Mautic before v2.13.0 has stored XSS via a theme config file.


A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properly sanitize a specially crafted web request to an affected AD FS server aka \Active Directory Federation Services XSS Vulnerability.\ This affects Windows Server 2012 R2 Windows RT 8.1 Windows Server 2019 Windows Server 2016 Windows 8.1 Windows 10 Windows 10 Servers.


CoverCMS v1.1.6 has XSS via the fourth input box to index.php related to admina/mconfigs.inc.php.


WSO2 Identity Server before 5.5.0 has XSS via the dashboard allowing attacks by low-privileged attackers.


IdentityServer IdentityServer4 1.x before 1.5.3 and 2.x before 2.1.3 does not encode the redirect URI on the authorization response page which might lead to XSS in some configurations.


Bookme Control Panel 2.0 Application is vulnerable to stored XSS within the Customers \Book Me\ function. Within the Name and Note (aka custName and custNote) sections of the Customers screen the application does not sanitize user-supplied input and renders injected JavaScript code to the user's browser.


The admin web interface on Technicolor MediaAccess TG789vac v2 HP devices with firmware v16.3.7190-2761005-20161004084353 displays unsanitised user input which allows an unauthenticated malicious user to embed JavaScript into the Log viewer interface via a crafted HTTP Referer header aka XSS.


A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properly sanitize a specially crafted web request to an affected AD FS server aka \Open Source Customization for Active Directory Federation Services XSS Vulnerability.\ This affects Web Customizations.


The

Apache

TomEE

console

(tomee-webapp)

has

a

XSS

vulnerability

which

could

allow

javascript

to

be

executed

if

the

user

is

given

a

malicious

URL.

This

web

application

is

typically

used

to

add

TomEE

features

to

a

Tomcat

installation.

The

TomEE

bundles

do

not

ship

with

this

application

included.

This

issue

can

be

mitigated

by

removing

the

application

after

TomEE

is

setup

(if

using

the

application

to

install

TomEE)

using

one

of

the

provided

pre-configured

bundles

or

by

upgrading

to

TomEE

This

issue

is

resolve

in

this

commit:


Xiuno BBS 4.0.0 has XSS in the adminpage sitename parameter.


OTCMS 3.20 allows XSS by adding a keyword or link to an article as demonstrated by an admin/keyWord_deal.php?mudi=add request.


Recommender before 2018-07-18 allows XSS.


MetInfo

through

has

XSS

via

the

parameter.


The Master Slider plugin 3.2.7 and 3.5.1 for WordPress has XSS via the wp-admin/admin-ajax.php Name input field of the MSPanel.Settings value on Callback.


In WordPress before 4.9.9 and 5.x before 5.0.1 when the Apache HTTP Server is used authors could upload crafted files that bypass intended MIME type restrictions leading to XSS as demonstrated by a .jpg file without JPEG data.


The advanced-custom-fields (aka Elliot Condon Advanced Custom Fields) plugin before 5.7.8 for WordPress has XSS by authors.


An issue was discovered in DouCo DouPHP 1.5 20181221. admin/system.php?rec=update has XSS via the site_name parameter.


CubeCart 6.2.2 has Reflected XSS via a /{ADMIN-FILE}/ query string.


SZ NetChat before 7.9 has XSS in the MyName input field of the Options module. Attackers are able to inject commands to compromise the enabled HTTP server web frontend.


Chamilo

LMS

version

contains

XSS

in

in

the

gradebook

dependencies

tool

allowing

authenticated

users

to

affect

other

users

under

specific

conditions

of

permissions

granted

by

administrators.

This

is

considered

\low

risk\

due

to

the

nature

of

the

feature

it

exploits.


cPanel before 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).


XSS exists in FUEL CMS 1.4.3 via the Page title Meta description or Meta keywords during page data management as demonstrated by the pages/edit/1?lang=english URI.


Application Links before version 5.0.11 from version 5.1.0 before 5.2.10 from version 5.3.0 before 5.3.6 from version 5.4.0 before 5.4.12 and from version 6.0.0 before 6.0.4 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the applinkStartingUrl parameter. The product is used as a plugin in various Atlassian products where the following are affected: Confluence before version 6.15.2 Crucible before version 4.7.0 Crowd before version 3.4.3 Fisheye before version 4.7.0 Jira before version 7.13.3 and 8.x before 8.1.0.


cPanel before 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).


The Reporting Addon (aka Reports Addon) through 2019-01-02 for CUBA Platform through 6.10.x has Persistent XSS via the \Reports > Reports\ name field.


An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. A DOM-based XSS exists in the store part of the product.


The media-library-assistant plugin before 2.74 for WordPress has XSS via the Media/Assistant or Settings/Media Library assistant admin submenu screens.


An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13 11.5.x before 11.5.6 and 11.6.x before 11.6.1. It allows XSS.


Advisto PEEL SHOPPING 9.0.0 has CSRF via en/achat/caddie_ajout.php and en/achat/caddie_affichage.php as demonstrated by an XSS payload in the couleurId0 parameter to the latter.


An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article.php?rec=update has XSS via the title parameter.


Allied Telesis 8100L/8 devices allow XSS via the edit-ipv4_interface.php vlanid or subnet_mask parameter.


Stormshield Network Security 2.0.0 through 2.13.0 and 3.0.0 through 3.7.1 has self-XSS in the command line interface of the SNS web server.


The Markdown component in Evernote (Chinese) before 8.3.2 on macOS allows stored XSS aka MAC-832.


Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/users.php user ID.


MODX Revolution through v2.7.0-pl allows XSS via User Settings such as Description.


Fork CMS 5.0.6 allows stored XSS via the private/en/settings facebook_admin_ids parameter (aka \Admin ids\ input in the Facebook section).


An issue was discovered in DouCo DouPHP 1.5 20181221. admin/nav.php?rec=update has XSS via the nav_name parameter.


imcat 4.4 allow XSS via a crafted cookie to the root/tools/adbug/binfo.php?cookie URI.


The contact-form-to-email plugin before 1.2.66 for WordPress has XSS.


An XSS issue has been found in welcome.cgi in Pulse Secure Pulse Connect Secure (PCS) 8.1.x before 8.1R12 8.2.x before 8.2R9 and 8.3.x before 8.3R3 due to one of the URL parameters not being sanitized properly.


An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java.


cPanel before 71.9980.37 allows Remote-Stored XSS in WHM Save Theme Interface (SEC-400).


cPanel before 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).


Arastta eCommerce 1.6.2 is vulnerable to XSS via the PATH_INFO to the login/ URI.


The woocommerce-jetpack plugin before 3.8.0 for WordPress has XSS in the Products Per Page feature.


cPanel before 74.0.8 allows stored XSS in WHM \File and Directory Restoration\ interface (SEC-441).


An issue was discovered in DouCo DouPHP 1.5 20181221. admin/show.php?rec=update has XSS via the show_name parameter.


Ivan Cordoba Generic Content Management System (CMS) through 2018-04-28 has XSS via the Administrator/add_pictures.php article ID.


Technicolor

devices

allow

XSS

via

a

Cross

Protocol

Injection

attack

with

setSSID

of

1.3.6.1.4.1.4413.2.2.2.1.18.1.2.1.1.3.10001.


An

issue

was

discovered

in

Nagios

XI

before

The

url

parameter

of

is

not

filtered

resulting

in

an

XSS

vulnerability.


An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product_category.php?rec=update has XSS via the cat_name parameter.


in

Typesetter

has

index.php/Admin/Menu/Ajax?cmd=AddHidden

title

XSS.


cPanel before 68.0.27 allows self XSS in the WHM listips interface (SEC-389).


The Backpack\\CRUD Backpack component before 3.4.9 for Laravel allows XSS via the select field type.


Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).


cPanel before 71.9980.37 allows stored XSS in the YUM autorepair functionality (SEC-399).


index.php?p=admin/actions/entries/save-entry

in

Craft

CMS

allows

XSS

by

saving

a

new

title

from

the

console

tab.


edx-platform before 2018-07-18 allows XSS via a response to a Chemical Equation advanced problem.


cPanel before 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).


Barracuda Message Archiver 2018 has XSS in the error_msg exception-handling value for the ldap_user parameter to the cgi-mod/ldap_load_entry.cgi module. The injection point of the issue is the Add_Update module.


cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface (SEC-464).


admin/?/plugin/file_manager in Frog CMS 0.9.5 allows XSS by creating a new file containing a crafted attribute of an IMG element.


An issue was discovered in S-CMS 3.0. It allows XSS via the admin/demo.php T_id parameter.


An issue was discovered in DouCo DouPHP 1.5 20181221. admin/product.php?rec=update has XSS via the name parameter.


In WordPress before 4.9.9 and 5.x before 5.0.1 crafted URLs could trigger XSS for certain use cases involving plugins.


cPanel before 71.9980.37 allows stored XSS in the WHM cPAddons installation interface (SEC-398).


MODX Revolution through v2.7.0-pl allows XSS via the User Photo field.


ChinaMobile

PLC

Wireless

Router

devices

with

firmware

have

XSS

via

the

cgi-bin/webproc?getpage=html/index.html

var:subpage

parameter.


A carefully crafted URL could trigger an XSS vulnerability on Apache JSPWiki from versions up to 2.10.5 which could lead to session hijacking.


The activity stream gadget in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the country parameter.


XSS exists in FUEL CMS 1.4.3 via the Header or Body in the Layout Variables during new-page creation as demonstrated by the pages/edit/1?lang=english URI.


An XSS combined with CSRF vulnerability discovered in SalesAgility SuiteCRM 7.x before 7.8.24 and 7.10.x before 7.10.11 leads to cookie stealing aka session hijacking. This issue affects the \add dashboard pages\ feature where users can receive a malicious attack through a phished URL with script executed.


in

UCMS

has

XSS

via

an

index.php

action.


cPanel before 70.0.23 allows self XSS in the WHM cPAddons showsecurity Interface (SEC-357).


cPanel before 74.0.8 allows self XSS in the WHM \Create a New Account\ interface (SEC-428).


An issue was discovered in WSO2 API Manager 2.1.0 and 2.6.0. Reflected XSS exists in the carbon part of the product.


The wp-retina-2x plugin before 5.2.3 for WordPress has XSS.


An issue was discovered in Tyto Sahi Pro through 7.x.x and 8.0.0. The logs web interface is vulnerable to stored XSS.


An issue was discovered in DouCo DouPHP 1.5 20181221. admin/article_category.php?rec=update has XSS via the cat_name parameter.


