An attacker submitting facts to the Foreman server containing HTML can cause a stored XSS on certain pages: (1) Facts page when clicking on the \chart\ button and hovering over the chart; (2) Trends page when checking the graph for a trend based on a such fact; (3) Statistics page for facts that are aggregated on this page.


In Redmine before 3.2.6 and 3.3.x before 3.3.3 XSS exists because markup is mishandled in wiki content.


Stored

XSS

vulnerability

in

the

Media

Objects

component

of

ILIAS

before

and

before

allows

an

authenticated

user

to

inject

JavaScript

to

gain

administrator

privileges

related

to

the

setParameter

function

in


Perch Content Management System 3.0.3 allows unrestricted file upload (with resultant XSS) via the Asset Title field in conjunction with the Select File field. This is exploitable with a Limited Admin account.


app/sections/user-menu.php in phpIPAM before 1.3.1 has XSS via the ip parameter.


A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP (Content Security Policy) prevents exploitation of this XSS however not all browsers support CSP.


In Artica Pandora FMS version 7.0 an Attacker with write Permission can create an agent with an XSS Payload; when a user enters the agent definitions page the script will get executed.


osTicket 1.10.1 allows arbitrary client-side JavaScript code execution on victims who click a crafted support/scp/tickets.php?status= link aka XSS. Session ID and data theft may follow as well as the possibility of bypassing CSRF protections injection of iframes to establish communication channels etc. The vulnerability is present after login into the application. This affects a different tickets.php file than CVE-2015-1176.


XSS exists in NexusPHP 1.5 via the keyword parameter to messages.php.


mistune.py in Mistune 0.7.4 allows XSS via an unexpected newline (such as in java\\nscript:) or a crafted email address related to the escape and autolink functions.


The Java administration console in SAP CRM has XSS. This is SAP Security Note 2478964.


The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php.


An issue was discovered in these Pivotal RabbitMQ versions: all 3.4.x versions all 3.5.x versions and 3.6.x versions prior to 3.6.9; and these RabbitMQ for PCF versions: all 1.5.x versions 1.6.x versions prior to 1.6.18 and 1.7.x versions prior to 1.7.15. Several forms in the RabbitMQ management UI are vulnerable to XSS attacks.


Embedding Script (XSS) in HTTP Headers vulnerability in the server in McAfee Network Data Loss Prevention (NDLP) 9.3.x allows remote attackers to get session/cookie information via modification of the HTTP request.


Readymade Job Site Script has XSS via the keyword parameter to the /job URI.


Zoho ManageEngine Password Manager Pro 9 before 9.4 (9400) has reflected XSS in SearchResult.ec and BulkAccessControlView.ec.


Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request.


Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting (XSS) vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid direct $_GET and $_POST usage where possible and instead use param_exists() and the correct param_*() function to fetch the expected value.


Bus Booking Script has XSS via the results.php datepicker parameter or the admin/new_master.php spemail parameter.


The test_sql_and_script_inject function in htdocs/main.inc.php in Dolibarr ERP/CRM 6.0.4 blocks some event attributes but neither onclick nor onscroll which allows XSS.


PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php.


custom/run.cgi in Webmin before 1.870 allows remote authenticated administrators to conduct XSS attacks via the description field in the custom command functionality.


Techno - Portfolio Management Panel through 2017-11-16 allows XSS via the panel/search.php s parameter.


Jenkins through 2.93 allows remote authenticated administrators to conduct XSS attacks via a crafted tool name in a job configuration form as demonstrated by the JDK tool in Jenkins core and the Ant tool in the Ant plugin aka SECURITY-624.


Ability Mail Server 3.3.2 has Cross Site Scripting (XSS) via the body of an e-mail message with JavaScript code executed on the Read Mail screen (aka the /_readmail URI). This is fixed in version 4.2.4.


wp-includes/feed.php in WordPress before 4.9.1 does not properly restrict enclosures in RSS and Atom fields which might allow attackers to conduct XSS attacks via a crafted URL.


An XSS issue was discovered in Designer Studio in Pegasystems Pega Platform 7.1.7 7.1.8 7.1.9 7.1.10 7.2 7.2.1 and 7.2.2. A user with developer credentials can insert malicious code (up to 64 characters) into a text field in Designer Studio after establishing context. Designer Studio is the developer workbench for Pega Platform. That XSS payload will execute when other developers visit the affected pages.


cgi/surgeftpmgr.cgi (aka the Web Manager interface on TCP port 7021 or 9021) in NetWin SurgeFTP version 23f2 has XSS via the classid domainid or username parameter.


The WP Mailster plugin before 1.5.5 for WordPress has XSS in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php.


Cells Blog 3.5 has XSS via the pub_readpost.php fmid parameter.


Trape before 2017-11-05 has XSS via the /nr red parameter the /nr vId parameter the /register User-Agent HTTP header the /register country parameter the /register countryCode parameter the /register cpu parameter the /register isp parameter the /register lat parameter the /register lon parameter the /register org parameter the /register query parameter the /register region parameter the /register regionName parameter the /register timezone parameter the /register vId parameter the /register zip parameter or the /tping id parameter.


Readymade Video Sharing Script has XSS via the search_video.php search parameter the viewsubs.php chnlid parameter or the user-profile-edit.php fname parameter.


Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.


packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request aka Open Bug Bounty ID OBB-466362.


The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diagnostics.html or /storage_info.html.


wp-includes/functions.php in WordPress before 4.9.1 does not require the unfiltered_html capability for upload of .js files which might allow remote attackers to conduct XSS attacks via a crafted file.


Bose SoundTouch devices allow XSS via crafted song data from a music service as demonstrated by Pandora.


Paid To Read Script 2.0.5 has XSS via the referrals.php tier parameter or the admin/userview.php uid parameter.


The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection leak in the windowId handling. The default size of the windowId get's cut off after 10 characters (by default) so the impact might be limited. A fix got applied and released in Apache deltaspike-1.8.1.


Kliqqi CMS 3.5.2 has XSS via a crafted group name in pligg/groups.php a crafted Homepage string in a profile or a crafted string in Tags or Description within pligg/submit.php.


FS Lynda Clone has XSS via the keywords parameter to tutorial/ or the edit_profile_first_name parameter to user/edit_profile.


The

Emag

Marketplace

Connector

plugin

for

WordPress

has

reflected

XSS

because

the

parameter

\post\

to

is

not

filtered

correctly.


In Apache Airflow 1.8.2 and earlier an experimental Airflow feature displayed authenticated cookies as well as passwords to databases used by Airflow. An attacker who has limited access to airflow whether it be via XSS or by leaving a machine unlocked can exfiltrate all credentials from the system.


ZyXEL ZyWALL USG 2.12 AQQ.2 and 3.30 AQQ.7 devices are affected by a CSRF vulnerability via a cgi-bin/zysh-cgi cmd action to add a user account. This account's access could for example subsequently be used for stored XSS.


The Clockwork SMS clockwork-test-message.php component has XSS via a crafted \to\ parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3 Two-Factor Authentication - Clockwork SMS 1.0.2 Booking Calendar - Clockwork SMS 1.0.5 Contact Form 7 - Clockwork SMS 2.3.0 Fast Secure Contact Form - Clockwork SMS 2.1.2 Formidable - Clockwork SMS 1.0.2 Gravity Forms - Clockwork SMS 2.2 and WP e-Commerce - Clockwork SMS 2.0.5.


PHP Scripts Mall Single Theater Booking has XSS via the admin/viewtheatre.php theatreid parameter.


PHP Scripts Mall Responsive Realestate Script has XSS via the admin/general.php gplus parameter.


packages/core/contact.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?p=core/contact request aka Open Bug Bounty ID OBB-278503.


wp-includes/general-template.php in WordPress before 4.9.1 does not properly restrict the lang attribute of an HTML element which might allow attackers to conduct XSS attacks via the language setting of a site.


Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify.


The mgl-instagram-gallery plugin for WordPress has XSS via the single-gallery.php media parameter.


There is a reflected XSS vulnerability in ZKTime Web 2.0.1.12280. The vulnerability exists due to insufficient filtration of user-supplied data in the 'Range' field of the 'Department' module in a Personnel Advanced Query. A remote attacker can execute arbitrary HTML and script code in the browser in the context of the vulnerable application.


Scubez Posty Readymade Classifieds has XSS via the admin/user_activate_submit.php ID parameter.


Synacor Zimbra Collaboration Suite (ZCS) before 8.8.3 has Persistent XSS.


Pexip Infinity before 17 allows an unauthenticated remote attacker to achieve stored XSS via management web interface views.


The dump function in Util/TemplateHelper.php in filp whoops before 2.1.13 has XSS.


XSS exists on D-Link DWR-933 1.00(WW)B17 devices via cgi-bin/gui.cgi.


In CMS Made Simple 2.2.3.1 the is_file_acceptable function in modules/FileManager/action.upload.php only blocks file extensions that begin or end with a \php\ substring which allows remote attackers to bypass intended access restrictions or trigger XSS via other extensions as demonstrated by .phtml .pht .html or .svg.


b3log Symphony (aka Sym) 2.2.0 allows an XSS attack by sending a private letter with a certain /article URI and a second private letter with a modified title.


Arris TG1682G devices with Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajax_managed_services.php service parameter.


The installer in MyBB before 1.8.13 has XSS.


The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator.


The invalidRedirectUrl template in Atlassian Application Links before version 5.2.7 from version 5.3.0 before version 5.3.4 and from version 5.4.0 before version 5.4.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the redirectUrl parameter link in the redirect warning message.


