determines the existence of files on visiting Windows 2000 systems that have Indexing Services enabled.


Multiple SQL injection vulnerabilities in Ripe Website Manager 0.8.9 and earlier allow remote authenticated users to execute arbitrary SQL commands via one or more of the following vectors: the (1) id parameter to (a) pages/delete_page.php (b) navigation/delete_menu.php and (c) navigation/delete_item.php in admin/; the (2) menu_id (3) name (3) page_id and (4) url parameters in (d) admin/navigation/do_new_item.php; the (5) new_menuname parameter in (e) admin/navigation/do_new_nav.php; and (6) area1 name and url parameters to (f) admin/pages/do_new_page.php. NOTE: some vectors might be reachable through the url and name parameters to (g) admin/navigation/new_nav_item.php. NOTE: the original disclosure does not precisely state which vectors are associated with SQL injection versus XSS.


Multiple SQL injection vulnerabilities in Advanced Webhost Billing System (AWBS) before 2.6.0 when magic_quotes_gpc is disabled allow remote attackers to execute arbitrary SQL commands via unspecified vectors. NOTE: this can be leveraged for XSS attacks that \bypass AWBS's anti-XSS input validation.\


Cross-zone scripting vulnerability in the internal browser in i-Systems Feedreader 3.10 allows remote attackers to inject arbitrary web script or HTML via an item in a feed as demonstrated by a WordPress blog update. NOTE: this was originally reported as XSS.


Unrestricted file upload vulnerability in upload.php in SeeBlick 1.0 Beta allows remote attackers to upload arbitrary files via unspecified vectors. NOTE: these files are stored with .html extensions so the scope of the attack might be limited to resource consumption and possibly XSS.


Unspecified vulnerability in xajax before 0.2.5 has unknown impact and attack vectors not related to XSS.


** DISPUTED ** Microsoft Internet Explorer 6 executes web script from URIs of arbitrary scheme names ending with the \script\ character sequence using the (1) vbscript: handler for scheme names with 7 through 9 characters and the (2) javascript: handler for scheme names with 10 or more characters which might allow remote attackers to bypass certain XSS protection schemes. NOTE: other researchers dispute the significance of this issue stating \this only works when typed in the address bar.\


Unspecified vulnerability in the Username Hijacking Patch 20070312 for web-app.org WebAPP 0.9.9.6 allows remote attackers to obtain administrative access via unknown vectors related to \something overlooked in the original that was still overlooked in the patch\ and possibly related to copying files to the user-lib and the \XSS and cookies exploit.\


An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the user_id parameter to signup.php.


An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the fullname parameter to signup.php.


An issue was discovered in Bilboplanet 2.0. There is a stored XSS vulnerability when adding a tag via the user/?page=tribes tags parameter.


Vembu

StoreGrid

has

XSS

in

and


The profile-builder plugin before 1.1.66 for WordPress has multiple XSS issues in forms.


The memphis-documents-library plugin before 3.0 for WordPress has XSS via $_REQUEST.


The cp-polls plugin before 1.0.1 for WordPress has XSS in the votes list.


The duplicate-post plugin before 2.6 for WordPress has XSS.


Lexiglot through 2014-11-20 allows XSS (Reflected) via the username or XSS (Stored) via the admin.php?page=config install_name intro_message or new_file_content parameter.


The ISO-8859-1 encoder in Resin Pro before 4.0.40 does not properly perform Unicode transformations which allows remote attackers to bypass intended text restrictions via crafted characters as demonstrated by bypassing an XSS protection mechanism.


JBoss KeyCloak: XSS in login-status-iframe.html


JBoss AeroGear has reflected XSS via the password field


The Clientless SSL VPN portal customization framework in Cisco ASA Software 8.2 before 8.2(5.51) 8.3 before 8.3(2.42) 8.4 before 8.4(7.23) 8.6 before 8.6(1.14) 9.0 before 9.0(4.24) 9.1 before 9.1(5.12) and 9.2 before 9.2(2.4) does not properly implement authentication which allows remote attackers to modify RAMFS customization objects via unspecified vectors as demonstrated by inserting XSS sequences or capturing credentials aka Bug ID CSCup36829.


OpenShift Origin: Improperly validated team names could allow stored XSS attacks


The GenerateFunction function in bindings/scripts/code_generator_v8.pm in Blink as used in Google Chrome before 33.0.1750.149 does not implement a certain cross-origin restriction for the EventTarget::dispatchEvent function which allows remote attackers to conduct Universal XSS (UXSS) attacks via vectors involving events.


Pearson eSIS (Enterprise Student Information System) message board has stored XSS due to improper validation of user input


The Conceptronic C54APM access point with runtime code 1.26 has a default password of admin for the admin account which makes it easier for remote attackers to obtain access via an HTTP request as demonstrated by stored XSS attacks.


Versions of Katello as shipped with Red Hat Subscription Asset Manager 1.4 are vulnerable to a XSS via HTML in the systems name when registering.


The ultimate-weather plugin 1.0 for WordPress has XSS


flog plugin 0.1 for WordPress has XSS


Synacor Zimbra Collaboration before 8.0.8 has XSS.


CDA.xsl in HL7 C-CDA 1.1 and earlier does not anticipate the possibility of invalid C-CDA documents with crafted XML attributes which allows remote attackers to conduct XSS attacks via a document containing a table that is improperly handled during unrestricted xsl:copy operations.


The WordPress plugin Contact Form Integrated With Google Maps 1.0-2.4 has Stored XSS


TYPO3 before 4.2.13 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box.


TYPO3 before 4.4.1 allows XSS in the frontend search box.


JBoss BRMS before 5.1.0 has a XSS vulnerability via asset=UUID parameter.


TYPO3 before 4.3.4 and 4.4.x before 4.4.1 allows XSS in the textarea view helper in an extbase extension.


IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlgcaptchauid is non-persistent in 10.1.3 and 10.2.0.


IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlgcaptchaaction is non-persistent in 10.1.3 and 10.2.0.


IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persistent in 10.2.0.


IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent in 10.2.0.


IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlgcaptchacontroller is non-persistent in 10.1.3 and 10.2.0.


PmWiki before 2.2.21 has XSS.


Tiki Wiki CMS Groupware 5.2 has XSS


Mahara before 20.10.5 21.04.4 21.10.2 and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used and JavaScript code is constructed to perform an action.


An issue was discovered in MISP before 2.4.158. There is XSS in the cerebrate view if one administrator puts a javascript: URL in the URL field and another administrator clicks on it.


A

reflected

XSS

issue

exists

in

the

Management

Console

of

several

products.

This

affects

API

Manager

and

API

Manager

Analytics

and

API

Microgateway

Data

Analytics

Server

Enterprise

Integrator

and

IS

as

Key

Manager

and

Identity

Server

and

Identity

Server

Analytics

and

and

Micro

Integrator


ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar.


Crypt Server before 3.3.0 allows XSS in the index view. This is related to serial computername and username.


