Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.10 on Windows Mac OS X Linux and Solaris and before 10.3.186.7 on Android allows remote attackers to inject arbitrary web script or HTML via a crafted URL related to a \universal cross-site scripting issue \ as exploited in the wild in September 2011.


Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.6.4 allow remote attackers to inject arbitrary web script or HTML via (1) the query string to the com_contact component as demonstrated by the Itemid parameter to index.php; (2) the query string to the com_content component as demonstrated by the filter_order parameter to index.php; (3) the query string to the com_newsfeeds component as demonstrated by an arbitrary parameter to index.php; or (4) the option parameter in a reset.request action to index.php; and when Internet Explorer or Konqueror is used (5) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component.


Cross-site scripting (XSS) vulnerability in the chg_passwd function in web/swat.c in the Samba Web Administration Tool (SWAT) in Samba 3.x before 3.5.10 allows remote authenticated administrators to inject arbitrary web script or HTML via the username parameter to the passwd program (aka the user field to the Change Password page).


Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before 1.7.0 allow remote attackers to inject arbitrary web script or HTML via (1) the URI to includes/application.php reachable through index.php; and when Internet Explorer or Konqueror is used (2) allow remote attackers to inject arbitrary web script or HTML via the searchword parameter in a search action to index.php in the com_search component. NOTE: vector 2 exists because of an incomplete fix for CVE-2011-2509.5.


Multiple cross-site scripting (XSS) vulnerabilities in Chyrp 2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the action parameter to (1) the default URI or (2) includes/javascript.php or the (3) title or (4) body parameter to admin/help.php.


Cross-site scripting (XSS) vulnerability in the Admin Control Center in Sentinel HASP Run-time Environment 5.95 and earlier in SafeNet Sentinel HASP (formerly Aladdin HASP SRM) run-time installer before 6.x and SDK before 5.11 as used in 7 Technologies (7T) IGSS 7 and other products when Firefox 2.0 is used allows remote attackers to inject arbitrary web script or HTML via unspecified vectors that trigger write access to a configuration file.


Multiple cross-site scripting (XSS) vulnerabilities in Tembria Server Monitor before 6.0.5 Build 2252 allow remote attackers to inject arbitrary web script or HTML via (1) the siteid parameter to logbook.asp (2) the siteid parameter to monitor-events.asp (3) the siteid parameter to reports-config-by-device.asp (4) the siteid parameter to reports-config-by-monitor.asp (5) the siteid parameter to reports-monitoring-queue.asp (6) the action parameter to site-list.asp the (7) siteid or (8) type parameter to event-history.asp the (9) siteid or (10) type parameter to admin-history.asp the (11) siteid or (12) id parameter to dashboard-view.asp the (13) siteid or (14) dn parameter to device-events.asp the (15) siteid or (16) submit parameter to device-finder.asp the (17) siteid or (18) dn parameter to device-monitors.asp the (19) siteid or (20) type parameter to device-views.asp the (21) siteid or (22) type parameter to monitor-views.asp the (23) siteid or (24) sel parameter to reports-list.asp the (25) siteid (26) action or (27) sel parameter to monitor-list.asp or the (28) siteid (29) action or (30) sel parameter to device-list.asp.


Multiple cross-site scripting (XSS) vulnerabilities in the PMA_unInlineEditRow function in js/sql.js in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a (1) database name (2) table name or (3) column name that is not properly handled after an inline-editing operation.


Cross-site

scripting

(XSS)

vulnerability

in

in

the

theme

module

in

Zikula

Application

Framework

build

and

probably

other

versions

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

themename

parameter

in

the

setasdefault

action

to

index.php.


Cross-site scripting (XSS) vulnerability in the login page in the administrative interface on Cisco TelePresence Video Communication Servers (VCS) with software before X7.0 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header aka Bug ID CSCts80342.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Wuzly

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

Referer

header

to

admin/login.php

and

the

q

parameter

to

search.php;

the

parameter

to

parameter

to

q

parameter

to

search.php

type

parameter

to

comments.php

sort

parameter

to

pages.php

and

posts.php

and

the

type

and

q

parameter

to

media.php

in

admin/;

the

sidebar

parameter

to

and

widgets.php

id

parameter

to

comment.php

and

type

parameter

to

media.php

and

id

and

sidebar

parameter

to

in

mobile/;

and

the

name

email

website

and

comment

parameters

to

index.php;

and

the

username

parameter

to

admin/login.php.


Multiple cross-site scripting (XSS) vulnerabilities in config_defaults_inc.php in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO as demonstrated by the PATH_INFO to (1) manage_config_email_page.php (2) manage_config_workflow_page.php or (3) bugs/plugin.php.


Google Chrome before 18.0.1025.142 does not properly handle the EUC-JP encoding system which might allow remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in LightNEasy.php in LightNEasy 3.2.4 allow remote authenticated users to inject arbitrary web script or HTML via the (1) commentemail (2) commentmessage or (3) commentname parameter in a sendcomment action for the news page.


A DOM based cross-site scripting flaw was found in the JBoss Application Server 7 before 7.1.0 Beta 1 administration console. A remote attacker could provide a specially-crafted web page and trick the valid JBoss AS user with the administrator privilege to visit it which would lead into the DOM environment modification and arbitrary HTML or web script execution.


Drupal Views Builk Operations (VBO) module 6.x-1.0 through 6.x-1.10 does not properly escape the vocabulary help when the vocabulary has had user tagging enabled and the \Modify node taxonomy terms\ action is used. A remote attacker could provide a specially-crafted URL that could lead to cross-site scripting (XSS) attack.


Cross-site scripting (XSS) vulnerability in the Managed File Transfer server in TIBCO Managed File Transfer Internet Server before 7.1.1 and Managed File Transfer Command Center before 7.1.1 and the server in TIBCO Slingshot before 1.8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in IBM OpenAdmin Tool (OAT) before 2.72 for Informix allow remote attackers to inject arbitrary web script or HTML via the (1) informixserver (2) host or (3) port parameter in a login action.


Multiple cross-site scripting (XSS) vulnerabilities in Sonexis ConferenceManager 9.2.11.0 allow remote attackers to inject arbitrary web script or HTML via (1) the txtConferenceID parameter to HostLogin.asp (2) the txtConferenceID parameter to ParticipantLogin.asp (3) the acp parameter to ForgotPIN.asp or the (4) Description (5) title or (6) Heading parameter to Error.asp.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.5 allow remote authenticated users to inject arbitrary web script or HTML via a crafted row that triggers an improperly constructed confirmation message after inline-editing and save operations related to (1) js/functions.js and (2) js/tbl_structure.js.


Cross-site scripting (XSS) vulnerability in bug_actiongroup_ext_page.php in MantisBT before 1.2.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter related to bug_actiongroup_page.php a different vulnerability than CVE-2011-3357.


Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted alias (aka nickname).


Cross-site scripting (XSS) vulnerability in TIBCO Spotfire Server 3.0.x before 3.0.2 3.1.x before 3.1.2 3.2.x before 3.2.1 and 3.3.x before 3.3.1 and Spotfire Analytics Server before 10.1.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.8 allow remote attackers to inject arbitrary web script or HTML via the (1) os (2) os_build or (3) platform parameter to (a) bug_report_page.php or (b) bug_update_advanced_page.php related to use of the Projax library.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

include/functions.php

in

PunBB

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

id

or

delete

parameter

to

delete.php

the

id

or

submit

parameter

to

edit.php

the

action

or

parameter

to

login.php

the

email

or

submit

parameter

to

misc.php

the

action

id

or

update

parameter

to

profile.php

or

the

action

timezone

or

register

parameter

to

register.php.


Multiple cross-site scripting (XSS) vulnerabilities in Bugzilla 2.x and 3.x before 3.4.13 3.5.x and 3.6.x before 3.6.7 3.7.x and 4.0.x before 4.0.3 and 4.1.x through 4.1.3 when debug mode is used allow remote attackers to inject arbitrary web script or HTML via vectors involving a (1) tabular report (2) graphical report or (3) new chart.


Multiple cross-site scripting (XSS) vulnerabilities in phpPgAdmin before 5.0.3 allow remote attackers to inject arbitrary web script or HTML via (1) a web page title related to classes/Misc.php; or the (2) return_url or (3) return_desc parameter to display.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

myAddressBook.asp

in

Sonexis

ConferenceManager

and

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

fname

lname

email

sms

or

work

parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Domain Technologie Control (DTC) before 0.34.1 allow remote authenticated users to inject arbitrary web script or HTML via the (1) message body of a support ticket or unspecified vectors to the (2) DNS and (3) MX form as demonstrated by the \Domain root TXT record:\ field.


Multiple cross-site scripting (XSS) vulnerabilities in TWiki before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the newtopic parameter in a WebCreateNewTopic action related to the TWiki.WebCreateNewTopicTemplate topic; or (2) the query string to SlideShow.pm in the SlideShowPlugin.


Cross-site scripting (XSS) vulnerability in Flowplayer Flash 3.2.7 through 3.2.16 as used in the News system (news) extension for TYPO3 and Mahara allows remote attackers to inject arbitrary web script or HTML via the plugin configuration directive in a reference to an external domain plugin.