Chamilo LMS version 1.11.8 contains XSS in main/social/group_view.php in the social groups tool allowing authenticated users to affect other users under specific conditions of permissions granted by administrators. This is considered \low risk\ due to the nature of the feature it exploits.


cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config (SEC-387).


An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the page_name parameter.


An issue was discovered in GitLab Enterprise Edition 11.3.x and 11.4.x before 11.4.13 11.5.x before 11.5.6 and 11.6.x before 11.6.1. It allows XSS.


cPanel before 76.0.8 has Stored XSS in the WHM \Reset a DNS Zone\ feature (SEC-461).


cPanel before 68.0.27 allows self XSS in WHM Apache Configuration Include Editor (SEC-385).


The \mall some commodity details: commodity consultation\ component in WSTMart 2.0.8_181212 has stored XSS via the consultContent parameter as demonstrated by the index.php/home/goodsconsult/add.html URI.


The labels widget gadget in Atlassian Jira before version 7.6.11 and from version 7.7.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the rendering of retrieved content from a url location that could be manipulated by the up_projectid widget preference setting.


The wp-all-import plugin before 3.4.7 for WordPress has XSS.


cPanel before 70.0.23 has Stored XSS via an WHM Edit DNS Zone action (SEC-410).


The codection \Import users from CSV with meta\ plugin before 1.12.1 for WordPress allows XSS via the value of a cell.


An XSS issue has been found with rd.cgi in Pulse Secure Pulse Connect Secure 8.3RX before 8.3R3 due to improper header sanitization. This is not applicable to 8.1RX.


Tenda ADSL modem routers 1.0.1 allow XSS via the hostname of a DHCP client.


cPanel before 70.0.23 allows Stored XSS via a WHM Edit MX Entry (SEC-370).


The administrative linker functionality in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the href parameter.


MODX Revolution through v2.7.0-pl allows XSS via an extended user field such as Container name or Attribute name.


The pdf-print plugin before 2.0.3 for WordPress has multiple XSS issues.


cPanel before 74.0.8 allows self XSS in the Site Software Moderation interface (SEC-434).


Fat Free CRM before 0.18.1 has XSS in the tags_helper in app/helpers/tags_helper.rb.


An issue was discovered in PHPok v5.0.055. There is a Stored XSS vulnerability via the title parameter to api.php?c=post&f=save (reachable via the index.php?id=book URI).


TP-Link TD-W8961ND devices allow XSS via the hostname of a DHCP client.


MiniCMS V1.10 has XSS via the mc-admin/post-edit.php query string a related issue to CVE-2018-10296 and CVE-2018-16233.


ampforwp_save_steps_data in the AMP for WP plugin before 0.9.97.21 for WordPress allows stored XSS.


In WordPress before 4.9.9 and 5.x before 5.0.1 contributors could modify new comments made by users with greater privileges possibly causing XSS.


The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the cyclePeriod parameter.


MODX Revolution through v2.7.0-pl allows XSS via a document resource (such as pagetitle) which is mishandled during an Update action a Quick Edit action or the viewing of manager logs.


The Edit upload resource for a review in Atlassian Fisheye and Crucible before version 4.7.0 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the wbuser parameter.


cPanel before 74.0.8 allows self XSS in WHM Style Upload interface (SEC-437).


The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of <<a> in a message because a danmuWrapper DIV element in chatbox-only\\danmu.js is outside the scope of a Content Security Policy (CSP).


An issue was discovered in DouCo DouPHP 1.5 20181221. admin/mobile.php?rec=system&act=update has XSS via the mobile_name parameter.


An

issue

was

discovered

in

Nagios

XI

before

The

parameter

of

is

not

filtered

resulting

in

an

XSS

vulnerability.


An

issue

was

discovered

in

has

XSS

via

the

key

parameter.


cPanel before 68.0.27 allows self stored XSS in WHM Account Transfer (SEC-386).


An issue was discovered in GitLab Community and Enterprise Edition 11.2.x through 11.4.x before 11.4.13 11.5.x before 11.5.6 and 11.6.x before 11.6.1. It allows XSS.


cPanel before 68.0.27 allows self XSS in cPanel Backup Restoration (SEC-383).


cPanel before 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).


In Zulip Server versions before 1.7.2 there was an XSS issue with stream names in topic typeahead.


dsmall v20180320 allows XSS via the main page search box at the public/index.php/home URI.


The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.


Twonky Server before 8.5.1 has XSS via a folder name on the Shared Folders screen.


PHP Scripts Mall Match Clone Script 1.0.4 has XSS via the search field to searchbyid.php (aka the \View Search By Id\ screen).


PHP Scripts Mall Redbus Clone Script 3.0.6 has XSS via the ter_from or tag parameter to results.php.


dsmall

allows

XSS

via

the

member

search

box

at

the

URI.


register.jsp in Coremail XT3.0 allows stored XSS as demonstrated by the third form field to a URI under register/ a different vulnerability than CVE-2015-6942.


Twonky Server before 8.5.1 has XSS via a modified \language\ parameter in the Language section.


CoreOS Tectonic 1.7.x and 1.8.x before 1.8.7-tectonic.2 deploys the Grafana web application using default credentials (admin/admin) for the administrator account located at grafana-credentials secret. This occurs because CoreOS does not randomize the administrative password to later be configured by Tectonic administrators. An attacker can insert an XSS payload into the dashboards.


In Zulip Server versions before 1.7.2 there was an XSS issue with user uploads and the (default) LOCAL_UPLOADS_DIR storage backend.


CheckSec Canopy 3.x before 3.0.7 has stored XSS via the Login Page Disclaimer allowing attacks by low-privileged users against higher-privileged users.


The front page of MetInfo 6.0 allows XSS by sending a feedback message to an administrator.


GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting (specifically data-milestone-id in the milestone dropdown feature). This is fixed in 10.6.3 10.5.7 and 10.4.7.


The WP Live Chat Support plugin before 8.0.06 for WordPress has stored XSS via the Name field.


The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Google Maps miniature.


dsmall

allows

XSS

via

the

parameter

to


dsmall

allows

XSS

via

the

parameter

(aka

the

CMS

search

box).


Z-BlogPHP

has

XSS

via

the

parameter.

The

component

must

be

accessed

directly

by

an

administrator

or

through

CSRF.


An XSS issue was discovered in Subsonic Media Server 6.1.1. The podcast subscription form is affected by a stored XSS vulnerability in the add parameter to podcastReceiverAdmin.view; no administrator access is required. By injecting a JavaScript payload this flaw could be used to manipulate a user's session or elevate privileges by targeting an administrative user.


proberv.php in Yahei-PHP Proberv 0.4.7 has XSS via the funName parameter.


In Zulip Server versions 1.5.x 1.6.x and 1.7.x before 1.7.2 there was an XSS issue with muting notifications.


An

issue

was

discovered

in

idreamsoft

iCMS

through

XSS

exists

via

the

nickname

field

in

an

admincp.php?app=user&do=save&frame=iPHP

request.


The Iptanus WordPress File Upload plugin before 4.3.4 for WordPress mishandles Settings attributes leading to XSS.


GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge request component leads to cross site scripting (specifically filenames in changes tabs of merge requests). This is fixed in 10.6.3 10.5.7 and 10.4.7.


In Zulip Server versions before 1.7.2 there were XSS issues with the frontend markdown processor.


No-CMS 1.1.3 is prone to Persistent XSS via a contact_us name parameter as demonstrated by the VG48Z5PqVWname parameter.


Planon before Live Build 41 has XSS.


in

the

administration

login

interface

in

MailCleaner

CE

and

allows

XSS

via

the

admin/login/user/message/


Next.js

and

has

XSS

via

the

or

page.


An

issue

was

discovered

in

baserCMS

before

In

the

Register

New

Category

feature

of

the

Upload

menu

the

category

name

can

be

used

for

XSS

via

the

dataUploaderCategoryname

parameter

to

an

URI.


XSS

exists

in

DiliCMS

via

the

admin/index.php/setting/site?tab=site_attachment

parameter.


mailboxd component in Synacor Zimbra Collaboration Suite 8.6 8.7 before 8.7.11 Patch 7 and 8.8 before 8.8.10 Patch 2 has Persistent XSS.


An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via a seventh input field.


Fiyo CMS 2.0.7 has XSS via the dapur\\apps\\app_user\\edit_user.php name parameter.


The

variable

in

in

REDAXO

is

not

effectively

filtered

and

is

output

directly

to

the

page.

The

attacker

can

insert

XSS

payloads

via

an

index.php?page=mediapool/media&opener_input_field=XSS

request.


DedeCMS 5.7 SP2 allows XSS via the /member/uploads_select.php f or keyword parameter.


DedeCMS 5.7 SP2 allows XSS via the plus/qrcode.php type parameter.


An issue was discovered in nc-cms through 2017-03-10. index.php?action=edit_html allows XSS via the name parameter as demonstrated by a value beginning with home_content and containing a crafted SRC attribute of an IMG element.


ServersCheck Monitoring Software through 14.3.3 has Persistent and Reflected XSS via the sensors.html status parameter sensors.html type parameter sensors.html device parameter report.html location parameter group_delete.html group parameter report_save.html query parameter sensors.html location parameter or group_delete.html group parameter.


The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.


Loadbalancer.org Enterprise VA MAX before 8.3.3 has XSS because Apache HTTP Server logs are displayed.


XSS exists in Waimai Super Cms 20150505 via the fname parameter to the admin.php?m=Food&a=addsave or admin.php?m=Food&a=editsave URI.


GitLab CE & EE 11.2 and later and before 11.5.0-rc12 11.4.6 and 11.3.10 have Persistent XSS.


DedeCMS 5.7 SP2 allows XSS via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates as demonstrated by the PATH_INFO to /member/index.php /member/pm.php /member/content_list.php or /plus/feedback.php.


CommuniGate Pro 6.2 allows stored XSS via a message body in Pronto! Mail Composer which is mishandled in /MIME/INBOX-MM-1/ if the raw email link (in .txt format) is modified and then renamed with a .html or .wssp extension.


An issue was discovered in DESTOON B2B 7.0. XSS exists via certain text boxes to the admin.php?moduleid=2&action=add URI.


Mediamanager in REDAXO before 5.6.4 has XSS.


ajenticp (aka Ajenti Docker control panel) for Ajenti through v1.2.23.13 has XSS via a filename that is mishandled in File Manager.


The Bixie Portfolio plugin 1.2.0 for Pagekit has XSS: a logged-in user who has the \Manage portfolio\ privilege can inject arbitrary web script or HTML via the Image URL field in the portfolio editor. The vulnerability is triggered by visiting /portfolio/${project_title}.


** DISPUTED ** jQuery v2.2.2 allows XSS via a crafted onerror attribute of an IMG element. NOTE: this vulnerability has been reported to be spam entry.