An

issue

was

discovered

in

MISP

before

There

is

XSS

in

in

a

situation

with

a

\weird

single

checkbox

page.\


Woodpecker

before

allows

XSS

via

build

logs

because

lacks

escaping.


An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field.


An issue was discovered in MISP before 2.4.158. There is stored XSS in the event graph via a tag name.


The Ericom PowerTerm WebConnect 6.0 login portal can unsafely write an XSS payload from the AppPortal cookie into the page.


OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367.


The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true).


The

Nimbus

skin

for

MediaWiki

through

(before

allows

XSS

in

Advertise

link

messages.


An issue was discovered in MISP before 2.4.158. There is stored XSS in the galaxy clusters.


XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.


Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.


Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.


Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.


The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27 available to both unauthenticated and authenticated users responds with JSON data without an \application/json\ content-type. Since an HTML payload isn't properly escaped it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check the XSS is only exploitable against unauthenticated users (as they all share the same nonce)


The All-in-one Floating Contact Form Call Chat and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.


Stored XSS via file upload in GitHub repository star7th/showdoc prior to v2.10.4.


Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to 2.10.4.


Stored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4.


File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.


Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.


Rapid7 Nexpose versions 6.6.129 and earlier suffer from a reflected cross site scripting vulnerability within the shared scan configuration component of the tool. With this vulnerability an attacker could pass literal values as the test credentials providing the opportunity for a potential XSS attack. This issue is fixed in Rapid7 Nexpose version 6.6.130.


Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.


Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.


Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.


Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.


Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.


File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.


Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.


The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler as well as does not sanitize its settings which enables an unauthenticated attacker to inject malicious XSS payloads into the settings page of the plugin.


Stored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4.


Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.


Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.


Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4.


In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests.


XSS via Embedded SVG in SVG Diagram Format in GitHub repository plantuml/plantuml prior to 1.2022.4. Stored XSS in the context of the diagram embedder. Depending on the actual context this ranges from stealing secrets to account hijacking or even to code execution for example in desktop applications. Web based applications are the ones most affected. Since the SVG format allows clickable links in diagrams it is commonly used in plugins for web based projects (like the Confluence plugin etc. see https://plantuml.com/de/running).


Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser


Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim


The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature


Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking sensitive data exposure and worse.


Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app.


CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.


Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7 14.8 prior to 14.8.5 and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions comments etc.


Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working you might need to press \tab\ but there is probably a paylaod that runs without user interaction.


Stored XSS due to no sanitization in the filename in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking sensitive data exposure and worse.


There is a XSS vulnerability in Careerfy.


Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7 all versions starting from 14.8 before 14.8.5 all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.


DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code deface website steal cookie...


Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking sensitive data exposure and worse.


stored xss in GitHub repository getgrav/grav prior to 1.7.33.


Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .


stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss .


Stored XSS in \Name\ \Group Name\ & \Title\ in GitHub repository polonel/trudesk prior to v1.2.0. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking sensitive data exposure and worse.


XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.


An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6 all versions starting from 14.9 before 14.9.4 all versions starting from 14.10 before 14.10.1. Missing invalidation of Markdown caching causes potential payloads from a previously exploitable XSS vulnerability (CVE-2022-1175) to persist and execute.


Stored XSS viva .svg file upload in GitHub repository polonel/trudesk prior to v1.2.0.


The WP Subtitle WordPress plugin before 3.4.1 adds a subtitle field and provides a shortcode to display it via wp_subtitle. The subtitle is stored as a custom post meta with the key: \wps_subtitle\ which is sanitized upon post save/update however is not sanitized when updating it directly from the post meta update button (via AJAX) - and this makes the XSS exploitable by authenticated users with a role as low as contributor.


The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign and does not escape the campaign fields when outputting them In attributes. As a result attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack


XSS vulnerability with default `onCellHtmlData` function in GitHub repository hhurz/tableexport.jquery.plugin prior to 1.25.0. Transmitting cookies to third-party servers. Sending data from secure sessions to third-party servers


The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS but depending on further use of uploaded SVG files potentially other XML attacks).


Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1.


XSS in edit page of Hoosk 1.8.0 allows attacker to execute javascript code in user browser via edit page with XSS payload bypass filter some special chars.


OWASP AntiSamy before 1.6.6 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content.


jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.


WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS).


In SpringBootMovie <=1.2 when adding movie names malicious code can be stored because there are no filtering parameters resulting in stored XSS.


Craft CMS before 3.7.29 allows XSS.


Dragon Path Technologies Bharti Airtel Routers Hardware BDT-121 version 1.0 is vulnerable to Cross Site Scripting (XSS) via Dragon path router admin page.


JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.


DouPHP v1.6 Release 20220121 is affected by Cross Site Scripting (XSS) through /admin/login.php in the background which will lead to JavaScript code execution.


Accounting Journal Management 1.0 is vulnerable to XSS-PHPSESSID-Hijacking. The parameter manage_user from User lists is vulnerable to XSS-Stored and PHPSESSID attacks. The malicious user can attack the system by using the already session which he has from inside and outside of the network.


JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.


A carefully crafted user preferences for submission could trigger an XSS vulnerability on Apache JSPWiki related to the user preferences screen which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.2 or later.


An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11 resulting in a stored XSS.


In Checkmk <=2.0.0p19 fixed in 2.0.0p20 and Checkmk <=1.6.0p27 fixed in 1.6.0p28 the title of a Predefined condition is not properly escaped when shown as condition which can result in Cross Site Scripting (XSS).


Stored XSS in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010.


Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). To exploit this Vulnerability an admin views the registered user details.


JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.


Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. While creating or editing a user attribute the Help Text is subject to HTML injection which can be triggered for editing a user.


Metabase is an open source business intelligence and analytics application. In affected versions Metabase ships with an internal development endpoint `/_internal` that can allow for cross site scripting (XSS) attacks potentially leading to phishing attempts with malicious links that could lead to account takeover. Users are advised to either upgrade immediately or block access in your firewall to `/_internal` endpoints for Metabase. The following patches (or greater versions) are available: 0.42.4 and 1.42.4 0.41.7 and 1.41.7 0.40.8 and 1.40.8.


DHC Vision eQMS through 5.4.8.322 has Persistent XSS due to insufficient encoding of untrusted input/output. To exploit the vulnerability the attacker has to create or edit a new information object and use the XSS payload as the name. Any user that opens the object's version or history tab will be attacked.


LDAP

Account

Manager

(LAM)

is

an

open

source

web

frontend

for

managing

entries

stored

in

an

LDAP

directory.

The

profile

editor

tool

has

an

edit

profile

functionality

the

parameters

on

this

page

are

not

properly

sanitized

and

hence

leads

to

stored

XSS

attacks.

An

authenticated

user

can

store

XSS

payloads

in

the

profiles

which

gets

triggered

when

any

other

user

try

to

access

the

edit

profile

page.

The

pdf

editor

tool

has

an

edit

pdf

profile

functionality

the

logoFile

parameter

in

it

is

not

properly

sanitized

and

an

user

can

enter

relative

paths

like

via

tools

like

burpsuite.

Later

when

a

pdf

is

exported

using

the

edited

profile

the

pdf

icon

has

the

image

on

that

path(if

image

is

present).