Multiple cross-site scripting (XSS) vulnerabilities in Kodak InSite 5.5.2 allow remote attackers to inject arbitrary web script or HTML via the (1) Language parameter to Pages/login.aspx (2) HeaderWarning parameter to Troubleshooting/DiagnosticReport.asp or (3) User-Agent header to troubleshooting/speedtest.asp.


Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4 when Internet Explorer 6 or earlier is used allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578.


Multiple cross-site scripting (XSS) vulnerabilities in the DataDynamics.Reports.Web class library in GrapeCity Data Dynamics Reports before 1.6.2084.14 allow remote attackers to inject arbitrary web script or HTML via (1) the reportName or (2) uniqueId parameter to CoreViewerInit.js or the (3) uniqueId or (4) traceLevel parameter to CoreController.js as reachable by CoreHandler.ashx.


Cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint Server 2010 Windows SharePoint Services 2.0 and 3.0 SP2 and SharePoint Foundation 2010 allows remote attackers to inject arbitrary web script or HTML via the URI aka \SharePoint XSS Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in XWork in Apache Struts 2.x before 2.2.3 and OpenSymphony XWork in OpenSymphony WebWork allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) an action name (2) the action attribute of an s:submit element or (3) the method attribute of an s:submit element.


Cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3 when docutils is installed or when \format rst\ is set allows remote attackers to inject arbitrary web script or HTML via a javascript: URL in the refuri attribute. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2010-2422.


Cross-site

scripting

(XSS)

vulnerability

in

in

QooxDoo

and

possibly

other

versions

as

used

in

eyeOS

and

and

possibly

other

products

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

callback

parameter.


Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold Update 1 Update 2 and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka \Default Reflected XSS Vulnerability.\


Cross-site scripting (XSS) vulnerability in Cybozu Office 6 Cybozu Garoon 2.0.0 through 2.1.3 Cybozu Dezie before 6.1 Cybozu MailWise before 3.1 and Cybozu Collaborex before 1.5 allows remote attackers to inject arbitrary web script or HTML via vectors related to \downloading graphic files from the mail system.\


Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.41 and 7.0 before 7.0.0.19 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1308.


Cross-site scripting (XSS) vulnerability in Active Directory Certificate Services Web Enrollment in Microsoft Windows Server 2003 SP2 and Server 2008 Gold SP2 R2 and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter aka \Active Directory Certificate Services Vulnerability.\


Cross-site scripting (XSS) vulnerability in agentDetect.jsp in the web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 before 6.3.0.5 7.0 before 7.0.0.5 and 7.5 before 7.5.0.1 allows remote attackers to inject arbitrary web script or HTML via the User-Agent HTTP header.


Cross-site scripting (XSS) vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold Update 1 Update 2 and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors aka \ExcelTable Reflected XSS Vulnerability.\


Cross-site scripting (XSS) vulnerability in the EditNews function in ManageNews.php in Simple Machines Forum (SMF) before 1.1.13 and 2.x before 2.0 RC5 might allow remote authenticated users to inject arbitrary web script or HTML via a save_items action.


Cross-site scripting (XSS) vulnerability in the Installation Verification Test (IVT) application in the Install component in IBM WebSphere Application Server (WAS) before 7.0.0.15 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the management login GUI page in Symantec LiveUpdate Administrator (LUA) before 2.3 allows remote attackers to inject arbitrary web script or HTML via the username field as demonstrated by injecting an IFRAME element into the event log a different vulnerability than CVE-2011-0545.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.3.x before 3.3.10.1 and 3.4.x before 3.4.1 allow remote attackers to inject arbitrary web script or HTML via a crafted table name that triggers improper HTML rendering on a Tracking page related to (1) libraries/tbl_links.inc.php and (2) tbl_tracking.php.


Multiple cross-site scripting (XSS) vulnerabilities in IBM HTTP Server 2.0.47 and earlier as used in WebSphere Application Server and other products allow remote attackers to inject arbitrary web script or HTML via vectors involving unspecified documentation files in (1) manual/ibm/ and (2) htdocs/*/manual/ibm/.


The checkCss function in includes/Sanitizer.php in the wikitext parser in MediaWiki before 1.16.3 does not properly validate Cascading Style Sheets (CSS) token sequences which allows remote attackers to conduct cross-site scripting (XSS) attacks or obtain sensitive information by using the \\2f\\2a and \\2a\\2f hex strings to surround CSS comments.


Cross-site scripting (XSS) vulnerability in the KHTMLPart::htmlError function in khtml/khtml_part.cpp in Konqueror in KDE SC 4.4.0 through 4.6.1 allows remote attackers to inject arbitrary web script or HTML via the URI in a URL corresponding to an unavailable web site.


ikiwiki before 3.20110328 does not ascertain whether the htmlscrubber plugin is enabled during processing of the \meta stylesheet\ directive which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences in (1) the default stylesheet or (2) an alternate stylesheet.


The MHTML protocol handler in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for embedded content in an HTML document which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted EMBED element in a web page that is visited in Internet Explorer aka \MHTML Mime-Formatted Request Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in the IBM Web Interface for Content Management (aka WEBi) 1.0.4 before FP3 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2010-1242.


Cross-site scripting (XSS) vulnerability in the WebReporting module in F-Secure Policy Manager 7.x 8.00 before hotfix 2 8.1x before hotfix 3 on Windows and hotfix 2 on Linux and 9.00 before hotfix 4 on Windows and hotfix 2 on Linux allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in the Messaging module 6.x-2.x before 6.x-2.4 and 6.x-4.x before 6.x-4.0-beta8 for Drupal allows remote attackers with administer messaging permissions to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Novell Identity Manager (aka IDM) User Application 3.5.0 3.5.1 3.6.0 3.6.1 3.7.0 and 4.0.0 and Identity Manager Roles Based Provisioning Module 3.6.0 3.6.1 3.7.0 and 4.0.0 allows remote attackers to inject arbitrary web script or HTML via the apwaDetail (aka apwaDetailId) parameter aka Bug 692972.


Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5 when Internet Explorer 6 or earlier is used allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578 and CVE-2011-1587.


Multiple cross-site scripting (XSS) vulnerabilities in include/html/header.php in TaskFreak! 0.6.4 allow remote attackers to inject arbitrary web script or HTML via the (1) sContext (2) sort (3) dir and (4) show parameters in a save action to index.php; the (5) dir and (6) show parameters to print_list.php; and the (7) HTTP referer header to rss.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the UI in IBM Rational Build Forge 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the mod parameter to the fullcontrol program. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in content/error.jsp in IBM WebSphere ILOG Rule Team Server 7.1.1 allows remote attackers to inject arbitrary web script or HTML via vectors that trigger an Unknown Error document a different vulnerability than CVE-2011-4171.


Cross-site scripting (XSS) vulnerability in Liferay Portal Community Edition (CE) 6.x before 6.0.6 GA when Apache Tomcat is used allows remote authenticated users to inject arbitrary web script or HTML via a message title a different vulnerability than CVE-2004-2030.


Cross-site scripting (XSS) vulnerability in the Report Viewer Control in Microsoft Visual Studio 2005 SP1 and Report Viewer 2005 SP1 allows remote attackers to inject arbitrary web script or HTML via a parameter in a data source aka \Report Viewer Controls XSS Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in Cherry-Design Photopad 1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id or (2) datatitle parameters in an edit action to files.php or (3) id parameter in a view action to gallery.php.


Cross-site scripting (XSS) vulnerability on the HP Photosmart D110 and B110; Photosmart Plus B210; Photosmart Premium C310 Fax All-in-One and C510; and ENVY 100 D410 printers allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3 when Internet Explorer 6 or earlier is used allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character.


Cross-site scripting (XSS) vulnerability in app/views/layouts/base.rhtml in Redmine 1.0.1 through 1.1.1 allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO to projects/hg-helloworld/news/. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme as demonstrated by a javascript: URI.


Cross-site scripting (XSS) vulnerability in Microsoft Windows SharePoint Services 3.0 SP2 and SharePoint Foundation 2010 Gold and SP1 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in a request to a script aka \Contact Details Reflected XSS Vulnerability.\


Cross-site scripting (XSS) vulnerability in the logon page in Remote Desktop Web Access (RD Web Access) in Microsoft Windows Server 2008 R2 and R2 SP1 allows remote attackers to inject arbitrary web script or HTML via the URI aka \Remote Desktop Web Access Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in common.php in Post Revolution before 0.8.0c-2 allow remote attackers to inject arbitrary web script or HTML via an attribute of a (1) P a (2) STRONG a (3) A a (4) EM a (5) I a (6) IMG a (7) LI an (8) OL a (9) VIDEO or a (10) BLOCKQUOTE element.


CRLF injection vulnerability in Microsoft Forefront Unified Access Gateway (UAG) 2010 Gold Update 1 Update 2 and SP1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks and cross-site scripting (XSS) attacks via unspecified vectors aka \ExcelTable Response Splitting XSS Vulnerability.\


Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title) (2) post_status (3) comment_status (4) ping_status and (5) escaping of tags within the tags meta box.