In the sharingGroupPopulateOrganisations function in app/webroot/js/misp.js in MISP 2.4.82 there is XSS via a crafted organisation name that is manually added.


The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the orderby parameter.


In admin/write-post.php in Typecho through 1.1 one can log in to the background page write a new article and add payload in the article content resulting in XSS via index.php/action/contents-post-edit.


The WebMail components (Crystal pronto and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation (3) e-mail granting access to a directory that has JavaScript in its name (4) JavaScript in a note name (5) JavaScript in a task name or (6) HTML e-mail that is mishandled in the Inbox component.


Inedo BuildMaster before 5.8.2 has XSS.


In TinyWebGallery v2.4 an XSS vulnerability is located in the `mkname` `mkitem` and `item` parameters of the `Add/Create` module. Remote attackers with low-privilege user accounts for backend access are able to inject malicious script codes into the `TWG Explorer` item listing. The request method to inject is POST and the attack vector is located on the application-side of the service. The injection point is the add/create input field and the execution point occurs in the item listing after the add or create.


b3log Symphony (aka Sym) 2.2.0 does not properly address XSS in JSON objects as demonstrated by a crafted userAvatarURL value to /settings/avatar related to processor/AdminProcessor.java processor/ArticleProcessor.java processor/UserProcessor.java service/ArticleQueryService.java service/AvatarQueryService.java and service/CommentQueryService.java.


GitBook is a command line tool (and Node.js library) for building beautiful books using GitHub/Git and Markdown (or AsciiDoc). Stored Cross-Site-Scripting (XSS) is possible in GitBook before 3.2.2 by including code outside of backticks in any ebook. This code will be executed on the online reader.


dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field.


Reflected

XSS

in

Kubik-Rubik

SIGE

(aka

Simple

Image

Gallery

Extended)

before

allows

attackers

to

execute

JavaScript

in

a

victim's

browser

by

having

them

visit

a

link

with

a

crafted

img

name

or

caption

parameter.


Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasic.


b3log Symphony (aka Sym) 2.2.0 has XSS in processor/AdminProcessor.java in the admin console as demonstrated by a crafted X-Forwarded-For HTTP header that is mishandled during display of a client IP address in /admin/user/userid.


Multiple persistent stored Cross-Site-Scripting (XSS) vulnerabilities in the files /wb/admin/admintools/tool.php (Droplet Description) and /install/index.php (Site Title) in WebsiteBaker 2.10.0 allow attackers to insert persistent JavaScript code that gets reflected back to users in multiple areas in the application.


RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a reflected Cross Site Scripting (XSS) attack via the service parameter to the /soap URI triggering an invalid attempt to generate WSDL.


In Bludit v1.5.2 and v2.0.1 an XSS vulnerability is located in the new page new category and edit post function body message context. Remote attackers are able to bypass the basic editor validation to trigger cross site scripting. The XSS is persistent and the request method to inject via editor is GET. To save the editor context the followup POST method request must be processed to perform the attack via the application side. The basic validation of the editor does not allow injecting script codes and blocks the context. Attackers can inject the code by using an editor tag that is not recognized by the basic validation. Thus allows a restricted user account to inject malicious script code to perform a persistent attack against higher privilege web-application user accounts.


installer.php

in

the

Snap

Creek

Duplicator

(WordPress

Site

Migration

Backup)

plugin

before

for

WordPress

has

XSS

because

the

values

(/wp-content/plugins/duplicator/installer/build/view.step4.php)

and

\logging\

(wp-content/plugins/duplicator/installer/build/view.step2.php)

are

not

filtered

correctly.


Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags the result is a potential XSS vulnerability.


In Home Assistant before 0.57 it is possible to inject JavaScript code into a persistent notification via crafted Markdown text aka XSS.


In Horde Groupware 5.2.19 and 5.2.21 there is XSS via the Color field in a Create Task List action.


The PieChart gadget in Atlassian Jira before version 7.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a project or filter.


The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows remote attackers to inject arbitrary HTML or JavaScript via cross site scripting (XSS) vulnerabilities in various rss properties which were used as links without restriction on their scheme.


An issue was discovered in Zammad before 1.0.4 1.1.x before 1.1.3 and 1.2.x before 1.2.1. XSS can be triggered via malicious HTML in a chat message or the content of a ticket article when using either the REST API or the WebSocket API.


An issue was discovered in the WP Mail plugin before 1.2 for WordPress. The replyto parameter when composing a mail allows for a reflected XSS. This would allow you to execute JavaScript in the context of the user receiving the mail.


An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header.


Blink in Google Chrome prior to 56.0.2924.76 for Linux Windows and Mac and 56.0.2924.87 for Android allowed attacker controlled JavaScript to be run during the invocation of a private script method which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.


In

the

Kunena

extension

through

for

Joomla!

the

forum

message

subject

(aka

topic

subject)

accepts

JavaScript

leading

to

XSS.

Six

files

are

affected:

and

This

is

fixed

in


In version 3.5 and prior of Cambium Networks ePMP firmware an attacker who knows (or guesses) the SNMP read/write (RW) community string can insert XSS strings in certain SNMP OIDs which will execute in the context of the currently-logged on user.


When a \javascript:\ URL is drag and dropped by a user into the addressbar the URL will be processed and executed. This allows for users to be socially engineered to execute an XSS attack on themselves. This vulnerability affects Firefox < 53.


There is XSS in SilverStripe CMS before 3.4.4 and 3.5.x before 3.5.2. The attack vector is a page name. An example payload is a crafted JavaScript event handler within a malformed SVG element.


XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac Windows and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page.


NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+ when configured as an Identity Server has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document.


The \mozAddonManager\ allows for the installation of extensions from the CDN for addons.mozilla.org a publicly accessible site. This could allow malicious extensions to install additional extensions from the CDN in combination with an XSS attack on Mozilla AMO sites. This vulnerability affects Firefox < 51.


Incorrect application of sandboxing in Blink in Google Chrome prior to 62.0.3202.62 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted MHTML page.


Incorrect MIME type of XSS-Protection reports in Blink in Google Chrome prior to 58.0.3029.81 for Linux Windows and Mac and 58.0.3029.83 for Android allowed a remote attacker to circumvent Cross-Origin Resource Sharing checks via a crafted HTML page.


Multiple

reflected

XSS

vulnerabilities

exist

within

form

and

link

input

parameters

of

ZoneMinder

and

an

open-source

CCTV

server

web

application

which

allows

a

remote

attacker

to

execute

malicious

scripts

within

an

authenticated

client's

browser.

The

URL

is

and

sample

parameters

could

include

action=login&view=postloginXSS

view=consoleXSS

view=groupsXSS

view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=andXSS

view=events&filter%5Bterms%5D%5B1%5D%5Bcnj%5D=XSSand

(among

others).


In version 3.5 and prior of Cambium Networks ePMP firmware an attacker who knows or can guess the RW community string can provide a URL for a configuration file over SNMP with XSS strings in certain SNMP OIDs serve it via HTTP and the affected device will perform a configuration restore using the attacker's supplied config file including the inserted XSS strings.


Blink in Google Chrome prior to 56.0.2924.76 for Linux Windows and Mac and 56.0.2924.87 for Android incorrectly handled the sequence of events when closing a page which allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.


Croogo version 2.3.1-17-g6f82e6c contains a Cross Site Scripting (XSS) vulnerability in Page name that can result in execution of javascript code.


Soyket Chowdhury Vehicle Sales Management System version 2017-07-30 is vulnerable to multiple SQL Injecting in login/vehicle.php login/profile.php login/Actions.php login/manage_employee.php and login/sell.php scripts resulting in the expose of user's login credentials SQL Injection and Stored XSS vulnerability which leads to remote code executing.


marked version 0.3.6 and earlier is vulnerable to an XSS attack in the data: URI parser.


Invoice Plane version 1.5.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Client's details that can result in execution of javascript code . This vulnerability appears to have been fixed in 1.5.5 and later.


Rocket.Chat version 0.8.0 and newer is vulnerable to XSS in the markdown link parsing code for messages.


WBCE

is

vulnerable

to

reflected

XSS

via

the

\begriff\

POST

parameter

in

/admin/admintools/tool.php?tool=user_search


Leanote version <= 2.5 is vulnerable to XSS due to not sanitized input in markdown notes


Stored XSS vulnerabilities in chevereto CMS before version 3.8.11 one in the user profile and one in the Exif data parser.


Shiba markdown live preview app version 1.1.0 is vulnerable to XSS which leads to code execution due to enabled node integration.


MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying the data in the database to the user


Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.


LogicalDoc Community Edition 7.5.3 and prior is vulnerable to an XSS when using preview on HTML document.


Stored XSS in Salutation Responsive WordPress + BuddyPress Theme version 3.0.15 could allow logged-in users to do almost anything an admin can


Plotly Inc. plotly.js versions prior to 1.16.0 are vulnerable to an XSS issue.


MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in ExtKeyUsage extension) on X.509 certificates.


Dolibarr version 6.0.2 contains a Cross Site Scripting (XSS) vulnerability in Product details that can result in execution of javascript code.


Linux foundation ONOS 1.9 is vulnerable to XSS in the device. registration


flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER'PHP_SELF' to build links and a stored XSS in the admin log panel by specifying a malformed User-Agent string.


Leanote-desktop version v2.5 is vulnerable to a XSS which leads to code execution due to enabled node integration


Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener attack


Reflected XSS in Relevanssi Premium version 1.14.8 when using relevanssi_didyoumean() could allow unauthenticated attacker to do almost anything an admin can


MatrixSSL version 3.7.2 has an incorrect UTCTime date range validation in its X.509 certificate validation process resulting in some certificates have their expiration (beginning) year extended (delayed) by 100 years.