Both

issues

require

an

attacker

to

be

able

to

login

to

LAM

admin

interface.

The

issue

is

fixed

in

version


JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.


Checkmk <=2.0.0p19 Fixed in 2.0.0p20 and Checkmk <=1.6.0p27 Fixed in 1.6.0p28 are affected by a Cross Site Scripting (XSS) vulnerability. The Alias of a site was not properly escaped when shown as condition for notifications.


ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5 a cross site scripting (XSS) issue can occur when providing untrusted input to the `redirect.link` property as an argument to the `build(MessagePageOptions)` function. While there is no known workaround at this time there is a patch in version 0.1.5.


JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS.


An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.


JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS.


Passwork On-Premise Edition before 4.6.13 has multiple XSS issues.


Zoho ManageEngine SupportCenter Plus before 11020 allows Stored XSS in the request history.


SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRender.do has two parameters: saspfs_request_backlabel_list and saspfs_request_backurl_list. The first one affects the content of the button placed in the top left. The second affects the page to which the user is directed after pressing the button e.g. a malicious web page. In addition the second parameter executes JavaScript which means XSS is possible by adding a javascript: URL.


An issue was discovered in Cerebrate through 1.4. genericForm allows reflected XSS in form descriptions via a user-controlled description.


An XSS issue was discovered on Olivetti d-COLOR MF3555 2XD_S000.002.271 devices. The Web Application doesn't properly check parameters sent in a /dvcset/sysset/set.cgi POST request via the arg01.Hostname field before saving them on the server. In addition the JavaScript malicious content is then reflected back to the end user and executed by the web browser.


ZEROF Web Server 2.0 allows /admin.back XSS.


The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise not for download on SplunkBase and not installed on Splunk Cloud Platform instances. Note that the Cloud Monitoring Console is not impacted.


Jfinal_CMS 5.1.0 allows attackers to use the feedback function to send malicious XSS code to the administrator backend and execute it.


An issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each time the administrator modifies a user.


element-plus 2.0.5 is vulnerable to Cross Site Scripting (XSS) via el-table-column.


libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter. This is fixed in 10.1.0.


WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via \\admin\\pages\\sections_save.php namesection2 parameters.


WBCE CMS 1.5.2 is vulnerable to Cross Site Scripting (XSS) via /admin/users/save.php.


Terminalfour before 8.3.8 allows XSS aka RDSM-31817. 8.2.18.2.1 and 8.2.18.5 are also fixed versions.


Gnuboard 5.55 and 5.56 is vulnerable to Cross Site Scripting (XSS) via bbs/member_confirm.php.


Parallels H-Sphere 3.6.2 allows XSS via the index_en.php from parameter.


Archer 6.x through 6.9 SP3 (6.9.3.0) contains a reflected XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application.


lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.


Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field.


An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body.


An XSS was identified in the Admin Web interface of PrimeKey SignServer before 5.8.1. JavaScript code must be used in a worker name before a Generate CSR request. Only an administrator can update a worker name.


Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.


Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker.


Archer 6.x through 6.10 (6.10.0.0) contains a reflected XSS vulnerability. A remote SAML-unauthenticated malicious Archer user could potentially exploit this vulnerability by tricking a victim application user into supplying malicious HTML or JavaScript code to the vulnerable web application; the malicious code is then reflected back to the victim and gets executed by the web browser in the context of the vulnerable web application.


The {% debug %} template tag in Django 2.2 before 2.2.27 3.2 before 3.2.12 and 4.0 before 4.0.2 does not properly encode the current context. This may lead to XSS.


SAP Enterprise Threat Detection (ETD) - version 2.0 does not sufficiently encode user-controlled inputs which may lead to an unauthorized attacker possibly exploit XSS vulnerability. The UIs in ETD are using SAP UI5 standard controls the UI5 framework provides automated output encoding for its standard controls. This output encoding prevents stored malicious user input from being executed when it is reflected in the UI.


Due to improper HTML encoding in input control summary an authorized attacker can execute XSS vulnerability in SAP Business Objects Web Intelligence (BI Launchpad) - version 420.


The REST API component of TIBCO Software Inc.'s TIBCO JasperReports Server TIBCO JasperReports Server - Community Edition TIBCO JasperReports Server - Developer Edition TIBCO JasperReports Server for AWS Marketplace TIBCO JasperReports Server for ActiveMatrix BPM and TIBCO JasperReports Server for Microsoft Azure contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO JasperReports Server: versions 8.0.1 and below TIBCO JasperReports Server - Community Edition: versions 8.0.1 and below TIBCO JasperReports Server - Developer Edition: versions 8.0.0 and below TIBCO JasperReports Server for AWS Marketplace: versions 8.0.1 and below TIBCO JasperReports Server for ActiveMatrix BPM: versions 7.9.2 and below and TIBCO JasperReports Server for Microsoft Azure: versions 8.0.1 and below.


An authenticated high privileged user can perform a stored XSS attack due to incorrect output encoding in Incapptic connect and affects all current versions.


The Web server component of TIBCO Software Inc.'s TIBCO EBX TIBCO EBX TIBCO EBX TIBCO EBX Add-ons TIBCO EBX Add-ons TIBCO EBX Add-ons and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 5.8.124 and below TIBCO EBX: versions 5.9.3 5.9.4 5.9.5 5.9.6 5.9.7 5.9.8 5.9.9 5.9.10 5.9.11 5.9.12 5.9.13 5.9.14 and 5.9.15 TIBCO EBX: versions 6.0.0 6.0.1 6.0.2 and 6.0.3 TIBCO EBX Add-ons: versions 3.20.18 and below TIBCO EBX Add-ons: versions 4.1.0 4.2.0 4.2.1 4.2.2 4.3.0 4.3.1 4.3.2 4.3.3 4.3.4 4.4.0 4.4.1 4.4.2 4.4.3 4.5.0 4.5.1 4.5.2 4.5.3 4.5.4 4.5.5 and 4.5.6 TIBCO EBX Add-ons: versions 5.0.0 5.0.1 5.1.0 5.1.1 and 5.2.0 and TIBCO Product and Service Catalog powered by TIBCO EBX: versions 1.1.0 and below.


The Workspace client component of TIBCO Software Inc.'s TIBCO BPM Enterprise and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric contains difficult to exploit Reflected Cross Site Scripting (XSS) vulnerabilities that allow low privileged attackers with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BPM Enterprise: versions 4.3.1 and below and TIBCO BPM Enterprise Distribution for TIBCO Silver Fabric: versions 4.3.1 and below.


SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the \comments\ field could lead to potential stealing of cookies loading of HTML tags and JS code onto the system.


K-Box is a web-based application to manage documents images videos and geodata. Prior to version 0.33.1 a stored Cross-Site-Scripting (XSS) vulnerability is present in the markdown editor used by the document abstract and markdown file preview. A specifically crafted anchor link can if clicked execute untrusted javascript actions like retrieving user cookies. Version 0.33.1 includes a patch that allows discarding unsafe links.