Cross-site scripting (XSS) vulnerability in system/modules/comments/Comments.php in Contao CMS 2.9.2 and possibly other versions before 2.9.3 allows remote attackers to inject arbitrary web script or HTML via the HTTP X_FORWARDED_FOR header which is stored by system/libraries/Environment.php but not properly handled by a comments action to main.php.


Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2011-0604.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Cisco

Unified

Operations

Manager

(CUOM)

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

extn

parameter

to

iptm/advancedfind.do

the

deviceInstanceName

parameter

to

iptm/ddv.do

the

cmd

or

group

parameter

to

iptm/eventmon

the

clusterName

or

deviceName

parameter

to

or

the

ccmName

or

clusterName

parameter

to

iptm/logicalTopo.do

aka

Bug

ID


Multiple cross-site scripting (XSS) vulnerabilities in HP Power Manager (HPPM) 4.3.2 and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the logType parameter to Contents/exportlogs.asp (2) the Id parameter to Contents/pagehelp.asp or the (3) SORTORD or (4) SORTCOL parameter to Contents/applicationlogs.asp. NOTE: some of these details are obtained from third party information.


Bugzilla before 3.2.10 3.4.x before 3.4.10 3.6.x before 3.6.4 and 4.0.x before 4.0rc2 creates a clickable link for a (1) javascript: or (2) data: URI in the URL (aka bug_file_loc) field which allows remote attackers to conduct cross-site scripting (XSS) attacks against logged-out users via a crafted URI.


Cross-site scripting (XSS) vulnerability in the Servlet Engine / Web Container component in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.35 and 7.0 before 7.0.0.15 allows remote attackers to inject arbitrary web script or HTML via vectors related to the lack of an error page for an application.


Multiple cross-site scripting (XSS) vulnerabilities in PivotX 2.2.0 and possibly other versions before 2.2.2 allow remote attackers to inject arbitrary web script or HTML via the (1) color parameter to includes/blogroll.php or (2) src parameter to includes/timwrapper.php.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

and

in

EC-CUBE

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

unspecified

vectors.


Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/admin.php in the StatPressCN plugin 1.9.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) what1 (2) what2 (3) what3 (4) what4 and (5) what5 parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in VaM Shop 1.6 1.6.1 and probably earlier versions llow remote attackers to inject arbitrary web script or HTML via the (1) status parameter to admin/orders.php (2) search parameter to admin/customers.php or (3) STORE_NAME parameter to admin/configuration.php.


Multiple cross-site scripting (XSS) vulnerabilities in the HTML Manager Interface in Apache Tomcat 5.5 before 5.5.32 6.0 before 6.0.30 and 7.0 before 7.0.6 allow remote attackers to inject arbitrary web script or HTML as demonstrated via the display-name tag.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

the

management

console

in

Symantec

IM

Manager

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

refreshRateSetting

parameter

to

the

nav

or

menuitem

parameter

to

or

the

action

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities in RoboHelp 7 and 8 and RoboHelp Server 7 and 8 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors related to (1) wf_status.htm and (2) wf_topicfs.htm in RoboHTML/WildFireExt/TemplateStock/.


Cross-site scripting (XSS) vulnerability in HP Business Availability Center (BAC) 7.x through 7.55 and 8.x through 8.05 and Business Service Management (BSM) through 9.01 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Cross-site scripting (XSS) vulnerability in Adobe ColdFusion before 9.0.1 CHF1 allows remote attackers to inject arbitrary web script or HTML via an id parameter containing a JavaScript onLoad event handler for a BODY element related to a \tag body\ attack. NOTE: this was originally reported as affecting 9.0.1 CHF1 and earlier.


Cross-site scripting (XSS) vulnerability in the management GUI in the MX Management Server in Imperva SecureSphere Web Application Firewall 6.2 7.x and 8.x allows remote attackers to inject arbitrary web script or HTML via an HTTP request to a firewalled server aka Bug ID 31759.


The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image which allows remote authenticated users to conduct cross-site scripting (XSS) attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login provider site.


Multiple cross-site scripting (XSS) vulnerabilities in the Web Interface in the Endpoint Protection Manager in Symantec Endpoint Protection (SEP) 11.0.600x through 11.0.6300 allow remote attackers to inject arbitrary web script or HTML via (1) the token parameter to portal/Help.jsp or (2) the URI in a console/apps/sepm request.


Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11 and 3.x before 3.0.4 when javascript encoding is used allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.


Cross-site scripting (XSS) vulnerability in webdesktop/app in the BlackBerry Web Desktop Manager component in Research In Motion (RIM) BlackBerry Enterprise Server (BES) software before 5.0.2 MR5 and 5.0.3 before MR1 and BlackBerry Enterprise Server Express software 5.0.1 and 5.0.2 allows remote attackers to inject arbitrary web script or HTML via the displayErrorMessage parameter in a ManageDevices action.


The MHTML protocol handler in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP1 and SP2 Windows Server 2008 Gold SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer aka \MHTML Mime-Formatted Request Vulnerability.\


Cross-site scripting (XSS) vulnerability in Adobe Reader and Acrobat 10.x before 10.0.1 9.x before 9.4.2 and 8.x before 8.2.6 on Windows and Mac OS X allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2011-0587.


Cross-site scripting (XSS) vulnerability in Apache Continuum 1.1 through 1.2.3.1 1.3.6 and 1.4.0 Beta; and Archiva 1.3.0 through 1.3.3 and 1.0 through 1.22 allows remote attackers to inject arbitrary web script or HTML via a crafted parameter related to the autoIncludeParameters setting for the extremecomponents table.


WebKit

in

Apple

Safari

before

when

the

Web

Inspector

is

used

does

not

properly

handle

the

property

which

allows

user-assisted

remote

attackers

to

bypass

the

Same

Origin

Policy

and

conduct

cross-site

scripting

(XSS)

attacks

via

a

crafted

web

site.


Cross-site

scripting

(XSS)

vulnerability

in

CSCOnm/servlet/com.cisco.nm.help.ServerHelpEngine

in

the

Common

Services

Device

Center

in

Cisco

Unified

Operations

Manager

(CUOM)

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

tag

parameter

aka

Bug

ID


Cross-site scripting (XSS) vulnerability in the overlay files tab in SUSE Studio Onsite 1.2 before 1.2.1 and SUSE Studio Extension for System z 1.2 before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via a crafted application related to cloning.


Multiple cross-site scripting (XSS) vulnerabilities in the HM Community (com_hmcommunity) component before 1.01 for Joomla! allow remote attackers to inject arbitrary web script or HTML via the (1) language (2) university (3) persent (4) company_name (5) designation (6) music (7) books (8) movies (9) games (10) syp (11) ft and (12) fa parameters in a save task for a profile to index.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004 2005 2007 and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP OP MP Comfort Panels and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2011-4510.


The list_directory function in Lib/SimpleHTTPServer.py in SimpleHTTPServer in Python before 2.5.6c1 2.6.x before 2.6.7 rc2 and 2.7.x before 2.7.2 does not place a charset parameter in the Content-Type HTTP header which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks against Internet Explorer 7 via UTF-7 encoding.


Cross-site scripting (XSS) vulnerability in the process function in SSViewer.php in SilverStripe before 2.3.13 and 2.4.x before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the QUERY_STRING to template placeholders as demonstrated by a request to (1) admin/reports/ (2) admin/comments/ (3) admin/ (4) admin/show/ (5) admin/assets/ and (6) admin/security/.


Multiple cross-site scripting (XSS) vulnerabilities in Hotaru.php in the Search plugin 1.3 for Hotaru CMS allow remote attackers to inject arbitrary web script or HTML via the (1) SITE_NAME parameter to admin_index.php or the (2) return and (3) search parameters to index.php. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in index.php in JAKCMS 2.0.4.1 and possibly other versions before 2.2.6 2011-09-23 allows remote attackers to inject arbitrary web script or HTML via the userpost parameter in a PM request related to tinymce. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the com_listing component in Barter Sites component 1.3 for Joomla! allow remote authenticated users to inject arbitrary web script or HTML via the (1) listing_title (2) description (3) homeurl (aka Website Address) (4) paystring (aka Payment types accepted) (5) sell_price (6) shipping_cost and (7) quantity parameters to index.php.


Multiple cross-site scripting (XSS) vulnerabilities in KENT-WEB WEB FORUM before 5.1 allow remote attackers to inject arbitrary web script or HTML via (1) an e-mail address field or (2) a cookie a related issue to CVE-2011-3383 CVE-2011-3983 and CVE-2011-3984.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Maximo Asset Management and Asset Management Essentials 6.2 7.1 and 7.5 allow remote attackers to inject arbitrary web script or HTML via the uisesionid parameter to (1) maximo.jsp or (2) the default URI under ui/.


Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 allow remote attackers to inject arbitrary web script or HTML via (1) the username parameter in a setup action to admin/company.php or the PATH_INFO to (2) admin/security_other.php (3) admin/events.php or (4) admin/user.php.


