In Mozilla Bleach before 3.12 a mutation XSS in bleach.clean when RCDATA and either svg or math tags are whitelisted and the keyword argument strip=False.


PHP-Fusion 9.03 allows XSS via the error_log file.


flatCore

before

allows

XSS

by

an

admin

via

the

acp/acp.php?tn=pages&sub=edit&editpage=1

or

parameter

or

the

or

parameter.


PHP-Fusion 9.03 allows XSS on the preview page.


WSO2 API Manager 3.1.0 and earlier has reflected XSS on the \publisher\ component's admin interface. More precisely it is possible to inject an XSS payload into the owner POST parameter which does not filter user inputs. By putting an XSS payload in place of a valid Owner Name a modal box appears that writes an error message concatenated to the injected payload (without any form of data encoding). This can also be exploited via CSRF.


Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. The vulnerability affects versions 6.5.0.4 6.0.0.6.


TinyMCE before 4.9.7 and 5.x before 5.1.4 allows XSS in the core parser the paste plugin and the visualchars plugin by using the clipboard or APIs to insert content into the editor.


A post-authenticated stored XSS was found in MultiUx v.3.1.12.0 via the /multiux/SaveMailbox LastName field.


The \origin\ parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit. This issue affects Apache Airflow versions prior to 1.10.13. This is same as CVE-2020-13944 but the implemented fix in Airflow 1.10.13 did not fix the issue completely.


SugarCRM

before

allows

XSS.


USVN (aka User-friendly SVN) before 1.0.9 allows XSS via SVN logs.


Mibew Messenger before 3.2.7 allows XSS via a crafted user name.


WSO2 Management Console through 5.10 allows XSS via the carbon/admin/login.jsp msgId parameter.


Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An authenticated attacker can store an XSS payload in the PSCU_FILE_INIT field of a Save Configuration XML document. The payload is triggered in the HTTP error response pages.


An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitrary HTML into the page by saving it into a text Custom Field leading to possible code execution in the browser of any user subsequently viewing the issue (if CSP settings allow it).


Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-16945.


The search functionality of the Greenmart theme 2.4.2 for WordPress is vulnerable to XSS.


LimeSurvey

allows

reflected

XSS

because

lacks

code

to

validate

parameters.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-16946.


Extreme Analytics in Extreme Management Center before 8.5.0.169 allows unauthenticated reflected XSS via a parameter in a GET request aka CFD-4887.


ownCloud (Core) before 10.5 allows XSS in login page 'forgot password.'


The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.


osTicket before 1.14.3 allows XSS because include/staff/banrule.inc.php has an unvalidated echo $info'notes' call.


Tiki before 21.2 allows XSS because \\s\\/\\\' is not properly considered in lib/core/TikiFilter/PreventXss.php.


This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server aka 'Microsoft SharePoint Reflective XSS Vulnerability'.


A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.


SMC D3G0804W 3.5.2.5-LAT_GA devices allow XSS via the SSID field on the WiFi Network Configuration page (after a successful login to the admin account).


Adive Framework 2.0.8 has admin/user/add userName XSS.


This affects the package markdown-it-highlightjs before 3.3.1. It is possible insert malicious JavaScript as a value of lang in the markdown-it-highlightjs Inline code highlighting feature. const markdownItHighlightjs = require(\markdown-it-highlightjs\); const md = require('markdown-it'); const reuslt_xss = md() .use(markdownItHighlightjs { inline: true }) .render('console.log(42){.\>js}'); console.log(reuslt_xss);


The LearnDash LMS plugin before 3.1.2 for WordPress allows XSS via the ld-profile search field.


The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php total_questions parameter.


GitLab EE 11.0 and later through 12.7.2 allows XSS.


Codologic Codoforum through 4.8.4 allows stored XSS in the login area. This is relevant in conjunction with CVE-2020-5842 because session cookies lack the HttpOnly flag. The impact is account takeover.


A Cross Site Scripting (XSS) Vulnerability on the Unified Portal Client (web client) used in Avaya Equinox Conferencing can allow an authenticated user to perform XSS attacks. The affected versions of Equinox Conferencing includes all 9.x versions before 9.1.10.


JetBrains YouTrack 2019.2 before 2019.2.59309 was vulnerable to XSS via an issue description.