An issue was discovered in phpMyAdmin 5.1 before 5.1.2. An attacker can inject malicious code into aspects of the setup script which can allow XSS or HTML injection.


A remote reflected cross site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below 6.9.9 and below 6.8.9-HF2 and below 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.


An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components.


XWiki

Platform

is

a

generic

wiki

platform

offering

runtime

services

for

applications

built

on

top

of

it.

In

affected

versions

there

is

a

cross

site

scripting

(XSS)

vector

in

the

`registerinline.vm`

template

related

to

the

`xredirect`

hidden

field.

This

template

is

only

used

in

the

following

conditions:

The

wiki

must

be

open

to

registration

for

anyone.

The

wiki

must

be

closed

to

view

for

Guest

users

or

more

specifically

the

XWiki.Registration

page

must

be

forbidden

in

View

for

guest

user.

A

way

to

obtain

the

second

condition

is

when

administrators

checked

the

\Prevent

unregistered

users

from

viewing

pages

regardless

of

the

page

rights\

box

in

the

administration

rights.

This

issue

is

patched

in

versions

There

are

two

main

ways

for

protecting

against

this

vulnerability

the

easiest

and

the

best

one

is

by

applying

a

patch

in

the

`registerinline.vm`

template

the

patch

consists

in

checking

the

value

of

the

xredirect

field

to

ensure

it

matches:

`<input

type=\hidden\

name=\xredirect\

value=\$escapetool.xml($!request.xredirect)\

If

for

some

reason

it's

not

possible

to

patch

this

file

another

workaround

is

to

ensure

\Prevent

unregistered

users

from

viewing

pages

regardless

of

the

page

rights\

is

not

checked

in

the

rights

and

apply

a

better

right

scheme

using

groups

and

rights

on

spaces.


The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission


PhpIPAM v1.4.4 allows an authenticated admin user to inject persistent JavaScript code inside the \Site title\ parameter while updating the site settings. The \Site title\ setting is injected in several locations which triggers the XSS.


An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media.


WikiDocs version 0.1.18 has multiple reflected XSS vulnerabilities on different pages.


An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields.


ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url and when a user clicks the url an XSS attack will be triggered.


An authenticated user can create a hosts group from the configuration with XSS payload which will be available for other users. When XSS is stored by an authenticated malicious actor and other users try to search for groups during new host creation the XSS payload will fire and the actor can steal session cookies and perform session hijacking to impersonate users or take over their accounts.


There is a stored XSS vulnerability in ZTE home gateway product. An attacker could modify the gateway name by inserting special characters and trigger an XSS attack when the user views the current topology of the device through the management page.


/usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST'pkg_filter' in a PHP echo call causing XSS.


A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.


Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a sandbox escape exists allowing for injection into web pages generated from Latte. This may lead to XSS attacks. The issue is fixed in the versions 2.8.8 2.9.6 and 2.10.8. Users unable to upgrade should not accept template input from untrusted sources.


Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also after uploading a file the XSS attack is triggered upon a user viewing the file. Through this vulnerability an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible.


Convos is an open source multi-user chat that runs in a web browser. Characters starting with \https://\ in the chat window create an <a> tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for \<\ or \>\ but escaping for double quotes does not exist. Through this vulnerability an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible.


WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack which can affect high-privileged users. This has been patched in WordPress version 5.8.3. Older affected versions are also fixed via security release that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this issue.


Google Chrome 2.0.x lets modifications to the global object persist across a page transition which makes it easier for attackers to conduct Universal XSS attacks via unspecified vectors.


Google Chrome 1.0.x does not cancel timeouts upon a page transition which makes it easier for attackers to conduct Universal XSS attacks by calling setTimeout to trigger future execution of JavaScript code and then modifying document.location to arrange for JavaScript execution in the context of an arbitrary web site. NOTE: this can be leveraged for a remote attack by exploiting a chromehtml: argument-injection vulnerability.


Argument injection vulnerability in the chromehtml: protocol handler in Google Chrome before 1.0.154.59 when invoked by Internet Explorer allows remote attackers to determine the existence of files and open tabs for URLs that do not satisfy the IsWebSafeScheme restriction via a web page that sets document.location to a chromehtml: value as demonstrated by use of a (1) javascript: or (2) data: URL. NOTE: this can be leveraged for Universal XSS by exploiting certain behavior involving persistence across page transitions.


pixelpost 1.7.1 has XSS


Cookie Dump Servlet stored XSS vulnerability in jetty though 6.1.20.


WebApp JSP Snoop page XSS in jetty though 6.1.21.


Invision Power Board (aka IPB or IP.Board) 2.x through 3.0.4 when Internet Explorer 5 is used allows XSS via a .txt attachment.


JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.


Multiple Cross Site Scripting (XSS) vulnerabilities in Vignette StoryServer 4 and 5 and Vignette V/5 and V/6 allow remote attackers to insert arbitrary HTML and script via text variables as demonstrated using the errInfo parameter of the default login template.


Microsoft Internet Information Services (IIS) 6.0 when DNS resolution is enabled for client IP addresses allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response as demonstrated by injecting XSS sequences related to an \Inverse Lookup Log Corruption (ILLC)\ issue.


The Apache HTTP Server 2.0.44 when DNS resolution is enabled for client IP addresses allows remote attackers to inject arbitrary text into log files via an HTTP request in conjunction with a crafted DNS response as demonstrated by injecting XSS sequences related to an \Inverse Lookup Log Corruption (ILLC)\ issue.


PeerSec MatrixSSL before 1.1 caches session keys for an indefinitely long time which might make it easier for remote attackers to hijack a session.


PeerSec MatrixSSL before 1.1 does not implement RSA blinding which allows context-dependent attackers to obtain the server's private key by determining factors using timing differences on (1) the number of extra reductions during Montgomery reduction and (2) the use of different integer multiplication algorithms (\Karatsuba\ and normal) a related issue to CVE-2003-0147.


A Reflected Cross Site Scripting (XSS) vulnerability exists in the authorization function exposed by RESTful Web Api of IBM Worklight Framework 6.1 6.2 6.3 7.0 7.1 and 8.0. The vulnerable parameter is \scope\; if you set as its value a \realm\ not defined in authenticationConfig.xml you get an HTTP 403 Forbidden response and the value will be reflected in the body of the HTTP response. By setting it to arbitrary JavaScript code it is possible to modify the flow of the authorization function potentially leading to credential disclosure within a trusted session.


The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component.


ASUS RT-N14UHP devices before 3.0.0.4.380.8015 have a reflected XSS vulnerability in the \flag\ parameter.


PHPJabbers File Sharing Script 1.0 has stored XSS in the comments section.


An exploitable cross site scripting (XSS) vulnerability exists in the filter functionality of the delayed_job_web rails gem version 1.4. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.


OX Software GmbH App Suite 7.8.4 and earlier is affected by: Cross Site Scripting (XSS).


PHPJabbers Night Club Booking Software has stored XSS in the name parameter in the reservations tab.


Red Hat Satellite before 6.5 is vulnerable to a XSS in discovery rule when you are entering filter and you use autocomplete functionality.