Cross-site scripting (XSS) vulnerability in phpgwapi/js/jscalendar/test.php in EGroupware Enterprise Line (EPL) before 11.1.20110804-1 and EGroupware Community Edition before 1.8.001.20110805 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.


Cross-site

scripting

(XSS)

vulnerability

in

in

Zen

Cart

before

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

message

parameter

in

a

action

to

index.php

a

different

vulnerability

than


Cross-site scripting (XSS) vulnerability in the HTML-Template-Pro module before 0.9507 for Perl allows remote attackers to inject arbitrary web script or HTML via template parameters related to improper handling of > (greater than) and < (less than) characters.


Multiple cross-site scripting (XSS) vulnerabilities in (1) view/admin/log_item.php and (2) view/admin/log_item_details.php in the Redirection plugin 2.2.9 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Referer HTTP header in a request to a post that does not exist.


Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2 and the rails_xss plugin in Ruby on Rails 2.3.x allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an \html\ substring.


Multiple cross-site scripting vulnerabilities in Tiki 7.2 and earlier allow remote attackers to inject arbitrary web script or HTML via the path info to (1) tiki-admin_system.php (2) tiki-pagehistory.php (3) tiki-removepage.php or (4) tiki-rename_page.php.


Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.4.4_build20111103.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script as demonstrated by admin/update/settings/ and certain other files.


Multiple cross-site scripting (XSS) vulnerabilities in vTiger CRM 5.2.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) viewname parameter in a CalendarAjax action (2) activity_mode parameter in a DetailView action (3) contact_id and (4) parent_id parameters in an EditView action (5) day (6) month (7) subtab (8) view and (9) viewOption parameters in the index action and (10) start parameter in the ListView action to the Calendar module; (11) return_action and (12) return_module parameters in the EditView action and (13) query parameter in an index action to the Campaigns module; (14) return_url and (15) workflow_id parameters in an editworkflow action to the com_vtiger_workflow module; (16) display_view parameter in an index action to the Dashboard module; (17) closingdate_end (18) closingdate_start (19) date_closed (20) owner (21) leadsource (22) sales_stage and (23) type parameters in a ListView action to the Potentials module; (24) folderid parameter in a SaveandRun action to the Reports module; (25) returnaction and (26) groupId parameters in a createnewgroup action (27) mode and (28) parent parameters in a createrole action (29) src_module in a ModuleManager action (30) mode and (31) profile_id parameters in a profilePrivileges action and (32) roleid parameter in a RoleDetailView to the Settings module; and (33) action parameter to the Home module and (34) module parameter to phprint.php.


Multiple cross-site scripting (XSS) vulnerabilities in iTop (aka IT Operations Portal) 1.1.181 and 1.2.0-RC-282 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted company name (2) a crafted database server name (3) a crafted CSV file (4) a crafted copy-and-paste action (5) the auth_user parameter in a suggest_pwd action to UI.php (6) the cmenu parameter to UniversalSearch.php (7) the description parameter in a SearchFormToAdd_document_list action to UI.php (8) the category parameter in an errors action to audit.php or (9) the suggest_pwd parameter to UI.php.


Cross-site scripting (XSS) vulnerability in inc/tesmodrewite.php in CF Image Hosting Script 1.3.82 1.4.1 and probably other versions before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the q parameter. NOTE: this was originally reported as a file disclosure vulnerability but this is likely inaccurate.


Cross-site scripting (XSS) vulnerability in the HMI web server in Siemens WinCC flexible 2004 2005 2007 and 2008 before SP3; WinCC V11 (aka TIA portal) before SP2 Update 1; the TP OP MP Comfort Panels and Mobile Panels SIMATIC HMI panels; WinCC V11 Runtime Advanced; and WinCC flexible Runtime allows remote attackers to inject arbitrary web script or HTML via unspecified vectors a different vulnerability than CVE-2011-4511.


Cross-site scripting (XSS) vulnerability in the Violations Table in the management GUI in the MX Management Server in Imperva SecureSphere Web Application Firewall (WAF) 9.0 allows remote attackers to inject arbitrary web script or HTML via the username field.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

in

Zen

Cart

when

debugging

is

enabled

might

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

or

a

different

vulnerability

than


Multiple cross-site scripting (XSS) vulnerabilities in Dolibarr 3.1.0 RC and probably earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) index.php (2) admin/boxes.php (3) comm/clients.php (4) commande/index.php; and the optioncss parameter to (5) admin/ihm.php and (6) user/home.php.


Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0 3.1.0 3.2.0 3.2.1 and possibly earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi related to the log file viewer a different vulnerability than CVE-2011-3361.


Multiple cross-site scripting (XSS) vulnerabilities in the Control Panel in Parallels Plesk Panel 10.2.0 build 20110407.20 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script as demonstrated by smb/user/create and certain other files.


Cross-site scripting (XSS) vulnerability in the print_object function in lib/datalib.php in Moodle 2.0.x before 2.0.6 and 2.1.x before 2.1.3 when a developer debugging script is enabled allows remote attackers to inject arbitrary web script or HTML via vectors involving object states.


Multiple cross-site scripting (XSS) vulnerabilities in Elxis CMS 2009.2 2009.3 and 2009.3 Aphrodite before revision 2684 allow remote attackers to inject arbitrary web script or HTML via the (1) task parameter to elxis/index.php and (2) PATH_INFO to elxis/administrator/index.php.


Cross-site scripting (XSS) vulnerability in Invensys Wonderware HMI Reports 3.42.835.0304 and earlier as used in Ocean Data Systems Dream Report before 4.0 and other products allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.


Multiple cross-site scripting (XSS) vulnerabilities in the billing system for Parallels Plesk Panel 10.3.1_build1013110726.09 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script as demonstrated by admin/index.php/default and certain other files.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Symphony

CMS

and

possibly

other

versions

before

allow

remote

authenticated

users

with

Author

privileges

to

inject

arbitrary

web

script

or

HTML

via

the

profile

parameter

to

as

demonstrated

via

requests

to

(a)

the

default

URI

(b)

about/

or

(c)

drafts/;

or

the

filter

parameter

in

as

demonstrated

via

requests

to

(d)

symphony/publish/comments

or

(e)

symphony/publish/images.

NOTE:

some

of

these

details

are

obtained

from

third

party

information.


Multiple cross-site scripting (XSS) vulnerabilities in the media-filter implementation in filter/mediaplugin/filter.php in Moodle 1.9.x before 1.9.11 and 2.0.x before 2.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) Flash Video (aka FLV) files and (2) YouTube videos.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

AutoSec

Tools

V-CMS

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

p

parameter

to

redirect.php

and

box

parameter

to

which

is

not

properly

handled

in


Multiple cross-site scripting (XSS) vulnerabilities in GoAhead Webserver 2.18 allow remote attackers to inject arbitrary web script or HTML via (1) the group parameter to goform/AddGroup related to addgroup.asp; (2) the url parameter to goform/AddAccessLimit related to addlimit.asp; or the (3) user (aka User ID) or (4) group parameter to goform/AddUser related to adduser.asp.


Multiple cross-site scripting (XSS) vulnerabilities in the Site Editor (aka SiteBuilder) feature in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script as demonstrated by Wizard/Edit/Modules/Image and certain other files.


Multiple cross-site scripting (XSS) vulnerabilities in the commenting system in Review Board before 1.5.7 and 1.6.x before 1.6.3 allow remote attackers to inject arbitrary web script or HTML via vectors involving the (1) diff viewer or (2) screenshot component.


Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 3.4.x before 3.4.8 allow remote attackers to inject arbitrary web script or HTML via (1) a crafted database name related to the Database Synchronize panel; (2) a crafted database name related to the Database rename panel; (3) a crafted SQL query related to the table overview panel; (4) a crafted SQL query related to the view creation dialog; (5) a crafted column type related to the table search dialog; or (6) a crafted column type related to the create index dialog.


Multiple cross-site scripting (XSS) vulnerabilities in the user profile feature in Atlassian FishEye before 2.5.5 allow remote attackers to inject arbitrary web script or HTML via (1) snippets in a user comment which is not properly handled in a Confluence page or (2) the user profile display name which is not properly handled in a FishEye page.


Multiple SQL injection vulnerabilities in symphony/content/content.publish.php in Symphony CMS 2.2.3 and possibly other versions before 2.2.4 allow remote authenticated users with Author permissions to execute arbitrary SQL commands via the filter parameter to (1) symphony/publish/comments or (2) symphony/publish/images. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks via error messages. NOTE: some of these details are obtained from third party information.


Cross-site scripting (XSS) vulnerability in Zope 2.8.x before 2.8.12 2.9.x before 2.9.12 2.10.x before 2.10.11 2.11.x before 2.11.6 and 2.12.x before 2.12.3 3.1.1 through 3.4.1. allows remote attackers to inject arbitrary web script or HTML via vectors related to the way error messages perform sanitization. NOTE: this issue exists because of an incomplete fix for CVE-2010-1104


Cross-site scripting (XSS) vulnerability in Schneider Electric Vijeo Historian 4.30 and earlier CitectHistorian 4.30 and earlier and CitectSCADAReports 4.10 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Parallels Plesk Small Business Panel 10.2.0 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script as demonstrated by smb/app/available/id/apscatalog/ and certain other files.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Joomla!