Mahara

before

and

before

and

before

are

vulnerable

to

XSS

due

to

window.opener

and

window.open())


Tine 2.0 version 2017.02.4 is vulnerable to XSS in the Addressbook resulting code execution and privilege escalation


Passbolt API version 1.6.4 and older are vulnerable to a XSS in the url field on the password workspace


PHPMiniAdmin version 1.9.160630 is vulnerable to stored XSS in the name of databases tables and columns resulting in potential account takeover and scraping of data (stealing data).


Eleix Openhacker version 0.1.47 is vulnerable to a XSS vulnerability in the bank transactions component resulting in arbitrary code execution in the browser.


rui Li finecms 5.0.10 is vulnerable to a reflected XSS in the file Weixin.php.


MyWebSQL version 3.6 is vulnerable to stored XSS in the database manager component resulting in account takeover or stealing of information


eZ Systems eZ Publish version 5.4.0 to 5.4.9 and 5.3.12 and older is vulnerable to an XSS issue in the search module resulting in a risk of attackers injecting scripts which may e.g. steal authentication credentials.


WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site


cPanel before 66.0.2 allows stored XSS during WHM cPAddons processing (SEC-269).


The examapp plugin 1.0 for WordPress has XSS via exam input text fields.


The moreads-se plugin before 1.4.7 for WordPress has XSS.


Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allow remote attackers who have permission to add or modify a repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the location setting of a configured repository.


The bws-pinterest plugin before 1.0.5 for WordPress has multiple XSS issues.


cPanel before 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).


The weblibrarian plugin before 3.4.8.7 for WordPress has XSS via front-end short codes.


An issue was discovered in Mattermost Server before 4.3.0 4.2.1 and 4.1.2. XSS could occur via the title_link field of a Slack attachment.


The Qards plugin through 2017-10-11 for WordPress has XSS via a remote document specified in the url parameter to html2canvasproxy.php.


The wiki markup component of atlassian-renderer from version 8.0.0 before version 8.0.22 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in nested wiki markup.


The bws-testimonials plugin before 0.1.9 for WordPress has multiple XSS issues.


The eelv-newsletter plugin before 4.6.1 for WordPress has XSS in the address book.


The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jira administrator to import their Trello board to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the title of a Trello card.


The updater plugin before 1.35 for WordPress has multiple XSS issues.


The IncomingMailServers resource in Atlassian Jira from version 6.2.1 before version 7.4.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter.


The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues.


The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-field-css parameter.


The analytics-tracker plugin before 1.1.1 for WordPress has XSS via a search event.


The editinword resource in Atlassian Confluence Server before version 6.4.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the contents of an uploaded file.


phpFK lite has XSS via the faq.php members.php or search.php query string or the user.php user parameter.


The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS.


cPanel before 66.0.2 allows stored XSS during WHM cPAddons uninstallation (SEC-266).


The

E-goi

Smart

Marketing

SMS

and

Newsletters

Forms

plugin

before

for

WordPress

has

XSS

via

the

url

parameter.


Certain

NETGEAR

devices

are

affected

by

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


The magic-fields plugin before 1.7.2 for WordPress has XSS via the custom-write-panel-id parameter.


The kama-clic-counter plugin before 3.5.0 for WordPress has XSS.


The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.


The embed-comment-images plugin before 0.6 for WordPress has XSS.


An issue was discovered in Mattermost Server before 4.3.0 4.2.1 and 4.1.2. XSS could occur via the author_link field of a Slack attachment.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


An NC-25986 issue was discovered in the Logging subsystem of Sophos XG Firewall with SFOS before 17.0.3 MR3. An unauthenticated user can trigger a persistent XSS vulnerability found in the WAF log page (Control Center -> Log Viewer -> in the filter option \Web Server Protection\) in the webadmin interface and execute any action available to the webadmin of the firewall (e.g. creating a new user enabling SSH or adding an SSH authorized key). The WAF log page will execute the \User-Agent\ parameter in the HTTP POST request.


The twitter-cards-meta plugin before 2.5.0 for WordPress has XSS.


The timesheet plugin before 0.1.5 for WordPress has multiple XSS issues.


The corner-ad plugin before 1.0.8 for WordPress has XSS.


cPanel before 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).


The realty plugin before 1.1.0 for WordPress has multiple XSS issues.


The sender plugin before 1.2.1 for WordPress has multiple XSS issues.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

and

before


The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWP_CreateCustomFieldPage.php custom-group-id parameter.


The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues.


Remedy Mid Tier in BMC Remedy AR System 9.1 allows XSS via the ATTKey parameter in an arsys/servlet/AttachServlet request.


The booking-sms plugin before 1.1.0 for WordPress has XSS.


The plan configure branches resource in Atlassian Bamboo before version 6.2.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the name of a branch.


Progress

Sitefinity

CMS

before

allows

XSS

via

/Pages

Parameter

Page

Title

Parameter

News

Title

Parameter

List

Title

Parameter

Document

Title

Parameter

Image

Title

Parameter

Link

Title

Parameter

Link

Title

or

Parameter

Video

Title.


cPanel before 66.0.2 allows stored XSS during WHM cPAddons file operations (SEC-265).


The visitors-online plugin before 1.0.0 for WordPress has multiple XSS issues.


The woocommerce-pdf-invoices-packing-slips plugin before 2.0.13 for WordPress has XSS via the tab or section variable on settings screens.


Certain

NETGEAR

devices

are

affected

by

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration) as demonstrated by the src attribute of an IMG element. This is fixed in 10.1.


The MyCBGenie Affiliate Ads for Clickbank Products plugin through 1.6 for WordPress has XSS via the text_ads_ajax.php border_color parameter.


The spotim-comments plugin before 4.0.4 for WordPress has multiple XSS issues.


The liveforms plugin before 3.4.0 for WordPress has XSS.


Certain

NETGEAR

devices

are

affected

by

reflected

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


The content-audit plugin before 1.9.2 for WordPress has XSS.


The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues.


The ILLID Share This Image plugin before 1.04 for WordPress has XSS via the sharer.php url parameter.


The gd-rating-system plugin before 2.1 for WordPress has XSS in log.php.


The rimons-twitter-widget plugin before 1.3 for WordPress has XSS.


The crafty-social-buttons plugin before 1.5.8 for WordPress has XSS.


An issue was discovered in Mattermost Server before 4.0.0 3.10.2 and 3.9.2. It allows XSS via an uploaded file.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


ANNKE SP1 HD wireless camera 3.4.1.1604071109 devices allow XSS via a crafted SSID.


The formcraft3 plugin before 3.4 for WordPress has stored XSS via the \New Form > Heading > Heading Text\ field.


The pagination plugin before 1.0.7 for WordPress has multiple XSS issues.


cPanel before 67.9999.103 allows stored XSS in WHM MySQL Password Change interfaces (SEC-282).


The print snippet resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the contents of a comment on the snippet.


An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.


The bws-linkedin plugin before 1.0.5 for WordPress has multiple XSS issues.


cPanel before 62.0.4 allows reflected XSS in reset-password interfaces (SEC-198).


The xo-security plugin before 1.5.3 for WordPress has XSS.


The adsense-plugin (aka Google AdSense) plugin before 1.44 for WordPress has multiple XSS issues.


LimeSurvey before 2.72.4 has Stored XSS by using the Continue Later (aka Resume later) feature to enter an email address which is mishandled in the admin panel.


An issue was discovered in Mattermost Server before 4.3.0 4.2.1 and 4.1.2. XSS could occur via a goto_location response to a slash command.


The Pinfinity theme before 2.0 for WordPress has XSS via the s parameter.


nZEDb v0.7.3.3 has XSS in the 404 error page.


The my-wp-translate plugin before 1.0.4 for WordPress has XSS.


The source browse resource in Atlassian Fisheye and Crucible before version 4.5.1 and 4.6.0 allows allows remote attackers that have write access to an indexed repository to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in via a specially crafted repository branch name when trying to display deleted files of the branch.


The time-sheets plugin before 1.5.0 for WordPress has XSS via the old timesheet list.


The searchrequest-xml resource in Atlassian Jira before version 7.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through various fields.


The user-role plugin before 1.5.6 for WordPress has multiple XSS issues.


cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).


Certain

NETGEAR

devices

are

affected

by

reflected

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


The bws-google-maps plugin before 1.3.6 for WordPress has multiple XSS issues.


The viewDeploymentVersionCommits resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a release.


The wp-whois-domain plugin 1.0.0 for WordPress has XSS via the pages/func-whois.php domain parameter.


The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

and

before


The smokesignal plugin before 1.2.7 for WordPress has XSS.


The contact-form-7-sms-addon plugin before 2.4.0 for WordPress has XSS.


Progress Sitefinity 9.1 has XSS via the Last name First name and About fields on the New User Creation Page. This is fixed in 10.1.


The ad-buttons plugin before 2.3.2 for WordPress has XSS.


Certain NETGEAR devices are affected by reflected XSS. This affects R6700v2 before 1.1.0.42 and R6800 before 1.1.0.42.


The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.


The gravity-forms-sms-notifications plugin before 2.4.0 for WordPress has XSS.


An issue was discovered in Mattermost Server before 4.2.0 4.1.1 and 4.0.5. Display names allow XSS.


The promobar plugin before 1.1.1 for WordPress has multiple XSS issues.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


The error-log-viewer plugin before 1.0.6 for WordPress has multiple XSS issues.


Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.