It was noticed an XSS in certain 404 pages that could be exploited to perform an XSS attack. Chrome will detect this as a reflected XSS attempt and prevent the page from loading. Firefox and other browsers don't and are vulnerable to this attack. Mitigation: The fix for this is to upgrade to Apache Airflow 1.9.0 or above.


An XSS issue was discovered in admin/install.php in MantisBT before 1.3.12 and 2.x before 2.5.2. Some variables under user control in the MantisBT installation script are not properly sanitized before being output allowing remote attackers to inject arbitrary JavaScript code as demonstrated by the $f_database $f_db_username and $f_admin_username variables. This is mitigated by the fact that the admin/ folder should be deleted after installation and also prevented by CSP.


Moodle 3.x has XSS in the contact form on the \non-respondents\ page in non-anonymous feedback.


PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel.


DokuWiki through 2017-02-19b has XSS in the at parameter (aka the DATE_AT variable) to doku.php.


An exploitable cross site scripting (XSS) vulnerability exists in the add filter functionality of the rails_admin rails gem version 1.2.0. A specially crafted URL can cause an XSS flaw resulting in an attacker being able to execute arbitrary javascript on the victim's browser. An attacker can phish an authenticated user to trigger this vulnerability.


lib/html.php in Cacti before 1.1.18 has XSS via the title field of an external link added by an authenticated user.


The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an el_admin_categories delete_bulk action.


Core\\Admin\\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATH_INFO to wp-admin/admin.php related to PHP_SELF.


DokuWiki through 2017-02-19c has stored XSS when rendering a malicious language name in a code element in /inc/parser/xhtml.php. An attacker can create or edit a wiki with this element to trigger JavaScript execution.


XOOPS Core 2.5.8 has stored XSS in imagemanager.php because of missing MIME type validation in htdocs/class/uploader.php.


AXIS 2100 devices 2.43 have XSS via the URI possibly related to admin/admin.shtml.


DokuWiki through 2017-02-19c has stored XSS when rendering a malicious RSS or Atom feed in /inc/parser/xhtml.php. An attacker can create or edit a wiki that uses RSS or Atom data from an attacker-controlled server to trigger JavaScript execution. The JavaScript can be in an author field as demonstrated by the dc:creator element.


PHPJabbers Star Rating Script 4.0 has stored XSS via a rating item.


The Easy Testimonials plugin 3.0.4 for WordPress has XSS in include/settings/display.options.php as demonstrated by the Default Testimonials Width View More Testimonials Link and Testimonial Excerpt Options screens.


controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the dirname variable.


Fiyo CMS 2.0.7 has XSS in dapur\\apps\\app_config\\sys_config.php via the site_name parameter.


ONOS versions 1.8.0 1.9.0 and 1.10.0 are vulnerable to XSS.


An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. There is XSS in the administration interface.


app/View/Helper/CommandHelper.php in MISP before 2.4.79 has persistent XSS via comments. It only impacts the users of the same instance because the comment field is not part of the MISP synchronisation.


Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are shipping a vulnerable JavaScript library for sanitizing untrusted user-input which suffered from a XSS vulnerability caused by a behaviour change in Safari 10.1 and 10.2. Note that Nextcloud employs a strict Content-Security-Policy preventing exploitation of this XSS issue on modern web browsers.


Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.


Microsoft SharePoint Server fails to sanitize crafted web requests allowing remote attackers to run cross-script in local security context aka \Microsoft SharePoint XSS Vulnerability.\


Nextcloud Server before 9.0.58 and 10.0.5 and 11.0.3 are vulnerable to an inadequate escaping of error messages leading to XSS vulnerabilities in multiple components.


FineCMS through 2017-07-12 allows XSS in visitors.php because JavaScript in visited URLs is not restricted either during logging or during the reading of logs a different vulnerability than CVE-2017-11180.


In Joomla! before 3.7.4 inadequate filtering of potentially malicious HTML tags leads to XSS vulnerabilities in various components.


In Rise Ultimate Project Manager v1.8 XSS vulnerabilities were found in the My Profile section. All input fields are vulnerable.


In Zoho ManageEngine Application Manager 13.1 Build 13100 an authenticated user with administrative privileges has the ability to add a widget on any dashboard. This widget can be a \Utility Widget\ with a \Custom HTML or Text\ field. Once this widget is created it will be loaded on the dashboard where it was added. An attacker can abuse this functionality by creating a \Utility Widget\ that contains malicious JavaScript code aka XSS.


NexusPHP V1.5 has XSS via a javascript: or data: URL in a UBBCode url tag.


The

WHM

Upload

Locale

interface

in

cPanel

before

before

before

before

before

and

before

has

XSS

via

a

locale

filename

aka


Bolt CMS 3.2.14 allows stored XSS via text input as demonstrated by the Title field of a New Entry.


Persistent XSS through the SSID of nearby Wi-Fi devices on Technicolor TC7337 routers 08.89.17.20.00 allows an attacker to cause DNS Poisoning and steal credentials from the router.


in

ConnectWise

Manage

allows

arbitrary

client-side

JavaScript

code

execution

(involving

a

ContactCommon

field)

on

victims

who

click

on

a

crafted

link

aka

XSS.


In J2 Innovations FIN Stack 4.0 the authentication webform is vulnerable to reflected XSS via the query string to /login.


application/core/controller/images.php in FineCMS through 2017-07-12 allows remote authenticated admins to conduct XSS attacks by uploading an image via a route=images action.


MetInfo through 5.3.17 allows stored XSS via HTML Edit Mode.


FineCMS through 2017-07-11 has stored XSS in the logging functionality as demonstrated by an XSS payload in (1) the User-Agent header of an HTTP request or (2) the username entered on the login screen.


interface/js/app/history.js in WebUI in Rspamd before 1.6.3 allows XSS via the Subject and Message-Id headers which are mishandled in the history page.


dayrui FineCms through 5.0.10 has Cross Site Scripting (XSS) in controllers/api.php via the function parameter in a c=api&m=data2 request.


Pulse Connect Secure 8.3R1 has Reflected XSS in adminservercacertdetails.cgi. In the admin panel the certid parameter of adminservercacertdetails.cgi is reflected in the application's response and is not properly sanitized allowing an attacker to inject tags. An attacker could come up with clever payloads to make the system run commands such as ping ping6 traceroute nslookup arp etc.


phpLDAPadmin through 1.2.3 has XSS in htdocs/entry_chooser.php via the form element rdn or container parameter.


dayrui FineCms 5.0.9 has Cross Site Scripting (XSS) in admin/Login.php via a payload in the username field that does not begin with a '<' character.


FineCMS through 2017-07-11 has stored XSS in route=admin when modifying user information and in route=register when registering a user account.


Pulse Connect Secure 8.3R1 has Reflected XSS in launchHelp.cgi. The helpLaunchPage parameter is reflected in an IFRAME element if the value contains two quotes. It properly sanitizes quotes and tags so one cannot simply close the src with a quote and inject after that. However an attacker can use javascript: or data: to abuse this.