Codologic Codoforum through 4.8.4 allows a DOM-based XSS. While creating a new topic as a normal user it is possible to add a poll that is automatically loaded in the DOM once the thread/topic is opened. Because session cookies lack the HttpOnly flag it is possible to steal authentication cookies and take over accounts.


Sonoff TH 10 and 16 devices with firmware 6.6.0.21 allows XSS via the Friendly Name 1 field (after a successful login with the Web Admin Password).


This

affects

the

package

phpoffice/phpspreadsheet

from

The

library

is

vulnerable

to

XSS

when

creating

an

html

output

from

an

excel

file

by

adding

a

comment

on

any

cell.

The

root

cause

of

this

issue

is

within

the

HTML

writer

where

user

comments

are

concatenated

as

part

of

link

and

this

is

returned

as

HTML.

A

fix

for

this

issue

is

available

on

commit

branch.


Adive Framework 2.0.8 has admin/user/add userUsername XSS.


An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site.


UHP UHP-100 3.4.1.15 3.4.2.4 and 3.4.3 devices allow XSS via cw2?td= (Site Name field of the Site Setup section).


The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via Display_FAQ to Shortcodes/DisplayFAQs.php.


JetBrains TeamCity before 2019.2 was vulnerable to a stored XSS attack by a user with the developer role.


This affects all versions of package osm-static-maps. User input given to the package is passed directly to a template without escaping ({{{ ... }}}). As such it is possible for an attacker to inject arbitrary HTML/JS code and depending on the context. It will be outputted as an HTML on the page which gives opportunity for XSS or rendered on the server (puppeteer) which also gives opportunity for SSRF and Local File Read.


The Calculated Fields Form plugin through 1.0.353 for WordPress suffers from multiple Stored XSS vulnerabilities present in the input forms. These can be exploited by an authenticated user.


This affects the package hellojs before 1.18.6. The code get the param oauth_redirect from url and pass it to location.assign without any check and sanitisation. So we can simply pass some XSS payloads into the url param oauth_redirect such as javascript:alert(1).


ASUS WRT-AC66U 3 RT 3.0.0.4.372_67 devices allow XSS via the Client Name field to the Parental Control feature.


Ruckus ZoneFlex R310 104.0.0.0.1347 devices allow Stored XSS via the SSID field on the Configuration > Radio 2.4G > Wireless X screen (after a successful login to the super account).


UHP

and

devices

allow

XSS

via

(profile

title).


htdocs/user/passwordforgotten.php in Dolibarr 10.0.6 allows XSS via the Referer HTTP header.


In LifeRay Portal CE 7.1.0 through 7.2.1 GA2 the First Name Middle Name and Last Name fields for user accounts in MyAccountPortlet are all vulnerable to a persistent XSS issue. Any user can modify these fields with a particular XSS payload and it will be stored in the database. The payload will then be rendered when a user utilizes the search feature to search for other users (i.e. if a user with modified fields occurs in the search results). This issue was fixed in Liferay Portal CE version 7.3.0 GA1.


Cacti 1.2.8 has stored XSS in data_sources.php color_templates_item.php graphs.php graph_items.php lib/api_automation.php user_admin.php and user_group_admin.php as demonstrated by the description parameter in data_sources.php (a raw string from the database that is displayed by $header to trigger the XSS).


LinuxKI v6.0-1 and earlier is vulnerable to an XSS which is resolved in release 6.0-2.


The conversation-watson plugin before 0.8.21 for WordPress has a DOM-based XSS vulnerability that is executed when a chat message containing JavaScript is sent.


GitLab through 12.7.2 allows XSS.


An issue was discovered on Eaton 5P 850 devices. The Ubicacion SAI field allows XSS attacks by an administrator.


The file upload feature in Atlassian Jira Server and Data Center in affected versions allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability. The affected versions are before version 8.5.4 from version 8.6.0 before 8.6.2 and from version 8.7.0 before 8.7.1.


An issue was discovered in MK-AUTH 19.01. XSS vulnerabilities in admin and client scripts allow an attacker to execute arbitrary JavaScript code.


KumbiaPHP through 1.1.1 in Development mode allows XSS via the public/pages/kumbia PATH_INFO.


Navigate CMS 2.9 allows XSS via the Alias or Real URL field of the \Web Sites > Create > Aliases > Add\ screen.


Solarwinds Orion (with Web Console WPM 2019.4.1 and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a name of an alert definition.


Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name Position Web Address Other Location Reviewed Product Reviewed Item Reviewed or Rating parameter.