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

header

to

or


Cross-site scripting (XSS) vulnerability in the JMX console in JBoss Enterprise Application Platform (EAP) before 5.2.0 Web Platform (EWP) before 5.2.0 BRMS Platform before 5.3.1 and SOA Platform before 5.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in admin/configuration.php in Geeklog before 1.7.1sr1 allow remote attackers to inject arbitrary web script or HTML via the (1) subgroup or (2) conf_group parameters. NOTE: this vulnerability might require a user-assisted attack or a bypass of a CSRF protection mechanism.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Prestashop

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

address

or

parameter

to

the

Pays

Ville

CP

Poids

Action

or

num

parameter

to

the

parameter

to

the

Expedition

parameter

to

or

the

folder

or

name

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities in the Virus Scan Interface in SAP Netweaver allow remote attackers to inject arbitrary web script or HTML via the (1) instname parameter to the VsiTestScan servlet and (2) name parameter to the VsiTestServlet servlet.


Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.26 and other versions before 1.0.0 allow remote attackers to inject arbitrary web script or HTML via the URL to (1) e107_images/thumb.php or (2) rate.php (3) resend_name parameter to e107_admin/users.php and (4) link BBCode in user signatures.


Multiple cross-site scripting (XSS) vulnerabilities in Zabbix before 1.8.10 allow remote attackers to inject arbitrary web script or HTML via the gname parameter (aka host groups name) to (1) hostgroups.php and (2) usergrps.php the update action to (3) hosts.php and (4) scripts.php and (5) maintenance.php.


Multiple cross-site scripting (XSS) vulnerabilities in libraries/display_export.lib.php in phpMyAdmin 3.4.x before 3.4.9 allow remote attackers to inject arbitrary web script or HTML via crafted URL parameters related to the export panels in the (1) server (2) database and (3) table sections.


Cross-site scripting (XSS) vulnerability in the theme_adium_append_message function in empathy-theme-adium.c in the Adium theme in libempathy-gtk in Empathy 3.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted alias (aka nickname) in a /me event a different vulnerability than CVE-2011-3635.


Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.5.1.a and possibly earlier versions allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter to include/formdhtmltextarea_preview.php or (2) img BBCODE tag within the message parameter to pmlite.php (aka Private Message). NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the Server Administration Panel in Parallels Plesk Panel 10.2.0_build1011110331.18 allow remote attackers to inject arbitrary web script or HTML via crafted input to a PHP script as demonstrated by admin/health/ and certain other files.


Multiple cross-site scripting (XSS) vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to (1) inc-options/deinstall_options.php (2) inc-options/theme_options.php or (3) inc-options/im_export_options.php or the (4) post or (5) post_ID parameters to adminimize.php different vectors than CVE-2011-4926.


Multiple cross-site scripting (XSS) vulnerabilities in OrangeHRM before 2.6.11.2 allow remote attackers to inject arbitrary web script or HTML via the (1) uniqcode or (2) isAdmin parameter to index.php; or the (3) PATH_INFO to lib/controllers/centralcontroller.php.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Web Experience Factory (aka WEF formerly WebSphere Portlet Factory) 7.0 and 7.0.1 allow remote attackers to inject arbitrary web script or HTML via a (1) text INPUT element or (2) TEXTAREA element related to an interaction between Smart Refresh and Dojo.


Multiple cross-site scripting (XSS) vulnerabilities in EmployeeSearch.cc in ZOHO ManageEngine ADSelfService Plus 4.5 Build 4521 allow remote attackers to inject arbitrary web script or HTML via the (1) searchType and (2) searchString parameters a different vulnerability than CVE-2010-3274.


Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.4.0-rc13 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tf_delegation (2) tf_ip or (3) tf_name parameter in a search action to host/host_index.php; (4) login parameter to obm.php; or (5) tf_user parameter in a search action to group/group_index.php.


Cross-site scripting (XSS) vulnerability in the addPost function in data/functions.php in Winn GuestBook before 2.4.8d allows remote attackers to inject arbitrary web script or HTML via the name parameter to index.php. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in PHPDug 2.0.0 allow remote attackers to inject arbitrary web script or HTML via (1) the story_url parameter to add_story.php (2) the email parameter to editprofile.php (3) the title parameter to adm/content_add.php or (4) the username parameter to adm/admin_edit.php.


** DISPUTED ** Cross-site scripting (XSS) vulnerability in lanoba-social-plugin/index.php in the Lanoba Social plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor disputes this issue stating \Lanoba's plug in does sanitize user input and because that input is never sent to the browser an attacker has no way of executing script or code on a user's behalf.\


Multiple cross-site scripting (XSS) vulnerabilities in admin/controller.php in eSyndiCat Pro 2.3.05 allow remote attackers to inject arbitrary web script or HTML via the (1) id parameter to the admins (2) blocks (3) articles or (4) suggest-category; or (5) sort parameter to the search page.


Multiple cross-site scripting (XSS) vulnerabilities in CosmoShop ePRO 10.05.00 allow remote attackers to inject arbitrary web script or HTML via (1) the rcopy parameter to cgi-bin/admin/rubrikadmin.cgi (2) the typ parameter to cgi-bin/admin/artikeladmin.cgi or (3) the suchbegriff parameter to cgi-bin/admin/shophilfe_suche.cgi.


Multiple cross-site scripting (XSS) vulnerabilities in Open Business Management (OBM) 2.3.20 and probably earlier allow remote attackers to inject arbitrary web script or HTML via the (1) tf_name (2) tf_delegation and (3) tf_ip parameters to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in Support Incident Tracker (aka SiT!) 3.65 allow remote attackers to inject arbitrary web script or HTML via (1) the file name to incident_attachments.php; (2) unspecified vectors in link_add.php possibly involving origref linkref linktype parameters which are not properly handled in the clean_int function in lib/base.inc.php or the redirect parameter which is not properly handled in the html_redirect function in lib/html.inc.php; and (3) unspecified vectors in translate.php.


Multiple cross-site scripting (XSS) vulnerabilities in the Authoritative DNS - DNS Zones page in Barracuda Link Balancer 330 Firmware 1.3.2.005 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) zoneid or (2) scope parameter.


Multiple cross-site scripting (XSS) vulnerabilities in the Sodahead Polls plugin before 2.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via (1) the poll_id parameter to customizer.php or (2) the customize parameter to poll.php.


Cross-site scripting (XSS) vulnerability in the Support Ticketing System module 6.x-1.x before 6.x-1.7 for Drupal allows remote authenticated users with the \administer support projects\ permission to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in BugFree 2.1.3 allow remote attackers to inject arbitrary web script or HTML via (1) the ActionType parameter to Bug.php the ReportMode parameter to (2) Report.php or (3) ReportLeft.php or the PATH_INFO to (4) AdminProjectList.php (5) AdminGroupList.php or (6) AdminUserLogList.php.


Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin 1.4.2.3 for WordPress when the WHOIS widget is enabled allows remote attackers to inject arbitrary web script or HTML via the domain parameter to index.php a different vulnerability than CVE-2011-5194.


Cross-site scripting (XSS) vulnerability in wpsc-admin/display-sales-logs.php in WP e-Commerce plugin 3.8.7.1 and possibly earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the custom_text parameter. NOTE: some of these details are obtained from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

poMMo

Aardvark

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

referer

parameter

to

index.php

the

parameter

to

the

parameter

to

or

the

parameter

to


Multiple cross-site scripting (XSS) vulnerabilities in the wiki application in Yaws 1.88 allow remote attackers to inject arbitrary web script or HTML via (1) the tag parameter to editTag.yaws (2) the index parameter to showOldPage.yaws (3) the node parameter to allRefsToMe.yaws or (4) the text parameter to editPage.yaws.


Cross-site scripting (XSS) vulnerability in clickdesk.php in ClickDesk Live Support - Live Chat plugin 2.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the cdwidgetid parameter. NOTE: some of these details are obtained from third party information.


Multiple cross-site scripting (XSS) vulnerabilities in the Classipress theme before 3.1.5 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) twitter_id parameter related to the Twitter widget and (2) facebook_id parameter related to the Facebook widget.


Cross-site scripting (XSS) vulnerability in the Webform Validation module 6.x-1.x before 6.x-1.5 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with permissions to \update Webform nodes\ to inject arbitrary web script or HTML via unspecified vectors.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

HESK

before

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

or

hesklangENCODING

parameter

to

inc/header.inc.php;

the

hesklangattempt

parameter

to

inc/attachments.inc.php

inc/common.inc.php

inc/database.inc.php

or

or

the

to


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

BrowserCRM

and

earlier

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

to

index.php

or

login

parameter

to

index.php

or

pub/clients.php;

or

framed

parameter

to

licence/index.php

or

licence/view.php.


Multiple cross-site scripting (XSS) vulnerabilities in Gollos 2.8 allow remote attackers to inject arbitrary web script or HTML via the returnurl parameter to (1) register.aspx (2) publication/info.aspx or (3) user/add.aspx or (4) the q parameter to product/list.aspx.


Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.08 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) testaddr or (2) testpass parameter to auth-settings.php; (3) hostname (4) domainname or (5) mailserver parameter to setup-relay.php; or (6) subnetmask or (7) defaultroute parameter to setup-network.php.


Multiple cross-site scripting (XSS) vulnerabilities in SpamTitan 5.07 and possibly earlier allow remote attackers or authenticated users to inject arbitrary web script or HTML via the (1) ipaddress or (2) domain parameter to setup-network.php different vectors than CVE-2011-5149. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Multiple

cross-site

scripting

(XSS)

vulnerabilities

in

Social

Book

Facebook

Clone

allow

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

parameter

to

signup.php

lostpass.php

login.php

index.php

or

help.php.


Cross-site scripting (XSS) vulnerability in the Meta tags quick module 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via unspecified vectors probably related to \names of entity bundles.\


Cross-site scripting (XSS) vulnerability in the poll module in Subrion CMS 2.0.4 allows remote attackers to inject arbitrary web script or HTML via the title field. NOTE: some of these details are obtained from third party information. NOTE: this might overlap CVE-2012-5452.


Cross-site scripting (XSS) vulnerability in vendors/samswhois/samswhois.inc.php in the Whois Search plugin before 1.4.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the domain parameter a different vulnerability than CVE-2011-5193.


Multiple cross-site scripting (XSS) vulnerabilities in spell-check-savedicts.php in the SpellChecker module in Xinha as used in WikiWig 5.01 and possibly other products allow remote attackers to inject arbitrary web script or HTML via the (1) to_p_dict or (2) to_r_list parameter. NOTE: this issue might be related to the htmlarea plugin and CVE-2013-5670.


Cross-site scripting (XSS) vulnerability in wp-1pluginjquery.php in the ZooEffect plugin 1.01 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. NOTE: some of these details are obtained from third party information. NOTE: this has been disputed by a third party.


Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remote attacker to inject arbitrary javascript via the onerror parameter in the /__r2/query endpoints.


Multiple cross-site scripting (XSS) vulnerabilities in ProfileDesign CMS v6.0.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) page (2) gbs (3) side (4) id (5) imgid (6) cat or (7) orderby parameter.


A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18 Magento 2.2 prior to 2.2.9 Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user to escalate privileges (admin vs. admin XSS attack).


A cross-site scripting (XSS) vulnerability in Jitbit .NET Forum (aka ASP.NET forum) 8.3.8 allows remote attackers to inject arbitrary web script or HTML via the gravatar URL parameter.


A cross-site scripting (XSS) vulnerability in index.php in ClonOS WEB control panel 19.09 allows remote attackers to inject arbitrary web script or HTML via the lang parameter.


A cross-site scripting (XSS) vulnerability in app/dialplans/dialplans.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the app_uuid parameter.


A cross-site scripting (XSS) vulnerability in app/dialplans/dialplan_detail_edit.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the dialplan_uuid parameter.


A cross-site scripting (XSS) vulnerability in app/fax/fax_log_view.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the fax_uuid parameter.


A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter a different vulnerability than CVE-2018-19934 and CVE-2019-13182.


A cross-site scripting (XSS) vulnerability in app/fax/fax_files.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.


A

cross-site

scripting

(XSS)

vulnerability

in

in

FusionPBX

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

the

id

and/or

parameter.


A cross-site scripting (XSS) vulnerability in app/fifo_list/fifo_interactive.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the c parameter.


A cross-site scripting (XSS) vulnerability in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web script or HTML via the redirect parameter.


A Cross-site scripting (XSS) vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter (aka $search_term or the Search field).


A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue is fixed in iOS 12.1.3 Safari 12.0.3. Processing maliciously crafted web content may lead to a cross site scripting attack.


Stored cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to inject arbitrary web script or HTML via the Management Page.


A cross-site scripting (XSS) vulnerability in getPagingStart() in core/lists/PAGING.php in WIKINDX before 5.8.2 allows remote attackers to inject arbitrary web script or HTML via the PagingStart parameter.


A cross-site scripting (XSS) vulnerability in noMenu() and noSubMenu() in core/navigation/MENU.php in WIKINDX prior to version 5.8.1 allows remote attackers to inject arbitrary web script or HTML via the method parameter.


A cross-site scripting vulnerability in Jenkins Warnings NG Plugin 5.0.0 and earlier allowed attacker with Job/Configure permission to inject arbitrary JavaScript in build overview pages.


A

cross-site

scripting

(XSS)

vulnerability

in

HumHub

allows

remote

attackers

to

inject

arbitrary

web

script

or

HTML

via

a

POST

request.


Multiple cross-site scripting (XSS) vulnerabilities in Mailbird before 2.7.5.0 r allow remote attackers to execute arbitrary JavaScript in a privileged context via a crafted HTML mail message. This vulnerability is distinct from CVE-2015-4657.


A Cross-Site Scripting (XSS) vulnerability in the blog function in SITOS six Build v6.2.1 allows remote attackers to inject arbitrary web script or HTML via the id parameter.


A cross-site scripting (XSS) vulnerability in upload.php in SunHater KCFinder 3.20-test1 3.20-test2 3.12 and earlier allows remote attackers to inject arbitrary web script or HTML via the CKEditorFuncNum parameter.


A cross-site scripting (XSS) vulnerability in ressource view in core/modules/resource/RESOURCEVIEW.php in Wikindx prior to version 5.7.0 allows remote attackers to inject arbitrary web script or HTML via the id parameter.


A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password parameter.


Multiple cross-site scripting (XSS) vulnerabilities in CS-Cart before 4.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) settings_file or (2) data_file parameter to (a) ampie.swf (b) amline.swf or (c) amcolumn.swf.


Multiple cross-site scripting (XSS) vulnerabilities in www/administrator.php in eFront 3.6.14 (build 18012) allow remote authenticated administrators to inject arbitrary web script or HTML via the (1) Last name (2) Lesson name or (3) Course name field.


Multiple cross-site scripting (XSS) vulnerabilities in LiveZilla before 5.1.2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) full name field (2) company field or (3) filename to chat.php.


Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer GRC 5.x before 5.4 SP1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in OpenStack Dashboard (Horizon) 2013.2 and earlier allow local users to inject arbitrary web script or HTML via an instance name to (1) \Volumes\ or (2) \Network Topology\ page.


Multiple cross-site scripting (XSS) vulnerabilities in WebProcess.srv in IBM TRIRIGA Application Platform 3.2.x and 3.3.x before 3.3.1.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the site creation interface in ikiwiki-hosting before 0.20131025 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Apache Struts 2.3.15.3 allow remote attackers to inject arbitrary web script or HTML via the namespace parameter to (1) actionNames.action and (2) showConfig.action in config-browser/.


Multiple cross-site scripting (XSS) vulnerabilities in the (1) JavaDumpService and (2) DataCollector servlets in SAP NetWeaver allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Cisco WebEx Meeting Center allow remote attackers to inject arbitrary web script or HTML via a crafted URL aka Bug ID CSCul36248.


Multiple cross-site scripting (XSS) vulnerabilities in the Calendar module in Olat 7.8.0.1 (b20130821 N1) allow remote attackers to inject arbitrary web script or HTML via the (1) event name or (2) date field.


Multiple cross-site scripting (XSS) vulnerabilities in JBPM KIE Workbench 6.0.x allow remote authenticated users to inject arbitrary web script or HTML via vectors related to task name html inputs.


Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Information Server 8.x through 8.5 FP3 8.7.x through 8.7 FP2 and 9.1.x through 9.1.2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified interfaces.


Multiple cross-site scripting (XSS) vulnerabilities in Review Board 1.6.x before 1.6.21 and 1.7.x before 1.7.17 allow remote attackers to inject arbitrary web script or HTML via the (1) Branch field or (2) caption of an uploaded file.


Multiple cross-site scripting (XSS) vulnerabilities in REDCap before 5.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors involving different modules.


Multiple cross-site scripting (XSS) vulnerabilities in Mintboard 0.3 allow remote attackers to inject arbitrary web script or HTML via the (1) name or (2) pass parameter in views/login.php or (3) name or (4) pass parameter in views/signup.php.


Multiple cross-site scripting (XSS) vulnerabilities in the management console on the Symantec Web Gateway (SWG) appliance before 5.1.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Apache Roller before 5.0.2 allow remote attackers to inject arbitrary web script or HTML via vectors related to the search results in the (1) RSS and (2) Atom feed templates.


Multiple cross-site scripting (XSS) vulnerabilities in Owl Intranet Knowledgebase 1.10 allow remote authenticated users to inject arbitrary web script or HTML via (1) the Search field to browse.php or (2) the Title field to prefs.php.


A Cross-site scripting (XSS) vulnerability exists in Conversation Overview Nickname in Cryptocat before 2.0.22.


Multiple cross-site scripting (XSS) vulnerabilities in the GateIn Portal component in Red Hat JBoss Portal 6.1.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Moodle through 2.2.11 2.3.x before 2.3.9 2.4.x before 2.4.6 and 2.5.x before 2.5.2 allow remote attackers to inject arbitrary web script or HTML via a crafted blog link within an RSS feed.