Certain

NETGEAR

devices

are

affected

by

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


The social-buttons-pack plugin before 1.1.1 for WordPress has multiple XSS issues.


The raygun4wp plugin before 1.8.3 for WordPress has XSS in the settings a different issue than CVE-2017-9288.


The updraftplus plugin before 1.13.5 for WordPress has XSS in rare cases where an attacker controls a string logged to a log file.


The usermacros resource in Atlassian Confluence Server before version 6.3.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the description of a macro.


The event-notifier plugin before 1.2.1 for WordPress has XSS via the loading animation.


cPanel before 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).


The download-manager plugin before 2.9.52 for WordPress has XSS via the id parameter in a wpdm_generate_password action to wp-admin/admin-ajax.php.


The megamenu plugin before 2.4 for WordPress has XSS.


The simple-membership plugin before 3.5.7 for WordPress has XSS.


The avada theme before 5.1.5 for WordPress has stored XSS.


The gnucommerce plugin before 1.4.2 for WordPress has XSS.


The weblibrarian plugin before 3.4.8.6 for WordPress has XSS via front-end short codes.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Various resources in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allow remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the base path setting of a configured file system repository.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


The mailchimp-for-wp plugin before 4.1.8 for WordPress has XSS via the return value of add_query_arg.


The view review history resource in Atlassian Crucible before version 4.4.3 (the fixed version for 4.4.x) and 4.5.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the invited reviewers for a review.


The

postman-smtp

plugin

through

for

WordPress

has

XSS

via

the

wp-admin/tools.php?page=postman_email_log

page

parameter.


The admin backupprogress action in Atlassian Fisheye and Crucible before version 4.4.3 (the fixed version for 4.4.x) and before 4.5.0 allows remote attackers with administrative privileges to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the filename of a backup.


An issue was discovered in Mattermost Server before 4.3.0 4.2.1 and 4.1.2. XSS attacks could occur against an OAuth 2.0 allow/deny page.


An issue was discovered in Mattermost Server before 3.8.2 3.7.5 and 3.6.7. XSS can occur via a link on an error page.


The football-pool plugin before 2.6.5 for WordPress has multiple XSS issues.


cPanel before 62.0.4 allows self XSS on the paper_lantern password-change screen (SEC-197).


The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search.


Cognitoys Dino devices allow XSS via the SSID.


The zendesk-help-center plugin before 1.0.5 for WordPress has multiple XSS issues.


The agile wallboard gadget in Atlassian Jira before version 7.8.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of quick filters.


The weblibrarian plugin before 3.4.8.5 for WordPress has XSS via front-end short codes.


cPanel before 66.0.2 allows stored XSS during WHM cPAddons installation (SEC-263).


An issue was discovered in Mattermost Server before 4.3.0 4.2.1 and 4.1.2. XSS can occur via OpenGraph data.


netpub/server.np in Extensis Portfolio NetPublish has XSS in the quickfind parameter aka Open Bug Bounty ID OBB-290447.


** DISPUTED ** The debug handler in Symfony before v2.7.33 2.8.x before v2.8.26 3.x before v3.2.13 and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar.


The time-sheets plugin before 1.5.2 for WordPress has multiple XSS issues.


Certain NETGEAR devices are affected by reflected XSS. This affects R6700 before 1.0.1.36 and R6900 before 1.0.1.34.


The democracy-poll plugin before 5.4 for WordPress has XSS via update_l10n in admin/class.DemAdminInit.php.


Certain

NETGEAR

devices

are

affected

by

reflected

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


The wp-all-import plugin before 3.4.6 for WordPress has XSS.


The viewDeploymentVersionJiraIssuesDialog resource in Atlassian Bamboo before version 6.2.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a release.


The bws-google-analytics plugin before 1.7.1 for WordPress has multiple XSS issues.


The contact-form-multi plugin before 1.2.1 for WordPress has multiple XSS issues.


The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter.


The share-on-diaspora plugin before 0.7.2 for WordPress has reflected XSS in share URL parameters.


Office Tracker 11.2.5 has XSS via the logincount parameter to the /otweb/OTPClientLogin URI.


The signupUser resource in Atlassian Bamboo before version 6.3.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the value of the csrf token cookie.


Certain

NETGEAR

devices

are

affected

by

reflected

XSS.

This

affects

before

before

before

before

before

before

and

before


The Backup Guard plugin before 1.1.47 for WordPress has multiple XSS issues.


The twitter-plugin plugin before 2.55 for WordPress has XSS.


Progress Sitefinity 9.1 has XSS via file upload because JavaScript code in an HTML file has the same origin as the application's own code. This is fixed in 10.1.


The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the class.zlinkpreview.php url parameter.


The customer-area plugin before 7.4.3 for WordPress has XSS via admin pages.


The custom-search-plugin plugin before 1.36 for WordPress has multiple XSS issues.


The rsvp plugin before 2.3.8 for WordPress has persistent XSS via the note field on the attendee-list screen.


The pdf-print plugin before 1.9.4 for WordPress has multiple XSS issues.


The social-login-bws plugin before 0.2 for WordPress has multiple XSS issues.


An issue was discovered in Mattermost Server before 4.0.0 3.10.2 and 3.9.2. XSS could occur via a channel header.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


cPanel before 62.0.24 allows stored XSS in the WHM cPAddons install interface (SEC-262).


The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.


The viewdefaultdecorator resource in Atlassian Confluence Server before version 6.6.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the key parameter.


On the OSNEXUS QuantaStor v4 virtual appliance before 4.3.1 if the REST call invoked does not exist an error will be triggered containing the invalid method previously invoked. The response sent to the user isn't sanitized in this case. An attacker can leverage this issue by including arbitrary HTML or JavaScript code as a parameter aka XSS.


In MODX Revolution before 2.5.7 an attacker is able to trigger Reflected XSS by injecting payloads into several fields on the setup page as demonstrated by the database_type parameter.


Bram Korsten Note through 1.2.0 is vulnerable to a reflected XSS in note-source\\ui\\editor.php (edit parameter).


andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the sitename parameter to admin.php.


In MODX Revolution before 2.5.7 a user with resource edit permissions can inject an XSS payload into the title of any post via the pagetitle parameter to connectors/index.php.


The review file upload resource in Atlassian Crucible before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the charset of a previously uploaded file.


Open Ticket Request System (OTRS) 3.3.9 has XSS in index.pl?Action=AgentStats requests as demonstrated by OrderBy=XSS and Direction=XSS attacks. NOTE: this CVE may have limited relevance because it represents a 2017 discovery of an issue in software from 2014. The 3.3.20 release for example is not affected.


An issue was discovered on Vera VeraEdge 1.7.19 and Veralite 1.7.481 devices. The device provides a shell script called relay.sh which is used for creating new SSH relays for the device so that the device connects to Vera servers. All the parameters passed in this specific script are logged to a log file called log.relay in the /tmp folder. The user can also read all the log files from the device using a script called log.sh. However when the script loads the log files it displays them with content-type text/html and passes all the logs through the ansi2html binary which converts all the character text including HTML meta-characters correctly to be displayed in the browser. This allows an attacker to use the log files as a storing mechanism for the XSS payload and thus whenever a user navigates to that log.sh script it enables the XSS payload and allows an attacker to execute his malicious payload on the user's browser.


Inadequate escaping lead to XSS vulnerability in the search module in ownCloud Server before 8.2.12 9.0.x before 9.0.10 9.1.x before 9.1.6 and 10.0.x before 10.0.2. To be exploitable a user has to write or paste malicious content into the search dialogue.


The repository changelog resource in Atlassian Fisheye before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability through the start date and end date parameters.


In SimpleCE 2.3.0 an authenticated XSS vulnerability was found on index.php/content/text/1?return_url=XSS exploitable as a regular or admin user.


Telerik.Web.UI.dll

in

Progress

Telerik

UI

for

ASP.NET

AJAX

before

and

Sitefinity

before

does

not

properly

protect

Telerik.Web.UI.DialogParametersEncryptionKey

or

the

MachineKey

which

makes

it

easier

for

remote

attackers

to

defeat

cryptographic

protection

mechanisms

leading

to

a

MachineKey

leak

arbitrary

file

uploads

or

downloads

XSS

or

ASP.NET

ViewState

compromise.


The Raygun4WP plugin 1.8.0 for WordPress is vulnerable to a reflected XSS in sendtesterror.php (backurl parameter).


lib/core/TikiFilter/PreventXss.php in Tiki Wiki CMS Groupware 16.2 allows remote attackers to bypass the XSS filter via padded zero characters as demonstrated by an attack on tiki-batch_send_newsletter.php.


In admin\\addgroup.php in CMS Made Simple 2.1.6 when adding a user group there is no XSS filtering resulting in storage-type XSS generation via the description parameter in an addgroup action.


In MODX Revolution before 2.5.7 an attacker might be able to trigger XSS by injecting a payload into the HTTP Host header of a request. This is exploitable only in conjunction with other issues such as Cache Poisoning.


The Sophos Web Appliance before 4.3.2 has XSS in the FTP redirect page aka NSWA-1342.


The Facetag extension 0.0.3 for Piwigo allows XSS via the name parameter to ws.php in a facetag.changeTag action.


Craft CMS before 2.6.2982 allows for a potential XSS attack vector by uploading a malicious SVG file.


WebsiteBaker v2.10.0 has a stored XSS vulnerability in /account/details.php.


A cross site scripting (XSS) vulnerability exists in Check_MK versions 1.4.0x prior to 1.4.0p6 allowing an unauthenticated remote attacker to inject arbitrary HTML or JavaScript via the _username parameter when attempting authentication to webapi.py which is returned unencoded with content type text/html.