Stored XSS has been discovered in the upload section of ARDAWAN.COM User Management 1.1 as demonstrated by a .jpg filename to the /account URI.


An

issue

was

discovered

in

Eleanor

CMS

through

XSS

exists

via

the

ajax.php?direct=admin&file=autocomplete&query=XSS

URI.


An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7 11.3.x before 11.3.8 and 11.4.x before 11.4.3. It has XSS.


The WP Editor.md plugin 10.0.1 for WordPress allows XSS via the comment area.


An issue was discovered in DESTOON B2B 7.0. admin\\setting.inc.php has XSS via the first text box to the admin.php URI.


Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.


Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter.


XSS

exists

in

DiliCMS

via

the

admin/index.php/setting/site?tab=site_attachment

parameter.


Citrix

NetScaler

Gateway

before

before

before

and

before

has

XSS.


Navigate CMS has Stored XSS via the navigate.php Title field in an edit action.


An issue was discovered in dialog.php in tecrail Responsive FileManager 9.8.1. A reflected XSS vulnerability allows remote attackers to inject arbitrary web script or HTML.


An issue was discovered in WUZHI CMS 4.1.0. There is stored XSS in index.php?m=core&f=index via an ontoggle attribute to details/open/ within a second input field.


A

cross

site

scripting

(XSS)

vulnerability

on

ASUS

devices

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

Logout.asp

YandexDNS.asp

apply.cgi

clients.asp

disk.asp

or

internet.asp.


An issue was discovered in Waimai Super Cms 20150505. There is XSS via the index.php?m=public&a=doregister username parameter.


In the 2.4 version of Camaleon CMS Stored XSS has been discovered. The profile image in the User settings section can be run in the update / upload area via /admin/media/upload?actions=false.


In the 4.2.23 version of BigTree a Stored XSS vulnerability has been discovered in /admin/ajax/file-browser/upload/ (aka the image upload area).


Nagios Core 4.4.2 has XSS via the alert summary reports of plugin results as demonstrated by a SCRIPT element delivered by a modified check_load plugin to NRPE.


XSS exists in cgi-bin/webcm on D-link DSL-2640T routers via the var:RelaodHref or var:conid parameter.


In the 3.1 version of Ekushey Project Manager CRM Stored XSS has been discovered in the input and upload sections as demonstrated by the name parameter to the index.php/admin/client/create URI.


admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases.


Evernote 6.15 on Windows has an incorrectly repaired stored XSS vulnerability. An attacker can use this XSS issue to inject Node.js code under Present mode. After a victim opens an affected note under Present mode the attacker can read the victim's files and achieve remote execution command on the victim's computer.


Stored XSS has been discovered in version 1.0.12 of the LUYA CMS software via /admin/api-cms-nav/create-page.


Helpy v2.1.0 has Stored XSS via the Ticket title.


WolfCMS v0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/file_manager/browse/.


servlet/SnoopServlet (a servlet installed by default) in Netscape Enterprise 3.63 has reflected XSS via an arbitrary parameter=XSS in the query string. A remote unauthenticated attacker could potentially exploit this vulnerability to supply malicious HTML or JavaScript code to a vulnerable web application which is then reflected back to the victim and executed by the web browser. NOTE: this product is discontinued.


XSS exists in CMS Made Simple version 2.2.7 via the m1_news_url parameter in an admin/moduleinterface.php \Content-->News-->Add Article\ action.


An issue was discovered in PublicCMS V4.0. It allows XSS by modifying the page_list \attached\ attribute (which typically has 'class=\icon-globe icon-large\' in its value) as demonstrated by an 'UPDATE sys_module SET attached = \XSS\ WHERE id=\page_list\' statement.


The

Kieran

O'Shea

Calendar

plugin

before

for

WordPress

has

Stored

XSS

via

the

parameter

in

a

wp-admin/admin.php?page=calendar

add

action

or

the

category

name

during

category

creation

at

the

wp-admin/admin.php?page=calendar-categories

URI.


In the Schiocco \Support Board - Chat And Help Desk\ plugin 1.2.3 for WordPress a Stored XSS vulnerability has been discovered in file upload areas in the Chat and Help Desk sections via the msg parameter in a /wp-admin/admin-ajax.php sb_ajax_add_message action.


LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections as demonstrated by the site_name parameter to the admin/settings/update URI.


GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the \board group extra contents\ parameter aka the adm/boardgroup_form_update.php gr_1~10 parameter.


CentOS-WebPanel.com

(aka

CWP)

CentOS

Web

Panel

has

XSS

via

the

parameter

or

the

admin/index.php

module

or

file

(within

the

parameter.


Pagoda Linux panel V6.0 has XSS via the verification code associated with an invalid account login. A crafted code is mishandled during rendering of the login log.


Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter the list/backup/ backup parameter the list/rrd/ period parameter the list/directory/ dir_a parameter or the filename to the list/directory/ URI.


XSS exists in CMS Made Simple version 2.2.7 via the m1_extra parameter in an admin/moduleinterface.php \Content-->News-->Add Article\ action.


In AXIOS ITALIA Axioscloud Sissiweb Registro Elettronico 1.7.0 secret/relogoff.aspx has XSS via the Error_Desc parameter.


Icinga Web 2 has XSS via the /icingaweb2/monitoring/list/services dir parameter the /icingaweb2/user/list query string the /icingaweb2/monitoring/timeline query string or the /icingaweb2/setup query string.


process_forms in the WPML (aka sitepress-multilingual-cms) plugin through 3.6.3 for WordPress has XSS via any locale_file_name_ parameter (such as locale_file_name_en) in an authenticated theme-localization.php request to wp-admin/admin.php.


DISPUTED

An

issue

was

discovered

in

nc-cms

through

index.php?action=edit_html&name=home_content

allows

XSS

via

the

HTML

Source

Editor.

NOTE:

the

vendor

disputes

this

because

the

form

requires

administrator

privileges

and

entering

JavaScript

is

supported

functionality.


GNUBOARD5 before 5.3.2.0 has XSS that allows remote attackers to inject arbitrary web script or HTML via the \homepage title\ parameter aka the adm/config_form_update.php cf_title parameter.


In waimai Super Cms 20150505 there is an XSS vulnerability via the /admin.php/Foodcat/addsave fcname parameter.


An issue was discovered in DESTOON B2B 7.0. admin/category.inc.php has XSS via the categorycatname parameter to the admin.php URI.


These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in bft_list.html.php:43: via the filter_signup_date parameter.


There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in unsubscribe.html.php:3: via GET reuqest to the email variable.


These vulnerabilities require administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:14: via POST request variable classes


There is a reflected XSS vulnerability in WordPress Arigato Autoresponder and News letter v2.5.1.8 This vulnerability requires administrative privileges to exploit. There is an XSS vulnerability in integration-contact-form.html.php:15: via POST request variable html_id.


In Nextcloud Calendar before 1.5.8 and 1.6.1 a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names hence malicious search results could only be crafted by privileged users like admins or group admins.


bracket-template suffers from reflected XSS possible when variable passed via GET parameter is used in template


XSS in sexstatic <=0.6.2 causes HTML injection in directory name(s) leads to Stored XSS when malicious file is embed with <iframe> element used in directory name.


In Nextcloud Contacts before 2.1.2 a missing sanitization of search results for an autocomplete field could lead to a stored XSS requiring user-interaction. The missing sanitization only affected group names hence malicious search results could only be crafted by privileged users like admins or group admins.


A missing sanitization of search results for an autocomplete field in NextCloud Talk <3.2.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names hence malicious search results could only be crafted by authenticated users.


There is a possible XSS vulnerability in all rails-html-sanitizer gem versions below 1.0.4 for Ruby. The gem allows non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments and these attributes can lead to an XSS attack on target applications. This issue is similar to CVE-2018-8048 in Loofah. All users running an affected release should either upgrade or use one of the workarounds immediately.


A missing sanitization of search results for an autocomplete field in NextCloud Server <13.0.5 could lead to a stored XSS requiring user-interaction. The missing sanitization only affected user names hence malicious search results could only be crafted by authenticated users.


An XSS in statics-server <= 0.0.9 can be used via injected iframe in the filename when statics-server displays directory index in the browser.


There is a Stored XSS vulnerability in the glance node module versions <= 3.0.5. File name which contains malicious HTML (eg. embedded iframe element or javascript: pseudo-protocol handler in <a> element) allows to execute JavaScript code against any user who opens a directory listing containing such crafted file name.


A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the LeaveEmployeeSearch.aspx prntFrmName or prntDDLCntrlName parameter.


An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'json' to the /q URI.


xowl/request.php in Ximdex 4.0 has XSS via the content parameter.


in

DragonByte

vBSecurity

through

for

vBulletin

and

vBulletin

allows

self-XSS

via

in

the

\Login

Sessions\

feature.


mao10cms 6 allows XSS via the article page.


An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of 'url_for' contained a XSS issue due to it allowing arbitrary protocols as a parameter.


Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name or description field to the \Olap Schemas' Catalogue\ catalogue.


An issue was discovered CMS MaeloStore V.1.5.0. There is stored XSS in the Telephone field of the admin interface.


content/content.blueprintspages.php in Symphony 2.7.6 has XSS via the pages content page.


In CraftedWeb through 2013-09-24 aasp_includes/pages/notice.php allows XSS via the e parameter.


An issue was discovered in Eventum 3.5.0. /htdocs/post_note.php has XSS via the garlic_prefix parameter.


system\\errors\\404.php in HongCMS 3.0.0 has XSS via crafted input that triggers a 404 HTTP status code.


xfind/search in Ximdex 4.0 has XSS via the filternvalue parameters for non-negative values of n as demonstrated by n equal to 0 through 12.


NetIQ iManager 3.1.1 addresses potential XSS vulnerabilities.


JEESNS through 1.2.1 allows XSS attacks by ordinary users who publish articles containing a crafted payload in order to capture an administrator cookie.


SeaCMS V6.61 has XSS via the site name parameter on an adm1n/admin_config.php page (aka a system management page).


An issue was discovered on Eminent EM4544 9.10 devices. The device does not require the user's current password to set a new one within the web interface. Therefore it is possible to exploit this issue (e.g. in combination with a successful XSS or at an unattended workstation) to change the admin password to an attacker-chosen value without knowing the current password.


A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4.0 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the flexiportal/GeneralInfo.aspx strAction parameter.


An issue was discovered in Eventum 3.5.0. /htdocs/validate.php has XSS via the values parameter.