Multiple cross-site scripting (XSS) vulnerabilities in the JUnit files in the GWTTestCase in Google Web Toolkit (GWT) before 2.5.1 RC1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.8b and earlier allow remote attackers to inject arbitrary web script or HTML via (1) the step parameter to install/index.php or (2) the id parameter to cacti/host.php.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2 and Sterling File Gateway 2.2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified parameters.


Multiple cross-site scripting (XSS) vulnerabilities in shopping/payment.tpl components in LOCKON EC-CUBE 2.11.0 through 2.13.0 allow remote attackers to inject arbitrary web script or HTML via crafted values.


Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.8 allow remote attackers to inject arbitrary web script or HTML via crafted input containing a %22 sequence a different issue than CVE-2013-3604.


Multiple cross-site scripting (XSS) vulnerabilities in Vastal I-Tech phpVID 1.2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) n parameter to browse_videos.php or the (2) cat parameter to groups.php.


Multiple cross-site scripting (XSS) vulnerabilities in Graphite before 0.9.11 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the Guestbook module for PHPCMS allow remote attackers to inject arbitrary web script or HTML via the (1) list or (2) introduce parameter to index.php.


Multiple cross-site scripting (XSS) vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary web script or HTML via the (1) \an\ parameter to agenda.php or (2) cat parameter to mobile/thread.php.


Multiple cross-site scripting (XSS) vulnerabilities in WebCenter in WatchGuard WSM and Fireware before 11.8 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters.


Multiple cross-site scripting (XSS) vulnerabilities in ESRI ArcGIS for Server 10.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


A Cross-site Scripting (XSS) vulnerability exists in the All in One SEO Pack plugin before 2.0.3.1 for WordPress via the Search parameter.


Multiple cross-site scripting (XSS) vulnerabilities in WebKit in Apple iOS before 7 allow user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) drag-and-drop or (2) copy-and-paste operation.


Multiple cross-site scripting (XSS) vulnerabilities in Cisco Unity Express before 8.0 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors aka Bug ID CSCud87527.


A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.13 allows remote authenticated users to inject arbitrary web script or HTML via a project name.


Multiple cross-site scripting (XSS) vulnerabilities in (1) index.php and (2) datePicker.php in Easy PHP Calendar 6.x and 7.x before 7.0.13 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function names.


Multiple cross-site scripting (XSS) vulnerabilities in the Views module 7.x-3.x before 7.x-3.6 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via certain view configuration fields.


A cross-site scripting (XSS) vulnerability in MantisBT 1.2.14 allows remote attackers to inject arbitrary web script or HTML via a version related to deleting a version.


Multiple cross-site scripting (XSS) vulnerabilities in Wiki Server in Apple Mac OS X Server before 2.2.2 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in jwplayer.swf in the smart-flv plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) link or (2) playerready parameter.


Multiple cross-site scripting (XSS) vulnerabilities in the server in Cisco Unified MeetingPlace 7.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters aka Bug IDs CSCuc65411 and CSCue18706.


A cross-site scripting (XSS) vulnerability in the configuration report page (adm_config_report.php) in MantisBT 1.2.0rc1 before 1.2.14 allows remote authenticated users to inject arbitrary web script or HTML via a complex value.


Multiple cross-site scripting (XSS) vulnerabilities in administrative-interface pages in the management console in Symantec Brightmail Gateway 9.5.x allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling B2B Integrator 5.2.4 and Sterling File Gateway allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.5.1 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) gallery shortcodes or (2) the content of a post.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Eclipse Help System (IEHS) 3.4.3 and 3.6.2 as used in IBM SPSS Data Collection 6.0 6.0.1 and 7.0 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in the administration interface in ASKIA askiaweb allow remote attackers to inject arbitrary web script or HTML via the (1) Number or (2) UpdatePage parameter to WebProd/cgi-bin/AskiaExt.dll.


Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the HMI web application in Siemens WinCC (TIA Portal) 11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA Archer 5.x before GRC 5.3SP1 and Archer Smart Suite Framework 4.x allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in the Classic Meeting Server in IBM Sametime 7.5.1.2 through 8.5.2.1 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Ganglia Web before 3.5.6 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in IBM iNotes 8.5.x allow local users to inject arbitrary web script or HTML via a shared mail file aka SPR DKEN8PDNTX.


Multiple cross-site scripting (XSS) vulnerabilities in iNotes 8.5.x in IBM Lotus Domino 8.5 before 8.5.3 FP5 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors aka SPR PTHN95XNR3.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 and 8.x before 8.5.0.4 allow remote attackers to inject arbitrary web script or HTML via a crafted report.


Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.16 and 5.x before 5.0.7 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to shared files.


Multiple cross-site scripting (XSS) vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) notify or (2) blog parameter.


Multiple cross-site scripting (XSS) vulnerabilities in Google Chrome before 27.0.1453.93 allow user-assisted remote attackers to inject arbitrary web script or HTML via vectors involving a (1) drag-and-drop or (2) copy-and-paste operation.


Multiple cross-site scripting (XSS) vulnerabilities in IBM Sterling File Gateway 2.2 and Sterling B2B Integrator allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors a different issue than CVE-2013-0468.


Multiple cross-site scripting (XSS) vulnerabilities in js/viewer.js in ownCloud before 4.5.12 and 5.x before 5.0.7 allow remote attackers to inject arbitrary web script or HTML via vectors related to shared files.


Multiple cross-site scripting (XSS) vulnerabilities in ownCloud before 4.0.15 4.5.x before 4.5.11 and 5.0.x before 5.0.6 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in BoltWire 3.5 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) \p\ or (2) content parameter to index.php.


Multiple cross-site scripting (XSS) vulnerabilities in lib/conditionlib.php in Moodle 2.4.x before 2.4.5 and 2.5.x before 2.5.1 allow remote attackers to inject arbitrary web script or HTML via the conditional access rule value of a user field.


Unspecified Cross-site scripting (XSS) vulnerability in the Verizon FIOS Actiontec MI424WR-GEN3I router.


Multiple cross-site scripting (XSS) vulnerabilities in EMC Documentum eRoom before 7.4.4 P11 allow remote attackers to inject arbitrary web script or HTML via a crafted URL.


Multiple cross-site scripting (XSS) vulnerabilities in Coursemill Learning Management System (LMS) 6.6 allow remote attackers to inject arbitrary web script or HTML via crafted input.


Multiple cross-site scripting (XSS) vulnerabilities in Xaraya 2.4.0-b1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) id (2) interface (3) name or (4) tabmodule parameter to index.php.


Multiple cross-site scripting (XSS) vulnerabilities in Belkin N300 router allow remote attackers to inject arbitrary web script or HTML via the Guest Access PSK field to wireless_guest2_print.stm or other unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Belkin Model F5D8236-4 v2 router allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Opsview before 4.4.1 and Opsview Core before 20130522 allow remote attackers to inject arbitrary web script or HTML.


Multiple cross-site scripting (XSS) vulnerabilities in todooforum.php in Todoo Forum 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) id_post or (2) pg parameter.


A Cross-site scripting (XSS) vulnerability in Users in Qiong ICP EyouCMS 1.5.4 allows remote attackers to inject arbitrary web script or HTML via the `title` parameter in bind_email function.


Persistent cross-site scripting (XSS) in the web interface of SuiteCRM before 7.11.19 allows a remote attacker to introduce arbitrary JavaScript via malicious SVG files. This occurs because the clean_file_output protection mechanism can be bypassed.


Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through contact.php.


A cross-site scripting (XSS) vulnerability in Online Catering Reservation System using PHP on Sourcecodester allows an attacker to arbitrarily inject code in the search bar.


Persistent cross-site scripting (XSS) in Hospital Management System targeted towards web admin through prescribe.php.


Reflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009.


A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php and the \search_name\ parameter.


CSRF + Cross-site scripting (XSS) vulnerability in search.php in PHPFusion 9.03.110 allows remote attackers to inject arbitrary web script or HTML


A cross-site scripting (XSS) vulnerability in Skoruba IdentityServer4.Admin before 2.0.0 via unencoded value passed to the data-secret-value parameter.


A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the \category\ parameter.


A cross-site scripting (XSS) issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via alerts.php and the \from_time\ parameter.


A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/my_images.php URI.


A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via webmaster-tools.php in the \to_time\ parameter.


A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the \report_type\ parameter.


A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/edit_personal_page.php URI.


A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/users_import.php URI.


A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/user_activity.php URI.


A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/index.php URI.


A cross-site scripting (XSS) issue in SEO Panel 4.8.0 allows remote attackers to inject JavaScript via archive.php in the \type\ parameter.


A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/preferences.php URI.


A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/permissions.php URI.


Stored cross-site scripting (XSS) issue in Esri Portal for ArcGIS may allow a remote unauthenticated attacker to pass and store malicious strings in the home application.


A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/index.php URI.


A cross-site scripting (XSS) vulnerability in Bitweaver version 3.1.0 allows remote attackers to inject JavaScript via the /users/admin/edit_group.php URI.