HCL Digital Experience 8.5 9.0 9.5 is susceptible to cross site scripting (XSS). One subcomponent is vulnerable to reflected XSS. In reflected XSS an attacker must induce a victim to click on a crafted URL from some delivery mechanism (email other web site).


Solarwinds Orion (with Web Console WPM 2019.4.1 and Orion Platform HF4 or NPM HF2 2019.4) allows XSS via a Responsible Team.


CMS

Made

Simple

allows

XSS

via

a

Search

Term

to

the

admin/moduleinterface.php?mact=ModuleManager

page.


NeDi 1.9C is vulnerable to XSS because of an incorrect implementation of sanitize() in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values but can be easily bypassed as demonstrated by an onerror attribute of an IMG element as a Devices-Config.php?sta= value.


The /servicedesk/customer/portals resource in Jira Service Desk Server and Data Center before version 4.10.0 allows remote attackers with project administrator privileges to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by uploading a html file.


The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function (via an arbitrary parameter).


An issue was discovered in Bloomreach Experience Manager (brXM) 4.1.0 through 14.2.2. It allows XSS in the login page via the loginmessage parameter the text editor via the src attribute of HTML elements the translations menu via the foldername parameter the author page via the link URL or the upload image functionality via an SVG document containing JavaScript.


WebFOCUS Business Intelligence 8.0 (SP6) was prone to XSS via arbitrary URL parameters.


scp/categories.php in osTicket 1.14.2 allows XSS via a Knowledgebase Category Name or Category Description. The attacker must be an Agent.


Cacti before 1.2.18 allows remote attackers to trigger XSS via template import for the midwinter theme.


An issue was discovered in Navigate CMS 2.9 r1433. There is a stored XSS vulnerability that is executed on the page to view users and on the page to edit users. This is present in both the User field and the E-Mail field. On the Edit user page the XSS is only triggered via the E-Mail field; however on the View user page the XSS is triggered via either the User field or the E-Mail field.


The loginForm within the general/login.php webpage in webTareas 2.0p8 suffers from a Reflected Cross Site Scripting (XSS) vulnerability via the query string.


The WYSIWYG editor resource in Jira Server and Data Center before version 8.8.2 allows remote attackers to inject arbitrary HTML or JavaScript names via an Cross Site Scripting (XSS) vulnerability by pasting javascript code into the editor field.


An issue was discovered in Navigate CMS 2.8 and 2.9 r1433. The query parameter fid on the resource navigate.php does not perform sufficient data validation and/or encoding making it vulnerable to reflected XSS.


The Laborator Xenon theme 1.3 for WordPress allows Reflected XSS via the data/typeahead-generate.php q (aka name) parameter.


The web interface of the 1734-AENTR communication module is vulnerable to stored XSS. A remote unauthenticated attacker could store a malicious script within the web interface that when executed could modify some string values on the homepage of the web interface.


Ozeki NG SMS Gateway through 4.17.6 has multiple authenticated stored and/or reflected XSS vulnerabilities via the (1) Receiver or Recipient field in the Mailbox feature (2) OZFORM_GROUPNAME field in the Group configuration of addresses (3) listname field in the Defining address lists configuration or (4) any GET Parameter in the /default URL of the application.


XSS exists in PRTG Network Monitor 20.1.56.1574 via crafted map properties. An attacker with Read/Write privileges can create a map and then use the Map Designer Properties screen to insert JavaScript code. This can be exploited against any user with View Maps or Edit Maps access.


Multiple XSS vulnerabilities in the Final Tiles Gallery plugin before 3.4.19 for WordPress allow remote attackers to inject arbitrary web script or HTML via the Title (aka imageTitle) or Caption (aka description) field of an image to wp-admin/admin-ajax.php.


PRODUCT

NOT

SUPPORTED

WHEN

ASSIGNED

A

Cross

Site

Scripting

(XSS)

vulnerability

was

found

in

Codiad

and

later.

The

vulnerability

occurs

because

of

improper

sanitization

of

the

folder's

name

$path

variable

in

NOTE:

the

vendor

states

\Codiad

is

no

longer

under

active

maintenance

by

core

contributors.\


An issue was discovered in Agentejo Cockpit 0.10.2. Insufficient sanitization of the to parameter in the /auth/login route allows for injection of arbitrary JavaScript code into a web page's content creating a Reflected XSS attack vector.