MatrixSSL through 3.9.5 Open allows a memory-cache side-channel attack on ECDSA signatures aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key the attacker needs access to either the local machine or a different virtual machine on the same physical host.


Chevereto Free before 1.0.13 has XSS.


The /edit URI in the DMS component in Ximdex 4.0 has XSS via the Ciudad or Nombre parameter.


The

extension

for

has

XSS.


In Easy Magazine through 2012-10-26 there is XSS in the search bar of the web site.


An issue was discovered in Eventum 3.5.0. htdocs/switch.php has XSS via the current_page parameter.


An issue was discovered in Eventum 3.5.0. /htdocs/list.php has XSS via the show_notification_list_issues or show_authorized_issues parameter.


A Reflected Cross Site Scripting (XSS) Vulnerability was discovered in Adrenalin 5.4 HRMS Software. The user supplied input containing JavaScript is echoed back in JavaScript code in an HTML response via the ShiftEmployeeSearch.aspx prntFrmName or prntDDLCntrlName parameter.


CMS Clipper 1.3.3 has XSS in the Security tab search User Groups Resource Groups and User/Resource Group Links fields.


mao10cms 6 allows XSS via the m=bbs&a=index page.


An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6 10.8.x before 10.8.5 and 11.x before 11.0.1. The wiki contains a persistent XSS issue due to a lack of output encoding affecting a specific markdown feature.


Adrenalin HRMS version 5.4.0 contains a Reflected Cross Site Scripting (XSS) vulnerability in the ApplicationtEmployeeSearch page via 'prntDDLCntrlName' and 'prntFrmName'.


DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).


Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3.


ArticleCMS through 2017-02-19 has XSS via an \add an article\ action.


An issue was discovered in GitLab Community Edition and Enterprise Edition before 10.7.6 10.8.x before 10.8.5 and 11.x before 11.0.1. The charts feature contained a persistent XSS issue due to a lack of output encoding.


In CyberArk Endpoint Privilege Manager (formerly Viewfinity) 10.2.1.603 there is persistent XSS via an account name on the create token screen the VfManager.asmx SelectAccounts->DisplayName screen a user's groups in ConfigurationPage the Dialog Title field and App Group Name in the Application Group Wizard.


DIGISOL DG-HR3400 devices have XSS via a modified SSID when the apssid value is unchanged.


JavaMelody through 1.60.0 has XSS via the counter parameter in a clear_counter action to the /monitoring URI.


Grafana before 5.2.0-beta1 has XSS vulnerabilities in dashboard links.


An issue was discovered in Eventum 3.5.0. htdocs/ajax/update.php has XSS via the field_name parameter.


An XSS issue was discovered in the language switcher module in Joomla! 1.6.0 through 3.8.8 before 3.8.9. In some cases the link of the current language might contain unescaped HTML special characters. This may lead to reflective XSS via injection of arbitrary parameters and/or values on the current page URL.


Knowage (formerly SpagoBI) 6.1.1 allows XSS via the name field to the \Business Model's Catalogue\ catalogue.


Nagios Fusion before 4.1.4 has XSS aka TPS#13332-13335.


An issue was discovered in Eventum 3.5.0. /htdocs/popup.php has XSS via the cat parameter.


An XSS issue was discovered in Inhaltsprojekte in Weblication CMS Core & Grid v12.6.24. The vulnerability is located in the `wFilemanager.php` and `index.php` files of the `/grid5/scripts/` modules. The injection point is located in the Project `Title` and the execution point occurs in the `Inhaltsprojekte` output listing section. Remote attackers with privileged user accounts are able to inject their own malicious script code with a persistent attack vector to compromise user session credentials or to manipulate the affected web-application module output context. The request method to inject is POST.


TCExam before 14.1.2 has XSS via an ff_ or xl_ field.


OX App Suite 7.8.4 and earlier allows XSS. Internal reference: 58742 (Bug ID)


The IncomingMailServers resource in Atlassian JIRA Server before version 7.6.7 from version 7.7.0 before version 7.7.5 from version 7.8.0 before version 7.8.5 from version 7.9.0 before version 7.9.3 and from version 7.10.0 before version 7.10.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the messagesThreshold parameter as the fix for CVE-2017-18039 was incomplete.


Imperavi Redactor 3 in Angular Redactor 1.1.6 when HTML content mode is used allows stored XSS as demonstrated by an onerror attribute of an IMG element a related issue to CVE-2018-7035.


The two-dimensional filter statistics gadget in Atlassian Jira before version 7.6.10 from version 7.7.0 before version 7.12.4 and from version 7.13.0 before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the name of a saved filter when displayed on a Jira dashboard.


Boostnote v0.11.7 allows XSS during highlighting of Markdown text as demonstrated by an onerror attribute of an IMG element.


An issue was discovered in OpenTSDB 2.3.0. There is XSS in parameter 'type' to the /suggest URI.


admin/themes/default/items/tag-form.php in Omeka before 2.6.1 allows XSS by adding or editing a tag.


TP-Link Archer C1200 1.13 Build 2018/01/24 rel.52299 EU devices have XSS via the PATH_INFO to the /webpages/data URI.


Catfish CMS v4.7.9 allows XSS via the admin/Index/write.html editorValue parameter (aka an article posted by an administrator).


** DISPUTED ** ModSecurity 3.0.0 has XSS via an onerror attribute of an IMG element. NOTE: a third party has disputed this issue because it may only apply to environments without a Core Rule Set configured.


Entrust Datacard Syntera CS 5.x has XSS via the name field of \Domain or Computer Name\ in the login page.


The review attachment resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in attached files.


PHP Scripts Mall Auditor Website 2.0.1 has XSS via the lastname or firstname parameter.


An

XSS

issue

was

discovered

in

in

Rocket.Chat

before

The

real

name

of

a

username

is

displayed

unescaped

when

the

user

is

mentioned

(using

the

symbol)

in

a

channel

or

private

chat.

Consequently

it

is

possible

to

exfiltrate

the

secret

token

of

every

user

and

also

admins

in

the

channel.


edit_requests.php in yTakkar Instagram-clone through 2018-04-23 has XSS via an onmouseover payload because of an inadequate XSS protection mechanism based on preg_replace.


An XSS issue was discovered in Sandoba CP:Shop v2016.1. The vulnerability is located in the `admin.php` file of the `./cpshop/` module. Remote attackers are able to inject their own script codes to the client-side requested vulnerable web-application parameters. The attack vector of the vulnerability is non-persistent and the request method to inject/execute is GET with the path search rename or dir parameter.


An issue was discovered in Jirafeau before 3.4.1. The \search file by link\ form is affected by reflected XSS that could allow by targeting an administrator stealing a session and gaining administrative privileges.


The Ultimate Member (aka ultimatemember) plugin before 2.0.18 for WordPress has XSS via the wp-admin settings screen.


An XSS issue was discovered in Advanced Electron Forum (AEF) v1.0.9. A persistent XSS vulnerability is located in the `FTP Link` element of the `Private Message` module. The editor of the private message module allows inserting links without sanitizing the content. This allows remote attackers to inject malicious script code payloads as a private message (aka pmbody). The injection point is the editor ftp link element and the execution point occurs in the message body context on arrival. The request method to inject is POST with restricted user privileges.


An issue was discovered in Jirafeau before 3.4.1. The \search file by hash\ form is affected by reflected XSS that could allow by targeting an administrator stealing a session and gaining administrative privileges.


The

Events

Manager

plugin

for

WordPress

has

XSS

via

the

parameter

to

the

wp-admin/edit.php?post_type=event&page=events-manager-options

URI.


An issue was discovered in idreamsoft iCMS 7.0.9. XSS exists via the callback parameter in a public/api.php uploadpic request bypassing the iWAF protection mechanism.


OpenSID 18.06-pasca has reflected Cross Site Scripting (XSS) via the cari parameter aka an index.php/first?cari= URI.


Various resources in Atlassian Jira before version 7.6.8 from version 7.7.0 before version 7.7.5 from version 7.8.0 before version 7.8.5 from version 7.9.0 before version 7.9.3 from version 7.10.0 before version 7.10.3 and before version 7.11.1 allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the epic colour field of an issue while an issue is being moved.


A

reflected

XSS

issue

was

discovered

in

the

registration

form

in

Rocket.Chat

before

When

one

creates

an

account

the

next

step

will

ask

for

a

username.

This

field

will

not

save

HTML

control

characters

but

an

error

will

be

displayed

that

shows

the

attempted

username

unescaped

via

in


TRACE method is enabled in SAP Business One Service Layer . Attacker can use XST (Cross Site Tracing) attack if frontend applications that are using Service Layer has a XSS vulnerability. This has been fixed in SAP Business One Service Layer (B1_ON_HANA versions 9.2 9.3).


A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated remote attacker to conduct a stored XSS attack against a user of the interface. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a customized link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.


Microsoft Access in Microsoft SharePoint Enterprise Server 2013 and Microsoft SharePoint Enterprise Server 2016 allows a cross-site-scripting (XSS) vulnerability due to the way image field values are handled aka \Microsoft Access Tampering Vulnerability\.


A reflected cross site scripting (XSS) vulnerability in Junos Space may potentially allow a remote authenticated user to inject web script or HTML and steal sensitive data and credentials from a session and to perform administrative actions on the Junos Space network management device.


Graylog before v2.4.4 has an XSS security issue with unescaped text in notifications related to toastr and util/UserNotification.js.


In e107 v2.1.7 output without filtering results in XSS.


app/webroot/js/misp.js in MISP 2.4.91 has a DOM based XSS with cortex type attributes.


Monstra CMS 3.0.4 and earlier has XSS via index.php.


The

RSS

subsystem

in

ILIAS

and

before

has

XSS

via

a

URI

to


DomainMod v4.09.03 has XSS via the assets/edit/account-owner.php oid parameter.


The Recent Threads plugin before 1.1 for MyBB allows XSS via a thread subject.


A reflected Cross-Site-Scripting (XSS) vulnerability has been identified in Siemens PLM Software TEAMCENTER (V9.1.2.5). If a user visits the login portal through the URL crafted by the attacker the attacker can insert html/javascript and thus alter/rewrite the login portal page. Siemens PLM Software TEAMCENTER V9.1.3 and newer are not affected.


ruibaby Halo 0.0.2 has stored XSS via the loginName and loginPwd parameters in a failed login attempt to AdminController.java.


There is a reflected XSS vulnerability in AXON PBX 2.02 via the \AXON->Auto-Dialer->Agents->Name\ field. The vulnerability exists due to insufficient filtration of user-supplied data. A remote attacker can execute arbitrary HTML and script code in a browser in the context of the vulnerable application.