A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.2.8x prior to 1.2.8p25 and 1.4.0x prior to 1.4.0p9 allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript via the output_format parameter and the username parameter of failed HTTP basic authentication attempts which is returned unencoded in an internal server error page.


Bolt CMS 3.2.14 allows stored XSS by uploading an SVG document with a \Content-Type: image/svg+xml\ header.


Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 allows remote attackers to obtain an authenticated user's password via XSS vulnerabilities or sniffing non-SSL traffic on the network because the password is represented in a cookie with a reversible encoding method.


In Rise Ultimate Project Manager v1.8 XSS vulnerabilities were found in the Messaging section. Subject and Message fields are vulnerable.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the \JavaScriptCore\ component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that triggers prototype mishandling.


An issue was discovered in certain Apple products. macOS before 10.12.3 is affected. The issue involves the \Help Viewer\ component which allows XSS attacks via a crafted web site.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the \WebKit\ component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with frame loading.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. tvOS before 10.2.1 is affected. The issue involves the \WebKit\ component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with WebKit Editor commands.


HP has identified a potential security vulnerability with HP Enterprise LaserJet Printers and MFPs HP OfficeJet Enterprise Color Printers and MFP HP PageWide Color Printers and MPS before 2308214_000901 2308214_000900 and other firmware versions. The vulnerability could be exploited to perform a cross site scripting (XSS) attack.


JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote authenticated attackers that have privileges to create lists can store scripts in them which are not properly sanitized before showing to other users including admins.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the \WebKit\ component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with container nodes.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the \WebKit\ component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted frame objects.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the \WebKit\ component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with pageshow events.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. tvOS before 10.2 is affected. The issue involves the \WebKit\ component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via crafted use of frames on a web site.


An issue was discovered in certain Apple products. iOS before 10.3 is affected. The issue involves the \Safari Reader\ component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site.


An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. Safari before 10.1.1 is affected. The issue involves the \WebKit\ component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that improperly interacts with cached frames.


A stored XSS (Cross-Site-Scripting) vulnerability in Fortinet FortiOS allows attackers to execute unauthorized code or commands via the policy global-label parameter.


Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to DOM XSS in the edit-tag functionality.


Embedding Script (XSS) in HTTP Headers vulnerability in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote authenticated users to view confidential information via a cross site request forgery attack.


An unauthenticated XSS vulnerability with FortiMail 5.0.0 - 5.2.9 and 5.3.0 - 5.3.8 could allow an attacker to execute arbitrary scripts in the security context of the browser of a victim logged in FortiMail assuming the victim is social engineered into clicking an URL crafted by the attacker.


Apache Atlas versions 0.6.0-incubating and 0.7.0-incubating were found vulnerable to Reflected XSS in the search functionality.


REDCap before 7.5.1 has XSS via the query string.


admin/profile.php in GetSimple CMS 3.x has XSS in a name field.


In

FineCMS

before

allows

XSS

in

the

and

meaning

parameters.


In ObjectPlanet Opinio before 7.6.4 there is XSS.


phpSocial (formerly phpDolphin) before 3.0.1 has XSS in the PATH_INFO to the search/tag/ URI.


In SimpleRisk 20170614-001 a CSRF attack on reset.php (aka the Send Password Reset Email form) can insert XSS sequences via the user parameter.


The WP Statistics plugin through 12.0.9 for WordPress has XSS in the rangestart and rangeend parameters on the wps_referrers_page page.


Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2 There is a stored XSS vulnerability via the $value->gallery_name and $value->gallery_description where anyone with privileges to modify or add galleries/images and inject javascript into the database.


AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addition of a domain.


The

Management

Console

in

Application

Server

Business

Process

Server

Business

Rules

Server

Complex

Event

Processor

Dashboard

Server

Data

Analytics

Server

Data

Services

Server

and

Machine

Learner

is

affected

by

stored

XSS.


The administration user deletion resource in Atlassian Fisheye and Crucible before version 4.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the uname parameter.


OWASP AntiSamy before 1.5.7 allows XSS via HTML5 entities as demonstrated by use of : to construct a javascript: URL.


Data

Analytics

Server

has

XSS

in

via

the

collectionName

or

parentPath

parameter.


Stored XSS vulnerability via IMG element at \Leadname\ of CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript which is mishandled during rendering by the application administrator and other users.


A Reflected XSS Vulnerability affects the forgotten password page of Maplesoft Maple T.A. 2016.0.6 (Customer Hosted) via the emailAddress parameter to passwordreset/PasswordReset.do aka Open Bug Bounty ID OBB-286688.


CrushFTP before 7.8.0 and 8.x before 8.2.0 has XSS.


The checktitle function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the module field.


In

GeniXCMS

has

XSS

via

the

id

parameter.


NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to fun.php in a delete action.


EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have XSS in the sms_content parameter in a getSMSlist request.


SilverStripe

CMS

before

has

XSS

via

an

SVG

document

that

is

mishandled

by

the

Insert

Media

option

in

the

content

editor

or

an

admin/assets/add

pathname

as

demonstrated

by

the

admin/pages/edit/EditorToolbar/MediaForm/field/AssetUploadField/upload

URI

aka

issue


Stored XSS vulnerability via IMG element at \History\ of Profile Calendar Tasks and CRM in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript which is mishandled during rendering by the application administrator and other users.


In BlackCat CMS 1.2 backend/settings/ajax_save_settings.php allows remote authenticated users to conduct XSS attacks via the Website header or Website footer field.


The oauth function in controllers/member/api.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.


WP_Admin_UI in the Crony Cronjob Manager plugin before 0.4.7 for WordPress has CSRF via the name parameter in an action=manage&do=create operation as demonstrated by inserting XSS sequences.


The Log Query and Quarantine Query pages in Trend Micro ScanMail for Exchange 12.0 are vulnerable to cross site scripting (XSS) attacks.


The call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 might have XSS related to the Referer HTTP header with Internet Explorer.


In GeniXCMS 1.1.4 gxadmin/index.php has XSS via the Menu ID field in a page=menus request.


In GeniXCMS 1.1.4 /inc/lib/backend/menus.control.php has XSS via the id parameter.


The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the jqlQuery query parameter.


Auth 2.0 Authorization Server of ForgeRock Access Management (OpenAM) 13.5.0-13.5.1 and Access Management (AM) 5.0.0-5.1.1 does not correctly validate redirect_uri for some invalid requests which allows attackers to execute a script in the user's browser via reflected XSS.


geminabox (aka Gem in a Box) before 0.13.6 has XSS as demonstrated by uploading a gem file that has a crafted gem.homepage value in its .gemspec file.


XSS (persistent) on the Intelbras Wireless N 150Mbps router with firmware WRN 240 allows attackers to steal wireless credentials without being connected to the network related to userRpm/popupSiteSurveyRpm.htm and userRpm/WlanSecurityRpm.htm. The attack vector is a crafted ESSID as demonstrated by an \airbase-ng -e\ command.


The Participants Database plugin before 1.7.5.10 for WordPress has XSS.