The smarty_self function in modules/module_smarty.php in PivotX 2.3.11 mishandles the URI allowing XSS via vectors involving quotes in the self Smarty tag.


The Javascript method Sling.evalString() in Apache Sling Servlets Post before 2.3.22 uses the javascript 'eval' function to parse input strings which allows for XSS attacks by passing specially crafted input strings.


Mahara 15.04 before 15.04.14 and 16.04 before 16.04.8 and 16.10 before 16.10.5 and 17.04 before 17.04.3 are vulnerable to a user submitting potential dangerous payload e.g. XSS code to be saved as their name in the usr_registration table. The values are then emailed to the the user and administrator and if accepted become part of the new user's account.


The IconUriServlet of the Atlassian OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 allows remote attackers to access the content of internal network resources and/or perform an XSS attack via Server Side Request Forgery (SSRF).


Lansweeper before 6.0.0.65 has XSS in an image retrieval URI aka Bug 542782.


andrzuk/FineCMS through 2017-05-28 is vulnerable to a reflected XSS in the search page via the text-search parameter to index.php in a route=search action.


The WP Editor.MD plugin 1.6 for WordPress has a stored XSS vulnerability in the content of a post.


Missing CSRF token checks and improper input validation in Joomla! CMS 1.7.3 through 3.7.2 lead to an XSS vulnerability.


The review dashboard resource in Atlassian Crucible from version 4.1.0 before version 4.4.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the review filter title parameter.


TikiFilter.php in Tiki Wiki CMS Groupware 12.x through 16.x does not properly validate the imgsize or lang parameter to prevent XSS.


inc/SP/Html/Html.class.php in sysPass 2.1.9 allows remote attackers to bypass the XSS filter as demonstrated by use of an \<svg/onload=\ substring instead of an \<svg onload=\ substring.


Two CalendarXP products have XSS in common parts of HTML files. CalendarXP FlatCalendarXP through 9.9.290 has XSS in iflateng.htm and nflateng.htm. CalendarXP PopCalendarXP through 9.8.308 has XSS in ipopeng.htm and npopeng.htm.


The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS vulnerability in the content of a post.


Aries QWR-1104 Wireless-N Router with Firmware Version WRC.253.2.0913 has XSS on the Wireless Site Survey page exploitable with the name of an access point.


In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3) certain pages allow code to be injected into the DOM environment through query parameters leading to XSS attacks.


Synacor Zimbra Collaboration Suite (ZCS) before 8.7.10 has Persistent XSS.


Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has pre-auth reflected XSS in the IPS UTF8 Converter v1.1.18: admin/convertutf8/index.php?controller= is the attack vector. This UTF8 Converter vulnerability can easily be used to make a malicious announcement affecting any Invision Power Board user who views the announcement.


GeniXCMS 1.0.2 has XSS triggered by an authenticated user who submits a page as demonstrated by a crafted oncut attribute in a B element.


XSS

via

exists

on

Peplink

Balance

and

devices

with

firmware

before

The

affected

script

is

guest/preview.cgi.


MediaWiki before 1.27.4 1.28.x before 1.28.3 and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the browser sends non-standard URL escaping.


cnvs.io Canvas 3.3.0 has XSS in the title and content fields of a \Posts > Add New\ action and during creation of new tags and users.


XSS

via

syncid

exists

on

Peplink

Balance

and

devices

with

firmware

before

The

affected

script

is


An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/user_add.html with the param parameter.


GeniXCMS 1.0.2 has XSS triggered by an authenticated comment that is mishandled during a mouse operation by an administrator.


Trend Micro OfficeScan 11.0 before SP1 CP 6325 (with Agent Module Build before 6152) and XG before CP 1352 has XSS via a crafted URI using a blocked website.


In

Exponent

CMS

before

Patch

XSS

in

elFinder

is

possible

in


An

issue

was

discovered

on

Accellion

FTA

devices

before

allows

XSS

with

a

crafted

URI.


In Single Sign-On for Pivotal Cloud Foundry (PCF) 1.3.x versions prior to 1.3.4 and 1.4.x versions prior to 1.4.3 a user can execute a XSS attack on certain Single Sign-On service UI pages by inputting code in the text field for an organization name.


ownCloud Server before 8.2.12 9.0.x before 9.0.10 9.1.x before 9.1.6 and 10.0.x before 10.0.2 are vulnerable to XSS on error pages by injecting code in url parameters.


Stored XSS in Serendipity v2.1-rc1 allows an attacker to steal an admin's cookie and other information by composing a new entry as an editor user. This is related to lack of the serendipity_event_xsstrust plugin and a set_config error in that plugin.


Invision

Power

Services

(IPS)

Community

Suite

and

earlier

has

stored

XSS

in

the

Announcements

allowing

privilege

escalation

from

an

Invision

Power

Board

moderator

to

an

admin.

An

attack

uses

the

parameter

in

an

index.php?/modcp/announcements/&action=create

request.

This

is

related

to

the

Source\

option.


In EMC RSA Authentication Manager 8.2 SP1 and earlier a malicious RSA Security Console Administrator could craft a token profile and store the profile name in the RSA Authentication Manager database. The profile name could include a crafted script (with an XSS payload) that could be executed when viewing or editing the assigned token profile in the token by another administrator's browser session.


irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding aka XSS.


Allen Disk 1.6 has XSS in the id parameter to downfile.php.


Mura

CMS

allows

admin/?muraAction=

XSS

attacks

related

to

and


GeniXCMS 1.0.2 has XSS triggered by a comment that is mishandled during a publish operation by an administrator as demonstrated by a malformed P element.


Zen Cart 1.6.0 has XSS in the main_page parameter to index.php. NOTE: 1.6.0 is not an official release but the vendor's README.md file offers a link to v160.zip with a description of \Download latest in-development version from github.\


An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in courier/1000@/index.html with the auth_params parameter. The device tries to use internal WAF filters to stop specific XSS Vulnerabilities. However these can be bypassed by using some modifications to the payloads e.g. URL encoding.


GitLab before 8.14.9 8.15.x before 8.15.6 and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.


Craft CMS before 2.6.2974 allows XSS attacks.


Craft CMS before 2.6.2976 allows XSS attacks because an array returned by HttpRequestService::getSegments() and getActionSegments() need not be zero-based. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-8052.


An issue was discovered on Accellion FTA devices before FTA_9_12_180. There is XSS in home/seos/courier/smtpg_add.html with the param parameter.


edx-platform before 2015-09-17 allows XSS via a team name.


Castle Rock Computing SNMPc before 2015-12-17 has XSS via SNMP.


edx-platform before 2015-08-17 allows XSS in the Studio listing of courses.


Spiceworks Desktop before 2015-12-01 has XSS via an SNMP response.


Opsview before 2015-11-06 has XSS via SNMP.


JNews Joomla Component before 8.5.0 has XSS via the mailingsearch parameter.


HikaShop Joomla Component before 2.6.0 has XSS via an injected payload/caption.


Synacor Zimbra Mail Client 8.6 before 8.6.0 Patch 5 has XSS via the error/warning dialog and email body content in Zimbra.


XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI.


XSS in filedownload v1.4 wordpress plugin


Philips In.Sight B120/37 has XSS related to the Weaved cloud web service as demonstrated by the name parameter to deviceSettings.php or shareDevice.php.


Zimbra Collaboration before 8.6.0 patch5 has XSS.


Google Chrome before 41.0.2272.76 when Instant Extended mode is used does not properly consider the interaction between the \1993 search\ features and restore-from-disk RELOAD transitions which makes it easier for remote attackers to spoof the address bar for a search-results page by leveraging (1) a compromised search engine or (2) an XSS vulnerability in a search engine a different vulnerability than CVE-2015-1231.


Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.


The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.


In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress XSS is possible for remote authenticated administrators via the images1alttext parameter.


The wp-ultimate-csv-importer plugin before 3.8.1 for WordPress has XSS.


The crazy-bone plugin before 0.6.0 for WordPress has XSS via the User-Agent HTTP header.


2Checkout Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


The captain-slider plugin 1.0.6 for WordPress has XSS via a Title or Caption section.


The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name lp-business-name lp-phone lp-street lp-city-state lp-country lp-email lp-address or lp-niche parameters.


The Easy Digital Downloads (EDD) Attach Accounts to Orders extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


The two-factor-authentication plugin before 1.1.10 for WordPress has XSS in the admin area.


The simple-fields plugin before 1.4.11 for WordPress has XSS.


The ckeditor-for-wordpress plugin before 4.5.3.1 for WordPress has reflected XSS in the \built-in (old)\ file browser.


The

kiwi-logo-carousel

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

the

wp-admin/edit.php?post_type=kwlogos&page=kwlogos_settings

tab

or

parameter.


The yawpp plugin through 1.2.2 for WordPress has XSS via the field1 parameter.


The wp-piwik plugin before 1.0.5 for WordPress has XSS.


iThemes Builder Theme Market before 5.1.27 for WordPress has XSS via add_query_arg() and remove_query_arg().


BMC Remedy Action Request (AR) System 9.0 before 9.0.00 Service Pack 2 hot fix 1 has persistent XSS.


The Modern theme before 1.4.2 for WordPress has XSS via the genericons/example.html anchor identifier.


The updraftplus plugin before 1.9.64 for WordPress has XSS via add_query_arg() and remove_query_arg().


The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via a quiz name.


The flickr-justified-gallery plugin before 3.4.0 for WordPress has XSS.


The quotes-and-tips plugin before 1.20 for WordPress has XSS.