YIBAN Easy class education platform 2.0 has XSS via the articlelist.php k parameter.


in

ILIAS

and

before

has

XSS.


SGIN.CN xiangyun platform V9.4.10 has XSS via the login_url parameter to /login.php.


An issue was discovered in MISP 2.4.91. A vulnerability in app/View/Elements/eventattribute.ctp allows reflected XSS if a user clicks on a malicious link for an event view and then clicks on the deleted attributes quick filter.


Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.


An issue was discovered in Pluck before 4.7.6. There is authenticated stored XSS because the character set for filenames is not properly restricted.


An issue was discovered in Joomla! Core before 3.8.8. Under specific circumstances (a redirect issued with a URI containing a username and password when the Location: header cannot be used) a lack of escaping the user-info component of the URI could result in an XSS vulnerability.


Web Viewer for Hanwha DVR 2.17 and Smart Viewer in Samsung Web Viewer for Samsung DVR are vulnerable to XSS via the /cgi-bin/webviewer_login_page data3 parameter. (The same Web Viewer codebase was transitioned from Samsung to Hanwha.)


Graylog

before

has

an

XSS

security

issue

with

unescaped

text

in

dashboard

names

related

to

and

pages/ShowDashboardPage.jsx.


index.php?action=createaccount in Ximdex 4.0 has XSS via the sname or fname parameter.


The MULTIDOTS WooCommerce Quick Reports plugin 1.0.6 and earlier for WordPress is vulnerable to Stored XSS. It allows an attacker to inject malicious JavaScript code on the WooCommerce -> Orders admin page. The attack is possible by modifying the \referral_site\ cookie to have an XSS payload and placing an order.


Open

Whisper

Signal

(aka

Signal-Desktop)

through

allows

XSS

via

a

resource

location

specified

in

an

attribute

of

a

SCRIPT

IFRAME

or

IMG

element

leading

to

JavaScript

execution

after

a

reply

a

different

vulnerability

than

The

attacker

needs

to

send

HTML

code

directly

as

a

message

and

then

reply

to

that

message

to

trigger

this

vulnerability.

The

Signal-Desktop

software

fails

to

sanitize

specific

HTML

elements

that

can

be

used

to

inject

HTML

code

into

remote

chat

windows

when

replying

to

an

HTML

message.

Specifically

the

IMG

and

IFRAME

elements

can

be

used

to

include

remote

or

local

resources.

For

example

the

use

of

an

IFRAME

element

enables

full

code

execution

allowing

an

attacker

to

download/upload

files

information

etc.

The

SCRIPT

element

was

also

found

to

be

injectable.

On

the

Windows

operating

system

the

CSP

fails

to

prevent

remote

inclusion

of

resources

via

the

SMB

protocol.

In

this

case

remote

execution

of

JavaScript

can

be

achieved

by

referencing

the

script

on

an

SMB

share

within

an

IFRAME

element

for

example:

<IFRAME

src=\\\\DESKTOP-XXXXX\\Temp\\test.html>

and

then

replying

to

it.

The

included

JavaScript

code

is

then

executed

automatically

without

any

interaction

needed

from

the

user.

The

vulnerability

can

be

triggered

in

the

Signal-Desktop

client

by

sending

a

specially

crafted

message

and

then

replying

to

it

with

any

text

or

content

in

the

reply

(it

doesn't

matter).


Stored

XSS

in

YOOtheme

Pagekit

and

earlier

allows

a

user

to

upload

malicious

code

via

the

picture

upload

feature.

A

user

with

elevated

privileges

could

upload

a

photo

to

the

system

in

an

SVG

format.

This

file

will

be

uploaded

to

the

system

and

it

will

not

be

stripped

or

filtered.

The

user

can

create

a

link

on

the

website

pointing

to

\/storage/poc.svg\

that

will

point

to

When

a

user

comes

along

to

click

that

link

it

will

trigger

a

XSS

attack.


in

ILIAS

and

before

has

XSS

via

a

link

attribute.


ruibaby Halo 0.0.2 has stored XSS via the commentAuthor field to FrontCommentController.java.


Two XSS vulnerabilities are located in the profile edition page of the user panel of the YunoHost 2.7.2 through 2.7.14 web application. By injecting a JavaScript payload these flaws could be used to manipulate a user's session.


DomainMod v4.09.03 has XSS via the assets/edit/ssl-provider-account.php sslpaid parameter.


index.js in oauth2orize-fprm before 0.2.1 has XSS via a crafted URL.


An issue was discovered in Mautic 2.13.1. There is Stored XSS via the authorUrl field in config.json.


An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in \Account Settings -> Member Centre -> Chinese information -> Ordinary member\ via a QQ number as demonstrated by a formqq_10= substring.


An issue was discovered in Joomla! Core before 3.8.8. Inadequate input filtering leads to a multiple XSS vulnerabilities. Additionally the default filtering settings could potentially allow users of the default Administrator user group to perform a XSS attack.


Subrion CMS before 4.1.4 has XSS.


Monstra CMS 3.0.4 has Reflected XSS during Login (i.e. the login parameter to admin/index.php).


DomainMod 4.10.0 has Stored XSS in the \/settings/profile/index.php\ new_last_name parameter.


Reflected XSS is possible in the GamePlan theme through 1.5.13.2 for WordPress because of insufficient input sanitization as demonstrated by the s parameter. In some (but not all) cases the '<' and '>' characters have < and > representations.


** DISPUTED ** An issue was discovered in Z-BlogPHP 2.0.0. There is a persistent XSS that allows remote attackers to inject arbitrary web script or HTML into background web site settings via the \copyright information office\ field. NOTE: the vendor indicates that the product was not intended to block this type of XSS by a user with the admin privilege.


Data input into EMS Master Calendar before 8.0.0.201805210 via URL parameters is not properly sanitized allowing malicious attackers to send a crafted URL for XSS.


Monstra CMS 3.0.4 has XSS in the registration Form (i.e. the login parameter to users/registration).


SAP Internet Transaction Server (ITS) 6200.X.X has Reflected Cross Site Scripting (XSS) via certain wgate URIs. NOTE: the vendor has reportedly indicated that there will not be any further releases of this product.


DomainMod 4.10.0 has Stored XSS in the \/settings/profile/index.php\ new_first_name parameter.


Spring Framework (versions 5.0.x prior to 5.0.7 versions 4.3.x prior to 4.3.18 and older unsupported versions) allow web applications to change the HTTP request method to any HTTP method (including TRACE) using the HiddenHttpMethodFilter in Spring MVC. If an application has a pre-existing XSS vulnerability a malicious user (or attacker) can use this filter to escalate to an XST (Cross Site Tracing) attack.


An issue was discovered in the Moderator Log Notes plugin 1.1 for MyBB. It allows moderators to save notes and display them in a list in the modCP. The XSS is located in the mod notes textarea.


An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.


Centreon

including

Centreon

Web

is

vulnerable

to

an

authenticated

user

injecting

a

payload

into

the

username

or

command

description

resulting

in

stored

XSS.

This

is

related

to

and


An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS as demonstrated by a subject field.


An

issue

was

discovered

in

WUZHI

CMS

There

is

a

persistent

XSS

vulnerability

that

can

steal

the

administrator

cookies

via

the

tagtag

parameter

to

the

index.php?m=tags&f=index&v=add&&_su=wuzhicms

URI.

After

a

website

editor

(whose

privilege

is

lower

than

the

administrator)

logs

in

he

can

add

a

new

TAGS

with

the

XSS

payload.


The Video Downloader professional extension before 2018-04-05 for Chrome has Universal XSS (UXSS) via vectors related to a link64_msgAddLinks event.


An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is anonymous reflected XSS on the error page via a /share/error?message= URI.


CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_name parameter related to moduledepends a different vulnerability than CVE-2017-16799.


Severalnines ClusterControl before 1.6.0-4699 allows XSS.


An issue was discovered in Edimax EW-7438RPn Mini v2 before version 1.26. There is XSS in an SSID field.


XSS exists in Domain Trader 2.5.3 via the recoverlogin.php email_address parameter.


The \Latest Posts on Profile\ plugin 1.1 for MyBB has XSS because there is an added section in a user profile that displays that user's most recent posts without sanitizing the tsubject (aka thread subject) field.


An issue was discovered in WUZHI CMS 4.1.0. The \Extension Module -> System Announcement\ feature has Stored XSS via an announcement.


Before WordPress 4.9.5 the version string was not escaped in the get_the_generator function and could lead to XSS in a generator tag.


BigTree before 4.2.22 has XSS in the Users management page via the name or company field.


** DISPUTED ** A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an \Edit page\ action. NOTE: the vendor disputes the relevance of this report because an installation accessible to untrusted users is supposed to have parserSafeMode=1 in system/config/config.ini to prevent XSS.


XSS exists in Flexense DiskSavvy Enterprise from v10.4 to v10.7.


and

in

ILIAS

through

before

allow

XSS

via

an

invalid

date.


An

issue

was

discovered

in

Nagios

XI

There

is

XSS

exploitable

via

CSRF

in

the

Schedule

New

Report

screen

via

the

hour

minute

or

ampm

parameter

related

to

components/scheduledreporting;

related

to

the

function;

the

ajaxhelper.php

opts

or

background

parameter;

the

i

array

parameter

to

or

the

deploynotification.php

title

parameter.


An issue was discovered in DiliCMS (aka DiligentCMS) 2.4.0. There is a Stored XSS Vulnerability in the fourth textbox of \System setting->site setting\ of admin/index.php.


Discuz! DiscuzX through X3.4 has stored XSS via the portal.php?mod=portalcp&ac=article URI related to mishandling of IMG elements associated with remote images.


An issue was discovered in WUZHI CMS 4.1.0. There is XSS via the email parameter to the index.php?m=member&v=register URI.


An issue was discovered in Vesta Control Panel 0.9.8-20. There is Reflected XSS via $_REQUEST'path' to the view/file/index.php URI which can lead to remote PHP code execution via vectors involving a file_put_contents call in web/upload/UploadHandler.php.


Zend Debugger in Zend Server before 9.1.3 has XSS aka ZSR-2455.


XSS exists in Flexense DiskPulse Enterprise from v10.4 to v10.7.


error.php in ILIAS 5.2.x through 5.3.x before 5.3.4 allows XSS via the text of a PDO exception.


MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter.


An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8 10.6.x before 10.6.5 and 10.7.x before 10.7.2. The Move Issue feature contained a persistent XSS vulnerability.


EasyCMS 1.3 is prone to Stored XSS when posting an article; four fields are affected: title keyword abstract and content as demonstrated by the /admin/index/index.html#listarticle URI.


An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS on the file or folder download pop-up via a crafted file or folder name.