Stored XSS vulnerability via a comment in inc/conv.php in BlogoText before 3.7.6 allows an unauthenticated attacker to inject JavaScript. If the victim is an administrator an attacker can (for example) change global settings or create/delete posts. It is also possible to execute JavaScript against unauthenticated users of the blog.


Stored XSS vulnerability via IMG element at \Filename\ of Filemanager in Tine 2.0 Community Edition before 2017.08.4 allows an authenticated user to inject JavaScript which is mishandled during rendering by the application administrator and other users.


The out function in controllers/member/Login.php in dayrui FineCms 5.0.11 has XSS related to the Referer HTTP header with Internet Explorer.


The shibboleth_login_form function in shibboleth.php in the Shibboleth plugin before 1.8 for WordPress is prone to an XSS vulnerability due to improper use of add_query_arg().


The Intense WP \WP Jobs\ plugin 1.5 for WordPress has XSS related to the Job Qualification field.


Both global and Room chat are vulnerable to XSS attack in Apache OpenMeetings 3.2.0.


An issue was discovered on Humax Digital HG100R 2.0.6 devices. There is XSS on the 404 page.


JavaScript can be injected into an exported bookmarks file by placing JavaScript code into user-supplied tags in saved bookmarks. If the resulting exported HTML file is later opened in a browser this JavaScript will be executed. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks if users were convinced to add malicious tags to bookmarks export them and then open the resulting file. This vulnerability affects Firefox < 57.


In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0) inadequate filtering of specific HTML attributes leads to XSS vulnerabilities in various components.


trollepierre/tdm before 2017-04-13 is vulnerable to a reflected XSS in tdm-master/webhook.php (challenge parameter).


There is reflected XSS in TOPdesk before 5.7.6 and 6.x and 7.x before 7.03.019.


Pixie 1.0.4 allows an admin/index.php s=login&m= XSS attack.


Heartland

Payment

Systems

Payment

Gateway

PHP

SDK

hps/heartland-php

is

vulnerable

to

a

reflected

XSS

in

via

the

URI

as

demonstrated

by

the

cavv

parameter.


JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload. A malformed XML file if uploaded causes an error message to appear that includes part of the bad XML code verbatim without filtering out scripts. Successful exploitation would allow execution of script code within the context of the affected user.


Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a persistent XSS vulnerability in Framework.


inc/PMF/Faq.php in phpMyFAQ before 2.9.7 has XSS in the question field.


Pixie 1.0.4 allows an admin/index.php s=settings&x= XSS attack.


In the webmail component in IceWarp Server 11.3.1.5 there was an XSS vulnerability discovered in the \language\ parameter.


A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the \WebKit\ component.


INFOR EAM V11.0 Build 201410 has XSS via comment fields.


OpenStack Horizon 9.x through 9.1.1 10.x through 10.0.2 and 11.0.0 allows remote authenticated administrators to conduct XSS attacks via a crafted federation mapping.


XSS exists in Easy WP SMTP (before 1.2.5) a WordPress Plugin via the e-mail subject or body.


Pixie 1.0.4 allows an admin/index.php s=publish&m=static&x= XSS attack.


sourcebans-pp (SourceBans++) 1.5.4.7 has XSS in admin.comms.php via the rebanid parameter.


In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0) inadequate escaping of file and folder names leads to XSS vulnerabilities in the template manager component.


A Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiOS 5.4.0 to 5.4.5 and 5.6.0 allows a remote unauthenticated attacker to execute arbitrary javascript code via webUI \Login Disclaimer\ redir parameter.


Multiple potential reflected XSS issues exist in NetIQ iManager versions before 2.7.7 Patch 10 HF2 and 3.0.3.2.


foreman before version 1.16.0 is vulnerable to a stored XSS in organizations/locations assignment to hosts. Exploiting this requires a user to actively assign hosts to an organization that contains html in its name which is visible to the user prior to taking action.


concrete5 8.1.0 places incorrect trust in the HTTP Host header during caching if the administrator did not define a \canonical\ URL on installation of concrete5 using the \Advanced Options\ settings. Remote attackers can make a GET request with any domain name in the Host header; this is stored and allows for arbitrary domains to be set for certain links displayed to subsequent visitors potentially an XSS vector.


Pixie 1.0.4 allows an admin/index.php s=publish&m=module&x= XSS attack.


Dolibarr ERP/CRM 4.0.4 has XSS in doli/societe/list.php via the sall parameter.


citymont/symetrie v.0.9.6 is vulnerable to a reflected XSS in symetrie-master/app/commands/page.php (model parameter).


In Joomla! 1.5.0 through 3.6.5 (fixed in 3.7.0) inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components.


Control characters prepended before \javascript:\ URLs pasted in the addressbar can cause the leading characters to be ignored and the pasted JavaScript to be executed instead of being blocked. This could be used in social engineering and self-cross-site-scripting (self-XSS) attacks where users are convinced to copy and paste text into the addressbar. This vulnerability affects Firefox < 57.


ILIAS before 5.2.3 has XSS via SVG documents.


ntopng before 3.0 allows XSS because GET and POST parameters are improperly validated.


An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. The issue involves the \WebKit\ component. It allows remote attackers to conduct Universal XSS (UXSS) attacks via a crafted web site that is mishandled during parent-tab processing.


TheFirstQuestion/HelpMeWatchWho before 2017-03-28 is vulnerable to a reflected XSS in HelpMeWatchWho-master/unaired.php (episodeID parameter).


In Joomla! 3.2.0 through 3.6.5 (fixed in 3.7.0) inadequate filtering leads to XSS in the template manager component.


In Apache NiFi before 0.7.4 and 1.x before 1.3.0 there are certain user input components in the UI which had been guarding for some forms of XSS issues but were insufficient.


XOOPS Core 2.5.8.1 has XSS due to unescaped HTML output of an Install DB failure error message in page_dbsettings.php.


OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input specifically terminal escape characters and the creation of clickable links automatically when viewing the log files for a pod.


A DOMParser XSS issue was discovered in certain Apple products. iOS before 10.3.3 is affected. Safari before 10.1.2 is affected. tvOS before 10.2.2 is affected. The issue involves the \WebKit\ component.


Django 1.10 before 1.10.7 1.9 before 1.9.13 and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an \on success\ URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs \safe\ when they shouldn't be aka an open redirect vulnerability. Also if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link they could suffer from an XSS attack.


The Reporting Module 1.12.0 for OpenMRS allows CSRF attacks with resultant XSS in which administrative authentication is hijacked to insert JavaScript into a name field in webapp/reports/manageReports.jsp.


Trend Micro InterScan Messaging Security Virtual Appliance (IMSVA) 9.1 before CP 1644 has XSS.


Pixie 1.0.4 allows an admin/index.php s=publish&m=dynamic&x= XSS attack.


The \Smart related articles\ extension 1.1 for Joomla! has XSS in dialog.php (n_art type in GET Method).


groovel/cmsgroovel before 3.3.7-beta is vulnerable to a reflected XSS in commons/browser.php (path parameter).