The Postmatic plugin before 1.4.6 for WordPress has XSS.


The

soundcloud-is-gold

plugin

before

for

WordPress

has

XSS

via

the

wp-admin/admin-ajax.php?action=get_soundcloud_player

id

parameter.


The alo-easymail plugin before 2.6.01 for WordPress has CSRF with resultant XSS in pages/alo-easymail-admin-options.php.


The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenir_plugin.


Stripe Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


The Easy Digital Downloads (EDD) Manual Purchases extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


The

display-widgets

plugin

before

for

WordPress

has

XSS

via

the

wp-admin/admin-ajax.php?action=dw_show_widget

or

instance

parameter.


The

multicons

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

the

wp-admin/options-general.php?page=multicons%2Fmulticons.php

or

parameter.


The Jetpack plugin before 3.4.3 for WordPress has XSS via add_query_arg() and remove_query_arg().


SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email which contained a malicious payload. Therefore users' passwords could be reset by using an XSS attack as the password reset page did not need the current password.


Easy EU Value Added (VAT) Taxes Add-on for iThemes Exchange before 1.2.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


Invoices Add-on for iThemes Exchange before 1.4.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


The Blubrry PowerPress Podcasting plugin 6.0.4 for WordPress has XSS via the tab parameter.


The relevant plugin before 1.0.8 for WordPress has XSS.


The

olevmedia-shortcodes

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

the

wp-admin/admin-ajax.php?action=omsc_popup

id

parameter.


The awesome-support plugin before 3.1.7 for WordPress has XSS via custom information messages.


The wp-slimstat (aka Slimstat Analytics) plugin before 4.1.6.1 for WordPress has XSS via an HTTP Referer header or via a field associated with JavaScript-based Referer tracking.


The

accurate-form-data-real-time-form-validation

plugin

for

WordPress

has

CSRF

with

resultant

XSS

via

wp-admin/options-general.php?page=Accu_Data_WP.


The Easy Digital Downloads (EDD) Simple Shipping extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


The xpinner-lite plugin through 2.2 for WordPress has wp-admin/options-general.php CSRF with resultant XSS.


Table Rate Shipping Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in a Grafana dashboard this vulnerability could allow an attacker to gain remote unauthenticated access to the dashboard.


The

addthis

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

the

wp-admin/options-general.php?page=addthis_social_widget

pubid

parameter.


The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header.


The

social-locker

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

the

wp-admin/edit.php?post_type=opanda-item&page=license-manager-sociallocker-next

licensekey

parameter.


The feedwordpress plugin before 2015.0514 for WordPress has XSS via add_query_arg() and remove_query_arg().


Easy US Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


The

wp-symposium

plugin

through

for

WordPress

has

XSS

via

the

wp-content/plugins/wp-symposium/get_album_item.php?size

parameter.


Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.


The Easy Digital Downloads (EDD) Recommended Products extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


Manual Purchases Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


The clean-login plugin before 1.5.1 for WordPress has reflected XSS.


The my-wish-list plugin before 1.4.2 for WordPress has multiple XSS issues.


The

qtranslate-x

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

the

wp-admin/options-general.php?page=qtranslate-x

or

parameter.


Authorize.net Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


The broken-link-manager plugin before 0.6.0 for WordPress has XSS via the HTTP Referer or User-Agent header to a URL that does not exist.


The NextGEN Gallery plugin before 2.1.10 for WordPress has multiple XSS issues involving thumbnail_width thumbnail_height thumbwidth thumbheight wmXpos and wmYpos and template.


The

yith-maintenance-mode

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

the

wp-admin/themes.php?page=yith-maintenance-mode

parameter.


In

the

page

in

the

BulletProof

Security

plugin

before

for

WordPress

XSS

is

possible

for

remote

authenticated

administrators

via

the

DBTablePrefix

parameter.


The gigpress plugin before 2.3.11 for WordPress has XSS.


The simple-share-buttons-adder plugin before 6.0.0 for WordPress has XSS.


The

ad-inserter

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

wp-admin/options-general.php?page=ad-inserter.php.


The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_keywords XSS.


iThemes Builder Style Manager before 0.7.7 for WordPress has XSS via add_query_arg() and remove_query_arg().


The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg.


The Auberge theme before 1.4.5 for WordPress has XSS via the genericons/example.html anchor identifier.


The feed-them-social plugin before 1.7.0 for WordPress has reflected XSS in the Facebook Feeds load more button.


The Related Posts plugin before 1.8.2 for WordPress has XSS via add_query_arg() and remove_query_arg().


The mtouch-quiz plugin before 3.1.3 for WordPress has wp-admin/edit.php CSRF with resultant XSS.


The mtouch-quiz plugin before 3.1.3 for WordPress has XSS via the quiz parameter during a Quiz Manage operation.


The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count parameter.


The Royal-Slider plugin before 3.2.7 for WordPress has XSS via the rstype parameter.


The

PlugNedit

Adaptive

Editor

plugin

before

for

WordPress

has

XSS

via

wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load

PlugneditBGColor

PlugneditEditorMargin

pnemedcount

or

plugneditcontent

parameters.


The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.


iThemes Builder Theme Depot before 5.0.30 for WordPress has XSS via add_query_arg() and remove_query_arg().


The

bookmarkify

plugin

for

WordPress

has

CSRF

with

resultant

XSS

via

wp-admin/options-general.php?page=bookmarkify.php.


The Easy Digital Downloads (EDD) Recurring Payments extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


The Easy Digital Downloads (EDD) Free Downloads extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


The cp-polls plugin before 1.0.5 for WordPress has XSS.


The

googmonify

plugin

through

for

WordPress

has

CSRF

with

resultant

XSS

via

the

wp-admin/options-general.php?page=googmonify.php

PID

or

AID

parameter.


The sitepress-multilingual-cms (WPML) plugin 2.9.3 to 3.2.6 for WordPress has XSS via the Accept-Language HTTP header.


The Fast Secure Contact Form plugin before 4.0.38 for WordPress allows fs_contact_form1welcome XSS.


The option-tree plugin before 2.5.4 for WordPress has XSS related to add_query_arg.


The Easy Digital Downloads (EDD) Cross-sell Upsell extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


The wp-rollback plugin before 1.2.3 for WordPress has XSS.


PayPal Pro Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


The

auto-thickbox-plus

plugin

through

for

WordPress

has

wp-content/plugins/auto-thickbox-plus/download.min.php?file=

XSS.


prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS.


The

wp-social-bookmarking-light

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

configuration

parameters

for

Tumblr

Twitter

Facebook

etc.

in

wp-admin/options-general.php?page=wp-social-bookmarking-light%2Fmodules%2Fadmin.php.


The wp-google-map-plugin plugin before 2.3.7 for WordPress has XSS related to the add_query_arg() and remove_query_arg() functions.


Easy Canadian Sales Taxes Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


MailEnable before 8.60 allows Stored XSS via malformed use of \<img/src\ with no \>\ character in the body of an e-mail message.


The wp-vipergb plugin before 1.3.16 for WordPress has XSS via add_query_arg() and remove_query_arg() a different issue than CVE-2014-9460.


The weeklynews theme before 2.2.9 for WordPress has XSS via the s parameter.


The dynamic-widgets plugin before 1.5.11 for WordPress has CSRF with resultant XSS via the wp-admin/themes.php?page=dynwid-config page_limit parameter.


The syndication-links plugin before 1.0.3 for WordPress has XSS via the genericons/example.html anchor identifier.


The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_name parameter.


The gregs-high-performance-seo plugin before 1.6.2 for WordPress has XSS in the context of an old browser.


The Exquisite Ultimate Newspaper theme 1.3.3 for WordPress has XSS via the anchor identifier to assets/js/jquery.foundation.plugins.js.


The profile-builder plugin before 2.2.5 for WordPress has XSS.


iThemes Exchange before 1.12.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


The neuvoo-jobroll plugin 2.0 for WordPress has neuvoo_location XSS.


The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS.


The

alpine-photo-tile-for-instagram

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

the

wp-admin/options-general.php?page=alpine-photo-tile-for-instagram-settings

tab

parameter.


Custom URL Tracking Add-on for iThemes Exchange before 1.1.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


The

cp-contact-form-with-paypal

(aka

CP

Contact

Form

with

PayPal)

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

related

to

and

cp_contactformpp_admin_int_list.inc.php.


The akismet plugin before 3.1.5 for WordPress has XSS.


The

dynamic-widgets

plugin

before

for

WordPress

has

XSS

via

the

wp-admin/admin-ajax.php?action=term_tree

prefix

or

parameter.


The indieweb-post-kinds plugin before 1.3.1.1 for WordPress has XSS via the genericons/example.html anchor identifier.


The xpinner-lite plugin through 2.2 for WordPress has xpinner-lite.php XSS.


The Easy Digital Downloads (EDD) Software Licensing extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


The users-ultra plugin before 1.5.63 for WordPress has XSS via the p_desc parameter.


The contact-form-plugin plugin before 3.96 for WordPress has XSS.


The Artificial Intelligence theme before 1.2.4 for WordPress has XSS because Genericons HTML files are unnecessarily placed under the web root.


The Post Connector plugin before 1.0.4 for WordPress has XSS via add_query_arg() and remove_query_arg().


The wp-all-import plugin before 3.2.5 for WordPress has reflected XSS.


The

eshop

plugin

through

for

WordPress

has

CSRF

with

resultant

XSS

via

the

wp-admin/admin.php?page=eshop-downloads.php

title

parameter.


The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id.