PrinterOn Enterprise 4.1.3 suffers from multiple authenticated stored XSS vulnerabilities via the (1) department field in the printer configuration (2) description field in the print server configuration and (3) username field for authentication to print as guest.


D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the RESULT parameter to /htdocs/webinc/js/info.php.


Zimbra Web Client (ZWC) in Zimbra Collaboration Suite 8.8 before 8.8.8.Patch4 and 8.7 before 8.7.11.Patch4 has Persistent XSS via a contact group.


iScripts

UberforX

has

Stored

XSS

in

the

section

of

the

Admin

Panel

via

a

value

field

to

the

/cms?section=manage_settings&action=edit

URI.


iScripts SupportDesk v4.3 has XSS via the admin/inteligentsearchresult.php txtinteligentsearch parameter.


XSS exists in Flexense DiskSorter Enterprise from v9.5.12 to v10.7.


WUZHI

CMS

allows

persistent

XSS

via

the

parameter

to

the

/index.php?m=member&f=index&v=profile&set_iframe=1

URI.


An issue was discovered in WUZHI CMS 4.1.0. The content-management feature has Stored XSS via the title or content section.


iCMS V7.0.8 has XSS via the admincp.php keywords parameter in a weixin_category action aka a WeChat Classified Management keyword search.


XSS exists in Flexense DupScout Enterprise from v10.0.18 to v10.7.


Flexense DiskBoss Enterprise v7.4.28 to v9.1.16 has XSS.


The CATALooK.netStore module through 7.2.8 for DNN (formerly DotNetNuke) allows XSS via the /ViewEditGoogleMaps.aspx PortalID or CATSkin parameter or the /ImageViewer.aspx link or desc parameter.


Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role and enters the payload in the content section of a new page in the blog catalog.


The

WeChat

module

in

YzmCMS

has

reflected

XSS

via

the

echostr

parameter

related

to

the

valid

function

in


An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is XSS in invitation mail received from a different user who can modify the HTML in that mail before sending it.


yidashi yii2cmf 2.0 has XSS via the /search q parameter.


CMS Made Simple (aka CMSMS) 2.2.7 has Reflected XSS in admin/moduleinterface.php via the m1_version parameter.


Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls occur when the html_escape function in lib/html.php is not used).


Discuz!

DiscuzX

through

has

reflected

XSS

via

forum.php?mod=post&action=newthread

because

does

not

restrict

the

content.


An issue was discovered in ext/phar/phar_object.c in PHP before 5.6.36 7.0.x before 7.0.30 7.1.x before 7.1.17 and 7.2.x before 7.2.5. There is Reflected XSS on the PHAR 403 and 404 error pages via request data of a request for a .phar file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2018-5712.


An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php.


The Responsive Cookie Consent plugin before 1.8 for WordPress mishandles number fields leading to XSS.


An issue was discovered on Moxa AWK-3121 1.19 devices. It provides functionality so that an administrator can change the name of the device. However the same functionality allows an attacker to execute XSS by injecting an XSS payload. The POST parameter \iw_board_deviceName\ is susceptible to this injection.


MODX Revolution 2.6.3 has XSS.


An Authenticated Stored XSS vulnerability was found in HRSALE The Ultimate HRM v1.0.2 exploitable by a low privileged user.


AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow XSS.


CMS Made Simple (aka CMSMS) 2.2.7 has Stored XSS in admin/siteprefs.php via the metadata parameter.


An issue was discovered in FastAdmin V1.0.0.20180417_beta. There is XSS via the application\\api\\controller\\User.php avatar parameter.


Cacti before 1.1.37 has XSS because it does not properly reject unintended characters related to use of the sanitize_uri function in lib/functions.php.


An issue was discovered in HongCMS 3.0.0. The post news feature has Stored XSS via the content field.


iScripts SupportDesk v4.3 has XSS via the staff/inteligentsearchresult.php txtinteligentsearch parameter.


MiniCMS v1.10 has XSS via the mc-admin/conf.php site_link parameter.


ILIAS 5.3.4 has XSS through unsanitized output of PHP_SELF related to shib_logout.php and third-party demo files.


Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI related to plugins/box/pages/pages.admin.php.


Lantronix SecureLinx Spider (SLS) 2.2+ devices have XSS in the auth.asp login page.


The Tagregator plugin 0.6 for WordPress has stored XSS via the title field in an Add New action.


The jDownloads extension before 3.2.59 for Joomla! has XSS.


Catfish CMS V4.7.21 allows XSS via the pinglun parameter to cat/index/index/pinglun (aka an authenticated comment).


Synacor Zimbra Admin UI in Zimbra Collaboration Suite before 8.8.0 beta 2 has Persistent XSS via mail addrs.


An issue was discovered in the Users (aka Front-end user management) plugin 1.4.5 for October CMS. XSS exists in the name field.


Cacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on $_SERVER'PHP_SELF' instead of $_SERVER'SCRIPT_NAME' to determine a page name.


XSS exists in Flexense VX Search Enterprise from v10.1.12 to v10.7.


** DISPUTED ** Z-BlogPHP 1.5.2 has a stored Cross Site Scripting Vulnerability exploitable by an administrator who navigates to \Web site settings --> Basic setting --> Website title\ and enters an XSS payload via the zb_system/cmd.php ZC_BLOG_NAME parameter. NOTE: the vendor disputes the security relevance noting it is \just a functional bug.\


Contao before 4.5.7 has XSS in the system log.


js/views/message_view.js in Open Whisper Signal (aka Signal-Desktop) before 1.10.1 allows XSS via a URL.


D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the Treturn parameter to /htdocs/webinc/js/bsc_sms_inbox.php.


app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on /tools/mac-lookup/ via the mac parameter.


An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS via the optional message field of a file request.


in

Monstra

CMS

has

a

stored

XSS

vulnerability

when

an

attacker

has

access

to

the

editor

role

and

enters

the

payload

in

the

title

section

of

an

admin/index.php?id=pages&action=edit_page&name=error404

(aka

Edit

page)

action.


An XSS in Flexense SyncBreeze affects all versions (tested from SyncBreeze Enterprise from v10.1 to v10.7).


D-Link DIR-615 T1 devices allow XSS via the Add User feature.


Pivotal Spring Batch Admin all versions contains a stored XSS vulnerability in the file upload feature. An unauthenticated malicious user with network access to Spring Batch Admin could store an arbitrary web script that would be executed by other users. This issue has not been patched because Spring Batch Admin has reached end of life.


In Nessus before 7.1.0 a XSS vulnerability exists due to improper input validation. A remote authenticated attacker could create and upload a .nessus file which may be viewed by an administrator allowing for the execution of arbitrary script code in a user's browser session. In other scenarios XSS could also occur by altering variables from the Advanced Settings.


In Apache Allura prior to 1.8.1 attackers may craft URLs that cause HTTP response splitting. If a victim goes to a maliciously crafted URL unwanted results may occur including XSS or service denial for the victim's browsing session.


Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by \Josna Joseph\.


Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. Utilizing a specially crafted request an authenticated attacker could potentially execute arbitrary JavaScript code by manipulating certain URL parameters related to offline plugins.


A reflected Cross-Site-Scripting (XSS) vulnerability in Fortinet FortiSandbox before 3.0 may allow an attacker to execute unauthorized code or commands via the back_url parameter in the file scan component.


Joplin

version

prior

to

contains

a

XSS

evolving

into

code

execution

due

to

enabled

nodeIntegration

for

that

particular

BrowserWindow

instance

where

XSS

was

identified

from

vulnerability

in

Note

content

field

information

on

the

fix

can

be

found

here

that

can

result

in

executing

unauthorized

code

within

the

rights

in

which

the

application

is

running.

This

attack

appear

to

be

exploitable

via

Victim

synchronizing

notes

from

the

cloud

services

or

other

note-keeping

services

which

contain

malicious

code.

This

vulnerability

appears

to

have

been

fixed

in

and

later.


sympa version 6.2.16 and later contains a CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in The \referer\ parameter of the wwsympa.fcgi login action. that can result in Open redirection and reflected XSS via data URIs. This attack appear to be exploitable via Victim's browser must follow a URL supplied by the attacker. This vulnerability appears to have been fixed in none available.


DomainMOD version 4.09.03 and above. Also verified in the latest version 4.11.01 contains a Cross Site Scripting (XSS) vulnerability in Segment Name field in the segments page that can result in Arbitrary script can be executed on all users browsers who visit the affected page. This attack appear to be exploitable via Victim must visit the vulnerable page. This vulnerability appears to have been fixed in No fix yet.


GONICUS

GOsa

version

before

commit

contains

a

Cross

Site

Scripting

(XSS)

vulnerability

in

change

password

form

(html/password.php

that

can

result

in

injection

of

arbitrary

web

script

or

HTML.

This

attack

appear

to

be

exploitable

via

the

victim

must

open

a

specially

crafted

web

page.

This

vulnerability

appears

to

have

been

fixed

in

after

commit


Imagely NextGEN Gallery version 2.2.30 and earlier contains a Cross Site Scripting (XSS) vulnerability in Image Alt & Title Text. This attack appears to be exploitable via a victim viewing the image in the administrator page. This vulnerability appears to have been fixed in 2.2.45.


I Librarian version 4.8 and earlier contains a Cross Site Scripting (XSS) vulnerability in \id\ parameter in stable.php that can result in an attacker using the XSS to send a malicious script to an unsuspecting user.


FreeBSD CVSweb version 2.x contains a Cross Site Scripting (XSS) vulnerability in all pages that can result in limited impact--CVSweb is anonymous & read-only. It might impact other sites on same domain. This attack appears to be exploitable via victim must load specially crafted url. This vulnerability appears to have been fixed in 3.x.


RubyGems version Ruby 2.2 series: 2.2.9 and earlier Ruby 2.3 series: 2.3.6 and earlier Ruby 2.4 series: 2.4.3 and earlier Ruby 2.5 series: 2.5.0 and earlier prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6.


FatFreeCRM

version

contains

a

Cross

Site

Scripting

(XSS)

vulnerability

in

commit

that

can

result

in

Javascript

execution.

This

attack

appear

to

be

exploitable

via

Content

with

Javascript

payload

will

be

executed

on

end

user

browsers

when

they

visit

the

page.

This

vulnerability

appears

to

have

been

fixed

in


Parsedown version prior to 1.7.0 contains a Cross Site Scripting (XSS) vulnerability in `setMarkupEscaped` for escaping HTML that can result in JavaScript code execution. This attack appears to be exploitable via specially crafted markdown that allows it to side step HTML escaping by breaking AST boundaries. This vulnerability appears to have been fixed in 1.7.0 and later.


oVirt version 4.2.0 to 4.2.2 contains a Cross Site Scripting (XSS) vulnerability in the name/description of VMs portion of the web admin application. This vulnerability appears to have been fixed in version 4.2.3.