A cross-site scripting (XSS) vulnerability in Pryaniki 6.44.3 allows remote authenticated users to upload an arbitrary file. The JavaScript code will execute when someone visits the attachment.


A cross-site scripting (XSS) vulnerability on the Delete Personal Data page in Cryptshare Server before 4.8.0 allows an attacker to inject arbitrary web script or HTML via the user name. The issue is fixed with the version 4.8.1


Stored cross-site scripting (XSS) in form field in robust.systems product Custom Global Variables v 1.0.5 allows a remote attacker to inject arbitrary code via the vars0name field.


Self cross-site scripting (XSS) was possible on devices page. The following products are affected: Acronis Cyber Protect 15 (Windows Linux) before build 28035


Stored cross-site scripting (XSS) was possible in protection plan details. The following products are affected: Acronis Cyber Protect 15 (Windows Linux) before build 28035


Stored cross-site scripting (XSS) was possible in activity details. The following products are affected: Acronis Cyber Protect 15 (Windows Linux) before build 28035


A Cross-Site Scripting (XSS) vulnerability exists in Courcecodester Multi Restaurant Table Reservation System 1.0 in register.php via the (1) fullname (2) phone and (3) address parameters.


A Cross-Site Scripting (XSS) issue in the chat component of Etherpad 1.8.13 allows remote attackers to inject arbitrary JavaScript or HTML by importing a crafted pad.


Multiple cross-site scripting (XSS) vulnerabilities in DRK Odenwaldkreis Testerfassung March-2021 allow remote attackers to inject arbitrary web script or HTML via all parameters to HTML form fields in all components.


Reflected Cross-site scripting (XSS) vulnerability in RosarioSIS 8.2.1 allows attackers to inject arbitrary HTML via the search_term parameter in the modules/Scheduling/Courses.php script.


Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator affecting version version 7.8 Update 1 and earlier versions. The vulnerability could allow disclosure of confidential data.


Reflected cross-site scripting vulnerability in the admin page of Calendar01 free edition ver1.0.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.


Reflected cross-site scripting vulnerability in the admin page of Telop01 free edition ver1.0.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.


Stored cross-site scripting vulnerability in Admin Page of GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote authenticated attackers to inject an arbitrary script via unspecified vectors.


Stored cross-site scripting vulnerability due to inadequate CSP (Content Security Policy) configuration in GROWI versions v4.2.2 and earlier allows remote authenticated attackers to inject an arbitrary script via a specially crafted content.


Reflected cross-site scripting vulnerability due to insufficient verification of URL query parameters in GROWI (v4.2 Series) versions from v4.2.0 to v4.2.7 allows remote attackers to inject an arbitrary script via unspecified vectors.


A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.


A cross-site scripting (XSS) vulnerability in the Create Post function of Anchor CMS v0.12.7 allows attackers to execute arbitrary web scripts or HTML.


Multiple cross-site scripting (XSS) vulnerabilities in the Add User module of Issabel PBX 20200102 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the username and password fields.


A cross-site scripting (XSS) vulnerability in H.H.G Multistore v5.1.0 and below allows attackers to execute arbitrary web scripts or HTML via a crafted payload inserted into the State parameter under the Address Book module.


Unauthenticated cross-site scripting (XSS) in Netgear WAC120 AC Access Point may lead to mulitple attacks like session hijacking even clipboard hijacking.


A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.


Stored Cross-Site Scripting (XSS) vulnerability in Andrea Pernici News Sitemap for Google plugin <= 1.0.16 on WordPress attackers must have contributor or higher user role.


Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with contributor or higher user rights.


Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable parameter: &post.


Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Comment Engine Pro plugin (versions <= 1.0) could be exploited by users with Editor or higher role.


Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG image upload.


A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6.


A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Scheduled Cron Jobs feature.


A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 via the Upload and Download feature.


A Cross-site scripting (XSS) vulnerability in the DocumentAction component of U.S. National Security Agency (NSA) Emissary 5.9.0 allows remote attackers to inject arbitrary web script or HTML via the uuid parameter.


A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the File Manager feature.


A Cross-Site Scripting (XSS) vulnerability exists in Webmin 1.973 through the Add Users feature.


A cross-site scripting (XSS) vulnerability in PaquitoSoftware Notimoo v1.2 allows attackers to execute arbitrary web scripts or HTML via a crafted title or message in a notification.


A Cross-site scripting (XSS) vulnerability was discovered in OPNsense before 21.7.4 via the LDAP attribute return in the authentication tester.


Stored cross-site scripting (XSS) in admin/usermanager.php over IPPlan v4.92b allows remote attackers to inject arbitrary web script or HTML via the userid parameter.


Stored Cross-Site Scripting vulnerabilities in Testimonial Rotator 3.0.3 allow low privileged users (Contributor) to inject arbitrary JavaScript code or HTML without approval. This could lead to privilege escalation


A cross-site scripting (XSS) vulnerability in the HTML Data Processor in CKEditor 4 4.14.0 through 4.16.x before 4.16.1 allows remote attackers to inject executable JavaScript code through a crafted comment because --!> is mishandled.


A Cross-site scripting (XSS) vulnerability in the \View in Browser\ feature in Elements-IT HTTP Commander 5.3.3 allows remote authenticated users to inject arbitrary web script or HTML via a crafted SVG image.


A cross-site scripting (XSS) vulnerability exists in the \contact us\ plugin for Subrion CMS <= 4.2.1 version via \List of subjects\.


Stored Cross-Site Scripting vulnerability in McAfee ePolicy Orchestrator (ePO) prior to 5.10 Update 11 allows ePO administrators to inject arbitrary web script or HTML via multiple parameters where the administrator's entries were not correctly sanitized.


A Cross-Site Scripting (XSS) vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent.


A cross-site scripting (XSS) vulnerability exists in Znote 0.5.2. An attacker can insert payloads and the code execution will happen immediately on markdown view mode.


A cross-site scripting (XSS) issue in the login panel in Redwood Report2Web 4.3.4.5 and 4.5.3 allows remote attackers to inject JavaScript via the signIn.do urll parameter.


A cross-site scripting (XSS) vulnerability in Power Admin PA Server Monitor 8.2.1.1 allows remote attackers to inject arbitrary web script or HTML via Console.exe.


A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the \valueID\ parameter.


A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the \page\ parameter.


A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the \author\ parameter.


A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the \redirect\ parameter.


A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allow remote attacker to inject javascript via URI in /index.php.


A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the \refID\ parameter.


A cross-site scripting (XSS) issue in FUDForum 3.1.0 allows remote attackers to inject JavaScript via index.php in the \srch\ parameter.


A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the \query\ parameter.


A cross-site scripting (XSS) vulnerability in DynPG version 4.9.2 allows remote attackers to inject JavaScript via the \limit\ parameter.


A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via modification of the authorisationUrl in some integration configurations.


A cross-site scripting (XSS) vulnerability in Image Tile in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via an SVG file.


A cross-site scripting (XSS) vulnerability in the \Zip content\ feature in Element-IT HTTP Commander 3.1.9 allows remote authenticated users to inject arbitrary web script or HTML via filenames.


A cross-site scripting (XSS) vulnerability in integration configuration in SquaredUp for SCOM 5.2.1.6654 allows remote attackers to inject arbitrary web script or HTML via dashboard actions.


Multiple cross-site scripting (XSS) vulnerabilities in index.php in OpenRat CMS 0.8-beta1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) subaction and (2) action parameters.


Multiple cross-site scripting (XSS) vulnerabilities in login.php in AdMan 1.0.20051202 FF 3 patch and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user and (2) pwd parameters.


Multiple cross-site scripting (XSS) vulnerabilities in the AXIS 207W camera allow remote attackers to inject arbitrary web script or HTML via the camNo parameter to incl/image_incl.shtml and other unspecified vectors.


Multiple cross-site scripting (XSS) vulnerabilities in Olate Download (od) 3.4.2 allow remote attackers to inject arbitrary web script or HTML via (1) the PHP_SELF variable in modules/core/uim.php and (2) url tags in a comment in modules/core/fldm.php.


Multiple cross-site scripting (XSS) vulnerabilities in SimpNews 2.41.03 allow remote attackers to inject arbitrary web script or HTML via the (1) l_username parameter to admin/layout2b.php and the (2) backurl parameter to comment.php.


Multiple cross-site scripting (XSS) vulnerabilities in urchin.cgi in Urchin 5.6.00r2 allow remote attackers to inject arbitrary web script or HTML via the (1) dtc (2) vid (3) n (4) dt (5) ed and (6) bd parameters.


Multiple cross-site scripting (XSS) vulnerabilities in AlstraSoft AskMe Pro allow remote attackers to inject arbitrary web script or HTML via (1) the cat_id parameter to search.php or the (2) typ parameter to register.php.


Multiple cross-site scripting (XSS) vulnerabilities in login.php in Brain Book Software Secure 1.0.20070629 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) user and (2) pwd parameters.


Multiple cross-site scripting (XSS) vulnerabilities in TechExcel CustomerWise (formerly TechExcel CRM) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.