The

PlugNedit

Adaptive

Editor

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load

pnemedcount

PlugneditBGColor

PlugneditEditorMargin

or

plugneditcontent

parameters.


iThemes Mobile before 1.2.8 for WordPress has XSS via add_query_arg() and remove_query_arg().


The

monetize

plugin

through

for

WordPress

has

CSRF

with

resultant

XSS

via

wp-admin/admin.php?page=monetize-zones-new.


The Easy Digital Downloads (EDD) Recount Earnings extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.


The Easy Digital Downloads (EDD) htaccess Editor extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


The wp-plotly plugin before 1.0.3 for WordPress has XSS by authors.


The

manual-image-crop

plugin

before

for

WordPress

has

CSRF

with

resultant

XSS

via

the

wp-admin/admin-ajax.php?action=mic_editor_window

postId

parameter.


The Easy Digital Downloads (EDD) Content Restriction extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


The testimonial-slider plugin through 1.2.1 for WordPress has CSRF with resultant XSS.


The shortcode-factory plugin before 1.1.1 for WordPress has XSS via add_query_arg.


esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.


The Easy Digital Downloads (EDD) Conditional Success Redirects extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


Membership Add-on for iThemes Exchange before 1.3.0 for WordPress has XSS via add_query_arg() and remove_query_arg().


The

altos-connect

plugin

for

WordPress

has

XSS

via

the

wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/


The Easy Digital Downloads (EDD) Per Product Emails extension for WordPress as used with EDD 1.8.x before 1.8.7 1.9.x before 1.9.10 2.0.x before 2.0.5 2.1.x before 2.1.11 2.2.x before 2.2.9 and 2.3.x before 2.3.7 has XSS because add_query_arg is misused.


SquirrelMail 1.4.6 and earlier with register_globals enabled allows remote attackers to hijack cookies in src/redirect.php via unknown vectors. NOTE: while \cookie theft\ is frequently associated with XSS the vendor disclosure is too vague to be certain of this.


SQL injection vulnerability in portfolio_photo_popup.php in Verosky Media Instant Photo Gallery 1.0.2 allows remote attackers to execute arbitrary SQL commands via the id parameter which is not cleansed before calling the count_click function in includes/functions/fns_std.php. NOTE: this issue could produce resultant XSS.


view.php in KnowledgeTree Open Source 3.0.3 and earlier allows remote attackers to obtain the full installation path via a crafted fDocumentId parameter which displays the path in the resulting error message. NOTE: this might be resultant from another vulnerability since this vector also produces XSS.


Unspecified vulnerability in main.php in an unspecified \file created by Andries Bruinsma \ possibly a FleXiBle Development (FXB) application allows remote attackers to include and execute arbitrary PHP code. NOTE: this disclosure is extremely vague and has very little information about the specific vulnerability type. In addition there is little public information on the named product. Finally an XSS vector is implied in the subject line but because there is no other information and evidence of a cut-and-paste error it will not be assigned a separate CVE identifier unless additional information is provided.


Incomplete blacklist vulnerability in the nk_CSS function in nuked.php in Nuked-Klan 1.7 SP4.3 allows remote attackers to bypass anti-XSS features and inject arbitrary web script or HTML via JavaScript in an attribute value that is not in the blacklist as demonstrated using the STYLE attribute of a B element.


index.php in Horde Application Framework before 3.1.2 allows remote attackers to include web pages from other sites which could be useful for phishing attacks via a URL in the url parameter aka \cross-site referencing.\ NOTE: some sources have referred to this issue as XSS but it is different than classic XSS.


Coppermine Photo Gallery (CPG) 1.4.8 stable with register_globals enabled allows remote attackers to bypass XSS protection and set arbitrary variables via a query string that causes the variable to be defined in global space with separate _GET _REQUEST or other critical parameters which are unset by the protection scheme and prevent the original variable from being detected.


SQL injection vulnerability in articles.asp in Expinion.net iNews (1) Publisher (iNP) 2.5 and earlier and possibly (2) News Manager allows remote attackers to execute arbitrary SQL commands via the ex parameter. NOTE: early reports of this issue reported it as XSS but this was erroneous. The original report was for News Manager but there is strong evidence that the correct product is Publisher.


CRLF injection vulnerability in lib/exe/fetch.php in DokuWiki 2006-03-09e and possibly earlier allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the media parameter. NOTE: this issue can be leveraged for XSS attacks.


Rigter Portal System (RPS) 1.0 2.0 and 3.0 allows remote attackers to add arbitrary content and conduct XSS attacks via a direct request to add_art.php. NOTE: this issue was originally reported as SQL injection but this is not likely.


PrestaShop before 1.5.2 allows XSS via the \<object data='data:text/html\ substring in the message field.


XSS in Telligent Community 5.6.583.20496 via a flash file and related to the allowScriptAccess parameter.


EllisLab CodeIgniter 2.1.2 allows remote attackers to bypass the xss_clean() Filter and perform XSS attacks.


PostfixAdmin 2.3.4 has multiple XSS vulnerabilities


Google Chrome before 21.0.1180.82 on iOS makes certain incorrect calls to WebView methods that trigger use of an applewebdata: URL which allows remote attackers to bypass the Same Origin Policy and conduct Universal XSS (UXSS) attacks via vectors involving the document.write method.


SQL injection vulnerability in SpiceWorks 5.3.75941 allows remote authenticated users to execute arbitrary SQL commands via the id parameter to api_v2.json. NOTE: this entry was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6658 is for the XSS.


Two XSS vulnerabilities were fixed in message list and view in the Hupa Webmail application from the Apache James project. An attacker could send a carefully crafted email to a user of Hupa which would trigger a XSS when the email was opened or when a list of messages were viewed. This issue was addressed in Hupa 0.0.3.


The formbuilder plugin before 0.9.1 for WordPress has XSS via a Referer header.


The count-per-day plugin before 3.2.3 for WordPress has XSS via search words.


The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.


The sharebar plugin before 1.2.2 for WordPress has XSS a different issue than CVE-2013-3491.


vBSeo before 3.6.0PL2 allows XSS via the member.php u parameter.


Novell ZENworks Configuration Management before 11.2.4 allows XSS.


The job-manager plugin before 0.7.19 for WordPress has multiple XSS issues.


The redirection plugin before 2.2.12 for WordPress has XSS a different issue than CVE-2011-4562.


Zenphoto before 1.4.3.4 admin-news-articles.php date parameter XSS.


letodms has multiple XSS issues: Reflected XSS in Login Page Stored XSS in Document Owner/User name Stored XSS in Calendar


Cross-application scripting vulnerability in Google Chrome before 18.0.1025308 on Android allows remote attackers to inject arbitrary web script via unspecified vectors as demonstrated by \Universal XSS (UXSS)\ attacks against the current tab.


Dokeos 2.1.1 has multiple XSS issues involving \extra_\ parameters in main/auth/profile.php.


MathJax version prior to version 2.7.4 contains a Cross Site Scripting (XSS) vulnerability in the \\unicode{} macro that can result in Potentially untrusted Javascript running within a web browser. This attack appear to be exploitable via The victim must view a page where untrusted content is processed using Mathjax. This vulnerability appears to have been fixed in 2.7.4 and later.


Gleezcms Gleez Cms version 1.3.0 contains a Cross Site Scripting (XSS) vulnerability in Profile page that can result in Inject arbitrary web script or HTML via the profile page editor. This attack appear to be exploitable via The victim must navigate to the attacker's profile page.


October CMS version prior to build 437 contains a Cross Site Scripting (XSS) vulnerability in the Media module and create folder functionality that can result in an Authenticated user with media module permission creating arbitrary folder name with XSS content. This attack appear to be exploitable via an Authenticated user with media module permission who can create arbitrary folder name (XSS). This vulnerability appears to have been fixed in build 437.


In Metinfo 6.1.3 include/interface/applogin.php allows setting arbitrary HTTP headers (including the Cookie header) and common.inc.php allows registering variables from the $_COOKIE value. This issue can for example be exploited in conjunction with CVE-2018-19835 to bypass many XSS filters such as the Chrome XSS filter.


Pixelimity 1.0 has Persistent XSS via the admin/portfolio.php datatitle parameter as demonstrated by a crafted onload attribute of an SVG element.


An

issue

was

discovered

in

Dotcms

through

Attackers

may

perform

XSS

attacks

via

the

inode

identifier

or

fieldName

parameter

in


An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/art.php?typeid=1 biaoti parameter.


An issue was discovered in S-CMS v1.5. There is an XSS vulnerability in search.php via the keyword parameter.


No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article/index/ \article_title\ parameter.


WeCenter

through

has

XSS

in

the

function

via

the

parameter.


Cobham Satcom Sailor 250 and 500 devices before 1.25 contained persistent XSS which could be exploited by an unauthenticated threat actor via the /index.lua?pageID=Phone%20book name field.


Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.


In JPress v1.0-rc.5 there is stored XSS via each of the first three input fields to the starter-tomcat-1.0/admin/setting URI as demonstrated by the web_name parameter.


GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page. This is fixed in 11.5.1.


cgi_handle_request in uhttpd in OpenWrt through 18.06.1 and LEDE through 17.01 has unauthenticated reflected XSS via the URI as demonstrated by a cgi-bin/?XSS URI.


An issue was discovered in XiaoCms 20141229. There is XSS related to the template\\default\\show_product.html file.


In

JEESNS

allows

stored

XSS

via

an

HTML

EMBED

element

a

different

vulnerability

than


XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date end_date or form_id parameter.


An issue was discovered in Sales & Company Management System (SCMS) through 2018-06-06. An email address can be modified in between the request for a validation code and the entry of the validation code leading to storage of an XSS payload contained in the modified address.