Dojo

Dojo

Objective

Harness

(DOH)

version

prior

to

version

contains

a

Cross

Site

Scripting

(XSS)

vulnerability

in

unit.html

and

and

in

the

DOH

that

can

result

in

Victim

attacked

through

their

browser

deliver

malware

steal

HTTP

cookies

bypass

CORS

trust.

This

attack

appear

to

be

exploitable

via

Victims

are

typically

lured

to

a

web

site

under

the

attacker's

control;

the

XSS

vulnerability

on

the

target

domain

is

silently

exploited

without

the

victim's

knowledge.

This

vulnerability

appears

to

have

been

fixed

in


Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.6 4.3.0.


Peel shopping peel-shopping_9_1_0 version contains a Cross Site Scripting (XSS) vulnerability that can result in an authenticated user injecting java script code in the \Site Name EN\ parameter. This attack appears to be exploitable if the malicious user has access to the administration account.


FreshDNS version 1.0.3 and prior contains a Cross Site Scripting (XSS) vulnerability in Account data form; Zone editor that can result in Execution of attacker's JavaScript code in victim's session. This attack appear to be exploitable via The attacker stores a specially crafted string as their Full Name in their account details. The victim (e.g. the administrator of the FreshDNS instance) opens the User List in the admin interface.. This vulnerability appears to have been fixed in 1.0.5 and later.


WP ULike version 2.8.1 3.1 contains a Cross Site Scripting (XSS) vulnerability in Settings screen that can result in allows unauthorised users to do almost anything an admin can. This attack appear to be exploitable via Admin must visit logs page. This vulnerability appears to have been fixed in 3.2.


Akiee version 0.0.3 contains a XSS leading to code execution due to the use of node integration vulnerability in \Details\ of a task is not validated that can result in XSS leading to abritrary code execution. This attack appear to be exploitable via The attacker tricks the victim into opening a crafted markdown.


Floodlight version 1.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in the web console that can result in javascript injections into the web page. This attack appears to be exploitable via the victim browsing the web console.


BigTree-CMS

contains

a

Cross

Site

Scripting

(XSS)

vulnerability

in

that

can

result

in

The

low-privileged

users

can

use

this

vulnerability

to

attack

high-privileged(Developer)

users..

This

attack

appear

to

be

exploitable

via

no.

This

vulnerability

appears

to

have

been

fixed

in

after

commit


OCS Inventory OCS Inventory NG version ocsreports 2.4 contains a Cross Site Scripting (XSS) vulnerability in login form and search functionality that can result in An attacker is able to execute arbitrary (javascript) code within a victims' browser. This attack appear to be exploitable via Victim must open a crafted link to the application. This vulnerability appears to have been fixed in ocsreports 2.4.1.


KOHA

Library

System

version

(up

until

and

(up

until

contains

a

Cross

Site

Scripting

(XSS)

vulnerability

in

Multiple

fields

on

multiple

pages

including

/cgi-bin/koha/acqui/supplier.pl?op=enter

/cgi-bin/koha/circ/circulation.pl?borrowernumber=number

that

can

result

in

Privilege

escalation

by

taking

control

of

higher

privileged

users

browser

sessions.

This

attack

appear

to

be

exploitable

via

Victims

must

be

socially

engineered

to

visit

a

vulnerable

webpage

containing

malicious

payload.

This

vulnerability

appears

to

have

been

fixed

in


Grails Fields plugin version 2.2.7 contains a Cross Site Scripting (XSS) vulnerability in Using the display tag that can result in XSS . This vulnerability appears to have been fixed in 2.2.8.


Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted..


** DISPUTED ** PHP cebe markdown parser version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in all distributed parsers allowing a malicious crafted script to be executed that can result in the lose of user data and sensitive user information. This attack can be exploited by crafting a three backtick wrapped payload with a character in front: L: \```<script>alert();</script>```\. NOTE: This has been argued as a non-issue (see references) since it is not the parser's job to sanitize malicious code from a parsed document.


WeBid

version

up

to

current

version

contains

a

Cross

Site

Scripting

(XSS)

vulnerability

in

register.php

that

can

result

in

Javascript

execution

in

the

user's

browser

injection

of

malicious

markup

into

the

page.

This

attack

appear

to

be

exploitable

via

The

victim

user

must

click

a

malicous

link.

This

vulnerability

appears

to

have

been

fixed

in

after

commit


Tooltipy Tooltipy (tooltips for WP) version 5 contains a Cross Site Scripting (XSS) vulnerability in Glossary shortcode that can result in could allow anybody to do almost anything an admin can. This attack appear to be exploitable via Admin must follow a link. This vulnerability appears to have been fixed in 5.1.


Zend.To version Prior to 5.15-1 contains a Cross Site Scripting (XSS) vulnerability in The verify.php page that can result in An attacker could execute arbitrary Javascript code in the context of the victim's browser.. This attack appear to be exploitable via HTTP POST request. This vulnerability appears to have been fixed in 5.16-1 Beta.


qutebrowser

version

introduced

in

contains

a

Cross

Site

Scripting

(XSS)

vulnerability

in

history

command

page

that

can

result

in

Via

injected

JavaScript

code

a

website

can

steal

the

user's

browsing

history.

This

attack

appear

to

be

exploitable

via

the

victim

must

open

a

page

with

a

specially

crafted

<title>

attribute

and

then

open

the

site

via

the

:history

command.

This

vulnerability

appears

to

have

been

fixed

in

fixed

in

to

be

released

today)

and

released

later

this

week).


OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'scan' parameter in line #41 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack appear to be exploitable via The victim must visit on a specially crafted URL..


OpenEMR version 5.0.0 contains a Cross Site Scripting (XSS) vulnerability in open-flash-chart.swf and _posteddata.php that can result in . This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher.


easymon version 1.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in Endpoint where monitoring is mounted that can result in Reflected XSS that affects Firefox. Can be used to steal cookies depending on the cookie settings.. This attack appear to be exploitable via The victim must click on a crafted URL that contains the XSS payload. This vulnerability appears to have been fixed in 1.4.1 and later.


phpipam version 1.3.2 and earlier contains a Cross Site Scripting (XSS) vulnerability in The value of the phpipamredirect cookie is copied into an HTML tag on the login page encapsulated in single quotes. Editing the value of the cookie to r5zkh'><script>alert(1)</script>quqtl exploits an XSS vulnerability. that can result in Arbitrary code executes in victims browser.. This attack appear to be exploitable via Needs to be chained with another exploit that allows an attacker to set or modify a cookie for the phpIPAM instance's domain..


OpenEMR version v5_0_1_4 contains a Cross Site Scripting (XSS) vulnerability in The 'file' parameter in line #43 of interface/fax/fax_view.php that can result in The vulnerability could allow remote authenticated attackers to inject arbitrary web script or HTML.. This attack appear to be exploitable via The victim must visit on a specially crafted URL..


SURFnet OpenConext EngineBlock version 5.7.0 to 5.7.3 contains a Cross Site Scripting (XSS) vulnerability that can result in Allows an attacker to inject arbitrary web scripts or HTML into help and login pages. This attack appear to be exploitable via the victim opening a specially crafted URL.


Medis version 0.6.1 and earlier contains a XSS vulnerability evolving into code execution due to enabled nodeIntegration for the renderer process vulnerability in Key name parameter on new key creation that can result in Unauthorized code execution in the victim's machine within the rights of the running application. This attack appear to be exploitable via Victim is synchronizing data from the redis server which contains malicious key value.


FlightAirMap version <=v1.0-beta.21 contains a Cross Site Scripting (XSS) vulnerability in GET variable used within registration sub menu page that can result in unauthorised actions and access to data stealing session information. This vulnerability appears to have been fixed in after commit 22b09a3.


Wampserver version prior to version 3.1.5 contains a Cross Site Scripting (XSS) vulnerability in index.php localhost page that can result in very low. This attack appear to be exploitable via payload onmouseover. This vulnerability appears to have been fixed in 3.1.5 and later.


Microweber version <= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution of JavaScript code.


mcholste Enterprise Log Search and Archive (ELSA) version revision 1205 commit 2cc17f1 and earlier contains a Cross Site Scripting (XSS) vulnerability in index view (/) that can result in . This attack appear to be exploitable via Payload delivered via the type name and value parameters of /Query/set_preference and the name and value parameters of /Query/preference. Payload executed when the user visits the index view (/).


Backdrop CMS version 1.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Sanitization of custom class names used on blocks and layouts. that can result in Execution of JavaScript from an unexpected source.. This attack appear to be exploitable via A user must be directed to an affected page while logged in.. This vulnerability appears to have been fixed in 1.11.1 and later.


Cobbler version Verified as present in Cobbler versions 2.6.11+ but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Cross Site Scripting (XSS) vulnerability in cobbler-web that can result in Privilege escalation to admin.. This attack appear to be exploitable via \network connectivity\. Sending unauthenticated JavaScript payload to the Cobbler XMLRPC API (/cobbler_api).


RisingStack protect version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in isXss() function in lib/rules/xss.js that can result in dangerous XSS strings being validated as safe. This attack appears to be exploitable via A number of XSS strings(26) detailed in the GitHub issue #16.


LimeSurvey version 3.0.0-beta.3+17110 contains a Cross Site Scripting (XSS) vulnerability in Boxes that can result in JS code execution against LimeSurvey admins. This vulnerability appears to have been fixed in 3.6.x.


An

issue

was

discovered

in

QCMS

has

XSS.


An issue was discovered in the Core and Portal modules in Polaris FT Intellect Core Banking 9.7.1. Reflected XSS exists with an authenticated session via the Customerid formName FrameId or MODE parameter.


SeaCMS 6.61 has two XSS issues in the admin_config.php file via certain form fields.


An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7 11.0.x before 11.0.5 and 11.1.x before 11.1.2. XSS can occur in the branch name during a Web IDE file commit.


An issue was discovered in QCMS 3.0.1. upload/System/Controller/guest.php has XSS as demonstrated by the name parameter a different vulnerability than CVE-2018-8070.


An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists via the fourth and fifth input elements on the admincp.php?app=prop&do=add screen.


PHP Template Store Script 3.0.6 allows XSS via the Address line 1 Address Line 2 Bank name or A/C Holder name field in a profile.


uploads/.htaccess in Subrion CMS 4.2.1 allows XSS because it does not block .html file uploads (but does block for example .htm file uploads).