Subrion CMS 4.0.5.10 has CSRF in admin/blog/add/. The attacker can add any blog entry and can optionally insert XSS into that entry via the body parameter.


paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.shop.php (id parameter).


before

is

vulnerable

to

a

reflected

XSS

in

(id

parameter).


novaksolutions/infusionsoft-php-sdk v2016-10-31 is vulnerable to a reflected XSS in the leadscoring.php resulting code execution


andrzuk/FineCMS before 2017-03-06 is vulnerable to a reflected XSS in index.php because of missing validation of the action parameter in application/classes/application.php.


is

vulnerable

to

a

reflected

XSS

in

(id

parameter).


FenixHosting/fenix-open-source before 2017-03-04 is vulnerable to a reflected XSS in forums/search.php (search-by-topic parameter).


Subrion CMS 4.0.5 has CSRF in admin/blocks/add/. The attacker can create any block and can optionally insert XSS via the content parameter.


paintballrefjosh/MaNGOSWebV4 before 4.0.8 is vulnerable to a reflected XSS in install/index.php (step parameter).


Subrion CMS 4.0.5 has CSRF in admin/blog/add/. The attacker can add any tag and can optionally insert XSS via the tags parameter.


XSS

in

Agora-Project

exists

with

an

index.php?ctrl=file&targetObjId=fileFolder-2&targetObjIdChild=XSS

attack.


dotCMS 3.7.0 has XSS reachable from ext/languages_manager/edit_language in portal/layout via the bottom two form fields.


paypal/invoice-sdk-php is vulnerable to reflected XSS in samples/permissions.php via the permToken parameter resulting in code execution.


is

vulnerable

to

a

reflected

XSS

in

(linkid

parameter).


paypal/adaptivepayments-sdk-php v3.9.2 is vulnerable to a reflected XSS in the SetPaymentOptions.php resulting code execution


paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.faq.php (id parameter).


XSS

in

Agora-Project

exists

with

an

index.php?ctrl=misc&action=XSS&editObjId=XSS

attack.


Persistent XSS Vulnerability in Wordpress plugin AnyVar v0.1.1.


paintballrefjosh/MaNGOSWebV4 4.0.8 is vulnerable to a reflected XSS in inc/admin/template_files/admin.vote.php (id parameter).


paypal/permissions-sdk-php is vulnerable to reflected XSS in the samples/GetAccessToken.php verification_code parameter resulting in code execution.


Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 before CP 1746 does not sanitize a rest/commonlog/report/template name field which allows a 'Reports Only' user to inject malicious JavaScript while creating a new report. Additionally IWSVA implements incorrect access control that allows any authenticated remote user (even with low privileges like 'Auditor') to create or modify reports and consequently take advantage of this XSS vulnerability. The JavaScript is executed when victims visit reports or auditlog pages.


XSS in Agora-Project 3.2.2 exists with an index.php?disconnect=1&msgNotif=XSS attack.


Gargaj/wuhu through 2017-03-08 is vulnerable to a reflected XSS in wuhu-master/www_admin/users.php (id parameter).


Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action and can optionally insert XSS via the title parameter.


XSS in Agora-Project 3.2.2 exists with an index.php?ctrl=object&action=XSS attack.


WebUI in qBittorrent before 3.3.11 did not escape many values which could potentially lead to XSS.


DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1 7.7.2 7.7.3 7.7.5 7.7.6 7.9.0 and 7.9.1 via a crafted URI.


rate-me.php in Rate Me 1.0 has XSS via the id field in a rate action.


In Redmine before 3.2.6 and 3.3.x before 3.3.3 stored XSS is possible by using an SVG document as an attachment.


Mahara 15.04 before 15.04.15 16.04 before 16.04.9 16.10 before 16.10.6 and 17.04 before 17.04.4 are vulnerable to a user submitting a potential dangerous payload e.g. XSS code to be saved as titles in internal artefacts.


include/global_session.php in Cacti 1.1.25 has XSS related to (1) the URI or (2) the refresh page.


A persistent (stored) XSS vulnerability in the EyesOfNetwork web interface (aka eonweb) 5.1-0 allows remote authenticated administrators to inject arbitrary web script or HTML via the hosts array parameter to module/admin_device/index.php.


Reflected XSS vulnerability in Shaarli v0.9.1 allows an unauthenticated attacker to inject JavaScript via the searchtags parameter to index.php. If the victim is an administrator an attacker can (for example) take over the admin session or change global settings or add/delete links. It is also possible to execute JavaScript against unauthenticated users.


In Redmine before 3.2.8 3.3.x before 3.3.5 and 3.4.x before 3.4.3 XSS exists in app/helpers/application_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of issue history.


The Easy Appointments plugin before 1.12.0 for WordPress has XSS via a Settings values in the admin panel.


Simple ASC Content Management System v1.2 has XSS in the location field in the sign function related to guestbook.asp formgb.asp and msggb.asp.


In Redmine before 3.2.8 3.3.x before 3.3.5 and 3.4.x before 3.4.3 XSS exists in app/views/timelog/_list.html.erb via crafted column data.


The Admin Console in Ignite Realtime Openfire Server before 4.1.7 allows arbitrary client-side JavaScript code execution on victims who click a crafted setup/setup-host-settings.jsp?domain= link aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections injection of iframes to establish communication channels etc. The vulnerability is present after login into the application.


There is XSS in the BouquetEditor WebPlugin for Dream Multimedia Dreambox devices as demonstrated by the \Name des Bouquets\ field or the file parameter to the /file URI.


Stored

XSS

vulnerability

in

Flyspray

before

allows

an

authenticated

user

to

inject

JavaScript

to

gain

administrator

privileges

and

also

to

execute

JavaScript

against

other

users

(including

unauthenticated

users)

via

the

name

title

or

id

parameter

to


In Redmine before 3.2.8 3.3.x before 3.3.5 and 3.4.x before 3.4.3 XSS exists in app/helpers/queries_helper.rb via a multi-value field with a crafted value that is mishandled during rendering of an issue list.


In Redmine before 3.2.8 3.3.x before 3.3.5 and 3.4.x before 3.4.3 XSS exists in app/views/issues/_list.html.erb via crafted column data.


A

flaw

in

the

way

URLs

are

escaped

and

encoded

in

the

org.apache.sling.xss.impl.XSSAPIImpl#getValidHref

and

org.apache.sling.xss.impl.XSSFilterImpl#isValidHref

allows

special

crafted

URLs

to

pass

as

valid

although

they

carry

XSS

payloads.

The

affected

versions

are

Apache

Sling

XSS

Protection

API

to

Apache

Sling

XSS

Protection

API

Compat

and

Apache

Sling

XSS

Protection

API


In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel.


In PHPSUGAR PHP Melody before 2.7.3 page_manager.php has XSS via the page_title parameter.


MISP

before

has

a

potential

reflected

XSS

in

a

quickDelete

action

that

is

used

to

delete

a

sighting

related

to

and


The Pootle Button plugin before 1.2.0 for WordPress has XSS via the assets_url parameter in assets/dialog.php exploitable via wp-admin/admin-ajax.php.