The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in an error.php echo statement.


An issue was discovered in tp5cms through 2017-05-25. admin.php/system/set.html has XSS via the title parameter.


Rhymix

CMS

allows

XSS

via

an

index.php?module=admin&act=dispModuleAdminFileBox

SVG

upload.


An

issue

was

discovered

in

YzmCMS

It

has

XSS

via

a

search/index/archives/pubtime/

query

string

as

demonstrated

by

the

URI.

NOTE:

this

does

not

obtain

a

user's

cookie.


i4 assistant 7.85 allows XSS via a crafted machine name field within iOS settings.


XSS

exists

in

the

Administration

Console

in

Oracle

Secure

Global

Desktop

(but

was

fixed

in

later

versions

including

helpwindow.jsp

has

reflected

XSS

via

all

parameters

as

demonstrated

by

the

windowTitle

parameter.


There is Stored XSS in GetSimple CMS 3.3.12 via the admin/edit.php \post-menu\ parameter a related issue to CVE-2018-16325.


The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the error.php error_msg parameter.


pandao Editor.md 1.5.0 has DOM XSS via input starting with a \<<\ substring which is mishandled during construction of an A element.


Monstra

CMS

allows

XSS

via

an

uploaded

SVG

document

to

the

admin/index.php?id=filesmanager&path=uploads/

URI.

NOTE:

this

is

a

discontinued

product.


The server in mubu note 2018-11-11 has XSS by configuring an account with a crafted name value (along with an arbitrary username value) and then creating and sharing a note.


Guriddo Form PHP 5.3 has XSS via the demos/jqform/defaultnodb/default.php OrderID ShipName ShipAddress ShipCity ShipPostalCode ShipCountry Freight or details parameter.


The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the success.php fort_id parameter.


Cobham Satcom Sailor 800 and 900 devices contained persistent XSS which required administrative access to exploit. The vulnerability was exploitable by acquiring a copy of the device's configuration file inserting an XSS payload into a relevant field (e.g. Satellite name) and then restoring the malicious configuration file.


An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.3.11 11.4.x before 11.4.8 and 11.5.x before 11.5.1. There is a persistent XSS vulnerability in the environment pages due to a lack of input validation and output encoding.


An issue was discovered in YzmCMS 5.2. XSS exists via the admin/content/search.html searinfo parameter.


Dolibarr ERP/CRM through 8.0.3 has /exports/export.php?datatoexport= XSS.


kimsQ Rb 2.3.0 allows XSS via the second input field to the /?r=home&mod=mypage&page=info URI.


SolarWinds Database Performance Analyzer 11.1.457 contains an instance of Reflected XSS in its idcStateError component where the page parameter is reflected into the HREF of the 'Try Again' Button on the page aka a /iwc/idcStateError.iwc?page= URI.


JTBC(PHP)

has

XSS

via

the

console/xml/manage.php?type=action&action=edit

content

parameter.


XSS exists in InfoVista VistaPortal SE Version 5.1 (build 51029). VPortal/mgtconsole/RolePermissions.jsp has reflected XSS via the ConnPoolName parameter.


An issue was discovered on Systrome ISG-600C ISG-600H and ISG-800W 1.1-R2.1_TRUNK-20180914.bin devices. There is CSRF via /ui/?g=obj_keywords_add and /ui/?g=obj_keywords_addsave with resultant XSS because of a lack of csrf token validation.


Simditor through 2.3.21 allows DOM XSS via an onload attribute within a malformed SVG element.


Centreon 3.4.x (fixed in Centreon 18.10.0) has XSS via the resource name or macro expression of a poller macro.


Centreon 3.4.x (fixed in Centreon 18.10.0) allows XSS via the Service field to the main.php?p=20201 URI as demonstrated by the \Monitoring > Status Details > Services\ screen.


Zenitel Norway IP-StationWeb before 4.2.3.9 allows stored XSS via the Display Name for Station Status or Account Settings related to the goform/zForm_save_changes sip_nick parameter. The password of alphaadmin for the admin account may be used for authentication in some cases.


The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via the route.php paymentMethod parameter.


CMS Made Simple 2.2.8 allows XSS via an uploaded SVG document a related issue to CVE-2017-16798.


An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS.


Concrete5 8.4.3 has XSS because config/concrete.php allows uploads (by administrators) of SVG files that may contain HTML data with a SCRIPT element.


No-CMS 1.1.3 is prone to Persistent XSS via the blog/manage_article \keyword\ parameter.


An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping allowing a remote attacker to conduct XSS attacks as demonstrated by \j a v a s c r i p t:\ in Internet Explorer. This is a similar issue to CVE-2014-3146.


Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.


tp4a TELEPORT 3.1.0 allows XSS via the login page because a crafted username is mishandled when an administrator later views the system log.


Discuz! X3.4 allows XSS via admin.php because admincp/admincp_setting.php and template\\default\\common\\footer.htm mishandles statcode field from third-party stats code.


Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.


The Markdown editor in YXBJ before 8.3.2 on macOS has stored XSS. This behavior may be encountered by some Evernote users; however it is a vulnerability in YXBJ not a vulnerability in Evernote.


The Amazon PAYFORT payfort-php-SDK payment gateway SDK through 2018-04-26 has XSS via an arbitrary parameter name or value that is mishandled in a success.php echo statement.


The Media File Manager plugin 1.4.2 for WordPress allows XSS via the dir parameter of an mrelocator_getdir action to the wp-admin/admin-ajax.php URI.


Maccms through 8.0 allows XSS via the site_keywords field to index.php?m=system-config because of tpl/module/system.php and tpl/html/system_config.html related to template/paody/html/vod_index.html.


steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style> as demonstrated by an onload attribute in a BODY element within an HTML attachment.


Artica Integria IMS 5.0.83 has XSS via the search_string parameter.


ArticleCMS through 2017-02-19 has XSS via the /update_personal_infomation realname or email parameter.


JTBC(PHP)

has

CSRF

via

the

console/xml/manage.php?type=action&action=edit

URI

as

demonstrated

by

an

XSS

payload

in

the

content

parameter.


login.php in Adiscon LogAnalyzer before 4.1.7 has XSS via the Login Button Referer field.


An issue was discovered in LAOBANCMS 2.0. It allows XSS via the first input field to the admin/type.php?id=1 URI.


The Simplenia Pages plugin 2.6.0 for Atlassian Bitbucket Server has XSS.


Squid before 4.4 has XSS via a crafted X.509 certificate during HTTP(S) error page generation for certificate errors.


wg7.php in Webgalamb 7.0 makes opportunistic calls to htmlspecialchars() instead of using a templating engine with proper contextual encoding. Because it is possible to insert arbitrary strings into the database any JavaScript could be executed by the administrator leading to XSS.


An issue was discovered in XiaoCms 20141229. There is XSS via the largest input box on the \New news\ screen.


HMS Industrial Networks Netbiter WS100 3.30.5 devices and previous have reflected XSS in the login form.


An issue was discovered in LAOBANCMS 2.0. It allows XSS via the admin/liuyan.php neirong parameter.


Zenitel Norway IP-StationWeb before 4.2.3.9 allows reflected XSS via the goform/ PATH_INFO.


Certain

NETGEAR

devices

are

affected

by

reflected

XSS.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Jupyter Notebook before 5.5.0 does not use a CSP header to treat served files as belonging to a separate origin. Thus for example an XSS payload can be placed in an SVG document.


The anycomment plugin before 0.0.33 for WordPress has XSS.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


The buddyboss-media plugin through 3.2.3 for WordPress has stored XSS.


Certain NETGEAR devices are affected by stored XSS. This affects SRR60 before 2.2.1.210 and SRS60 before 2.2.1.210.


The cf7-invisible-recaptcha plugin before 1.3.2 for WordPress has XSS.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka \Microsoft Office SharePoint XSS Vulnerability.\ This affects Microsoft SharePoint Server Microsoft SharePoint.


Roland

Gruber

Softwareentwicklung

LDAP

Account

Manager

before

has

XSS

via

the

dn

parameter

to

the

URI

or

the

template

parameter

to

the

templates/3rdParty/pla/htdocs/cmd.php?cmd=rename_form

URI.


server/app/views/static/code.html in Kontena before 1.5.0 allows XSS in \kontena master login --remote\ code display as demonstrated by /code#code= in a URI.


YzmCMS 3.7 has Stored XSS via the title parameter to advertisement/adver/edit.html.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka \Microsoft Office SharePoint XSS Vulnerability.\ This affects Microsoft SharePoint.


ServiceNow ITSM 2016-06-02 has XSS via the First Name or Last Name field of My Profile (aka navpage.do) or the Search bar of My Portal (aka search_results.do).


The select component in bui through 2018-03-13 has XSS because it performs an escape operation on already-escaped text as demonstrated by workGroupList text.


Airties

and

devices

allow

XSS.


Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.


In MISP before 2.4.89 app/View/Events/resolved_attributes.ctp has multiple XSS issues via a malicious MISP module.


Open-AudIT Professional 2.1 has CSRF as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI.


QCMS version 3.0 has XSS via the title parameter to the /guest/index.html URI.


Yxcms

building

system

(compatible

cell

phone)

has

XSS

via

the

content

parameter

to

or

in

an

index.php?r=default/column/index&col=guestbook

request.


Zoho

ManageEngine

EventLog

Analyzer

version

build

has

Stored

XSS

related

to

the

index2.do?url=editAlertForm&tab=alert&alert=profile

URI

and

the

Edit

Alert

Profile

screen