Matera Banco 1.0.0 is vulnerable to multiple stored XSS as demonstrated by the sca/privilegio/consultarUsuario.jsf \Nome Completo\ (aka user fullname) field.


LOYTEC LGATE-902 6.3.2 devices allow XSS.


The Mondula Multi Step Form plugin through 1.2.5 for WordPress allows XSS via the fw_data id1 fw_data id2 fw_data id3 fw_data id4 or email field of the contact form exploitable with an fw_send_email action to wp-admin/admin-ajax.php.


system/edit_book.php in XYCMS 1.7 has stored XSS via a crafted add_do.php request related to add_book.php.


Stored XSS vulnerabilities in Tiki before 18.2 15.7 and 12.14 allow an authenticated user injecting JavaScript to gain administrator privileges if an administrator opens a wiki page and moves the mouse pointer over a modified link or thumb image.


The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on the api/CallLog TimeZoneName parameter.


inc/plugins/thankyoulike.php in the Eldenroot Thank You/Like plugin before 3.1.0 for MyBB allows XSS via a post or thread subject.


Wolf CMS 0.8.3.1 has XSS in the Snippets tab as demonstrated by a ?/admin/snippet/edit/1 URI.


PRTG before 19.1.49.1966 has Cross Site Scripting (XSS) in the WEBGUI.


Matera Banco 1.0.0 is vulnerable to multiple reflected XSS as demonstrated by the /contingency/web/index.jsp (aka home page) url parameter.


Tiki before 18.2 15.7 and 12.14 has XSS via link attributes related to lib/core/WikiParser/OutputLink.php and lib/parser/parserlib.php.


Tenda D152 ADSL routers allow XSS via a crafted SSID.


The Web administration console on Polycom Trio devices with software before 5.5.4 has XSS.


Samsung Syncthru Web Service V4.05.61 is vulnerable to Multiple unauthenticated XSS attacks on several parameters as demonstrated by ruiFw_pid.


moodle before versions 3.5.2 3.4.5 3.3.8 is vulnerable to a boost theme - blog search GET parameter insufficiently filtered. The breadcrumb navigation provided by Boost theme when displaying search results of a blog were insufficiently filtered which could result in reflected XSS if a user followed a malicious link containing JavaScript in the search parameter.


An

issue

was

discovered

in

QCMS

has

XSS.


Feedback.asp in Xiao5uCompany 1.7 has XSS because the XSS protection mechanism in Safe.asp is insufficient (for example it considers SCRIPT and IMG elements but does not consider VIDEO elements).


An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7 11.0.x before 11.0.5 and 11.1.x before 11.1.2. XSS can occur in the tooltip of the job inside the CI/CD pipeline.


PHP Scripts Mall Basic B2B Script 2.0.0 has Reflected and Stored XSS via the First name Last name Address 1 City State and Company name fields.


There is a Persistent XSS vulnerability in the briefcase component of Synacor Zimbra Collaboration Suite (ZCS) Zimbra Web Client (ZWC) 8.8.8 before 8.8.8 Patch 7 and 8.8.9 before 8.8.9 Patch 1.


An XSS vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent XSS that allows remote attackers to inject arbitrary web script or HTML via the formnickname parameter to the index.php?m=core&f=set&v=sendmail URI. When the administrator accesses the \system settings - mail server\ screen the XSS payload is triggered.


Subrion CMS v4.2.1 is vulnerable to Stored XSS because of no escaping added to the tooltip information being displayed in multiple areas.


Click Studios Passwordstate before 8.3 Build 8397 allows XSS by authenticated users via an uploaded HTML document.


ecard.php in Coppermine Photo Gallery (CPG) 1.5.46 has XSS via the sender_name recipient_email greetings or recipient_name parameter.


Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients.


An issue was discovered in EMLsoft 5.4.5. XSS exists via the eml/upload/eml/?action=address&do=edit page.


The New Threads plugin before 1.2 for MyBB has XSS.


The Add page option in my little forum 2.4.12 allows XSS via the Menu Link field.


The Web server in 3CX version 15.5.8801.3 is vulnerable to Reflected XSS on all stack traces' propertyPath parameters.


An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7 11.0.x before 11.0.5 and 11.1.x before 11.1.2. XSS can occur via a Milestone name during a promotion.


InstantCMS 2.10.1 has /redirect?url= XSS.


A flaw was found in Keycloak 3.4.3.Final 4.0.0.Beta2 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.


An

issue

was

discovered

in

QCMS

has

XSS.


An issue was discovered in WeaselCMS v0.3.5. XSS exists via Site Language Site Title Site Description and Site Keywords on the SETTINGS page.


The Mondula Multi Step Form plugin before 1.2.8 for WordPress has multiple stored XSS via wp-admin/admin-ajax.php.


An issue was discovered in DataLife Engine (DLE) through 13.0. An attacker can use XSS (related to the /addnews.html and /index.php?do=addnews URIs) to send a malicious script to unsuspecting Admins or users.


In the Ban List plugin 1.0 for MyBB any forum user with mod privileges can ban users and input an XSS payload into the ban reason which is executed on the bans.php page.


The Add page option in my little forum 2.4.12 allows XSS via the Title field.


Digisol Wireless Wifi Home Router HR-3300 allows XSS via the userid or password parameter to the admin login page.


An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php PFFREE_Access_Token parameter.


Various administrative application link resources in Atlassian Application Links before version 5.4.4 allow remote attackers with administration rights to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the display url of a configured application link.


An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_height parameter.


Radiant CMS 1.1.4 has XSS via crafted Markdown input in the part_body_content parameter to an admin/pages/*/edit resource.


ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader function in setup/classes/class.ilSetupGUI.php in the Setup component.


Reservo Image Hosting 1.6 is vulnerable to XSS attacks. The affected function is its search engine (the t parameter to the /search URI). Since there is an user/admin login interface it's possible for attackers to steal sessions of users and thus admin(s). By sending users an infected URL code will be executed.


An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php logo_width parameter.


Discuz! DiscuzX X3.4 has XSS via the include\\spacecp\\spacecp_upload.php op parameter.


The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload_thumbnail (aka File Thumbnail) parameter in an edit action to wp-admin/post.php.


SonicWall SonicOS on Network Security Appliance (NSA) 2017 Q4 devices has XSS via the CFS Custom Category and Cloud AV DB Exclusion Settings screens.


An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature which is supposed to sanitize user input against XSS is flawed and does not escape the input properly. With a crafted payload XSS can be triggered as demonstrated by omitting the final '>' character from an IMG tag.


Discuz! DiscuzX X3.4 has XSS via the view parameter to include/space/space_poll.php as demonstrated by a mod=space do=poll request to home.php.


phprint.php in SugarCRM 3.5.1 has XSS via a parameter name in the query string (aka a $key variable).


An

issue

was

discovered

in

the

booking-calendar

plugin

for

WordPress.

XSS

exists

via

the

wp-admin/admin.php

parameter.


FoxSash ImgHosting 1.5 (according to footer information) is vulnerable to XSS attacks. The affected function is its search engine via the search parameter to the default URI. Since there is an user/admin login interface it's possible for attackers to steal sessions of users and thus admin(s). By sending users an infected URL code will be executed.


An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php sale_conditionscount parameter.


The EditIssue.jspa resource in Atlassian Jira before version 7.6.7 and from version 7.7.0 before version 7.10.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the issuetype parameter.


Persistent XSS exists in the web server on Cobham Sea Tel 116 build 222429 satellite communication system devices: remote attackers can inject malicious JavaScript code using the device's TELNET shell built-in commands as demonstrated by the \set ship name\ command. This is similar to a Cross Protocol Injection with SNMP.


An issue was discovered in the read-and-understood plugin 2.1 for WordPress. XSS exists via the wp-admin/options-general.php rnu_username_validation_title parameter.


An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_title parameter.


WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement (under wp-includes/js/mediaelement).


An issue was discovered in the weblizar-pinterest-feeds plugin 1.1.1 for WordPress. XSS exists via the wp-admin/admin-ajax.php security parameter.


The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.


An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php social_icon_1 parameter.


The Easy Custom Auto Excerpt plugin 2.4.6 for WordPress has XSS via the tonjoo_ecae_optionscustom_css parameter to the wp-admin/admin.php?page=tonjoo_excerpt URI.


The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.


An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php coming-soon_sub_title parameter.


An issue was discovered in the dark-mode plugin 1.6 for WordPress. XSS exists via the wp-admin/profile.php dark_mode_start parameter.


SonicWall SonicOS on Network Security Appliance (NSA) 2016 Q4 devices has XSS via the Configure SSO screens.


SonicWall Global Management System (GMS) 8.1 has XSS via the `newName` and `Name` values of the `/sgms/TreeControl` module.


An issue was discovered in PHP before 5.6.33 7.0.x before 7.0.27 7.1.x before 7.1.13 and 7.2.x before 7.2.1. There is Reflected XSS on the PHAR 404 error page via the URI of a request for a .phar file.


In Zoho ManageEngine ServiceDesk Plus before 9403 an XSS issue allows an attacker to run arbitrary JavaScript via a /api/request/?OPERATION_NAME= URI aka SD-69139.


An issue was discovered in the booking-calendar plugin 2.1.7 for WordPress. XSS exists via the wp-admin/admin.php form_field5label parameter.


The issue collector in Atlassian Jira before version 7.6.6 from version 7.7.0 before version 7.7.4 from version 7.8.0 before version 7.8.4 and from version 7.9.0 before version 7.9.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the error message of custom fields when an invalid value is specified.


index.php in CentOS-WebPanel.com (aka CWP) CentOS Web Panel through v0.9.8.12 has XSS via the id parameter to the phpini_editor module or the email_address parameter to the mail_add-new module.


The /browse/~raw resource in Atlassian Fisheye and Crucible before version 4.5.3 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the handling of response headers.


The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla! allows XSS.


An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title_icon parameter.


An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php bg_color parameter.


Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title parameter.


The SrbTransLatin plugin 1.46 for WordPress has XSS via an srbtranslatoptions action to wp-admin/options-general.php with a lang_identificator parameter.


An issue was discovered in the responsive-coming-soon-page plugin 1.1.18 for WordPress. XSS exists via the wp-admin/admin.php counter_title parameter.


Discuz! DiscuzX X3.4 has XSS via the include\\spacecp\\spacecp_space.php appid parameter in a delete action.


An

issue

was

discovered

in

the

weblizar-pinterest-feeds

plugin

for

WordPress.

XSS

exists

via

the

wp-admin/admin-ajax.php

parameter.


BizLogic xnami 1.0 has XSS via the comment parameter in an addComment action to the /media/ajax URI.