In PrestaShop module ps_linklist versions before 3.1.0 there is a stored XSS when using custom URLs. The problem is fixed in version 3.1.0


Dell EMC ECS versions prior to 3.4.0.1 contain an XSS vulnerability. A remote authenticated malicious user could exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When victim users access the data store through their browsers the malicious code gets executed by the web browser in the context of the vulnerable web application.


Stored XSS in Tenable.Sc before 5.14.0 could allow an authenticated remote attacker to craft a request to execute arbitrary script code in a user's browser session. Updated input validation techniques have been implemented to correct this issue.


PrestaShop module ps_facetedsearch versions before 3.5.0 has a reflected XSS with `url_name` parameter. The problem is fixed in 3.5.0


In Django User Sessions (django-user-sessions) before 1.7.1 the views provided allow users to terminate specific sessions. The session key is used to identify sessions and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability the session key could be extracted by the attacker and a session takeover could happen.


The OpenID Connect reference implementation for MITREid Connect through 1.3.3 allows XSS due to userInfoJson being included in the page unsanitized. This is related to header.tag. The issue can be exploited to execute arbitrary JavaScript.


In ActionView before versions 6.0.2.2 and 5.2.4.2 there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and 5.2.4.2.


On versions 15.1.0-15.1.0.1 15.0.0-15.0.1.2 and 14.1.0-14.1.2.3 in BIG-IP APM portal access a specially crafted HTTP request can lead to reflected XSS after the BIG-IP APM system rewrites the HTTP response from the untrusted backend server and sends it to the client.


In NGINX Controller 3.3.0-3.4.0 undisclosed API endpoints may allow for a reflected Cross Site Scripting (XSS) attack. If the victim user is logged in as admin this could result in a complete compromise of the system.


In the ps_link module for PrestaShop before version 3.1.0 there is a stored XSS when you create or edit a link list block with the title field. The problem is fixed in 3.1.0


Reflected XSS through an IMG element in Cerberus FTP Server prior to versions 11.0.1 and 10.0.17 allows a remote attacker to execute arbitrary JavaScript or HTML via a crafted public folder URL. This occurs because of the folder_up.png IMG element not properly sanitizing user-inserted directory paths. The path modification must be done on a publicly shared folder for a remote attacker to insert arbitrary JavaScript or HTML. The vulnerability impacts anyone who clicks the malicious link crafted by the attacker.


ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is mitigated by the need for an attacker to have commit privileges to a CVS repository exposed by an otherwise trusted ViewVC instance that also has the `show_subdir_lastmod` feature enabled. The attack vector involves files with unsafe names (names that when embedded into an HTML stream would cause the browser to run unwanted code) which themselves can be challenging to create. This vulnerability is patched in versions 1.2.1 and 1.1.28.


On BIG-IP 14.1.0-14.1.2.6 undisclosed endpoints in iControl REST allow for a reflected XSS attack which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.


On BIG-IP versions 16.0.0-16.0.0.1 15.1.0-15.1.0.5 14.1.0-14.1.2.7 13.1.0-13.1.3.4 12.1.0-12.1.5.2 and 11.6.1-11.6.5.2 undisclosed endpoints in iControl REST allow for a reflected XSS attack which could lead to a complete compromise of the BIG-IP system if the victim user is granted the admin role.


In Appspace On-Prem through 7.1.3 an adversary can steal a session token via XSS.


In PrestaShop before version 1.7.6.5 there is a reflected XSS while running the security compromised page. It allows anyone to execute arbitrary action. The problem is patched in the 1.7.6.5.


In PrestaShop between versions 1.7.6.0 and 1.7.6.5 there is an open redirection when using back parameter. The impacts can be many and vary from the theft of information and credentials to the redirection to malicious websites containing attacker-controlled content which in some cases even cause XSS attacks. So even though an open redirection might sound harmless at first the impacts of it can be severe should it be exploitable. The problem is fixed in 1.7.6.5


matestack-ui-core (RubyGem) before 0.7.4 is vulnerable to XSS/Script injection. This vulnerability is patched in version 0.7.4.


PHPGurukul Dairy Farm Shop Management System 1.0 is vulnerable to XSS as demonstrated by the category and CategoryCode parameters in add-category.php the CompanyName parameter in add-company.php and the ProductName parameter in add-product.php.


A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user can inject arbitrary JavaScript code into iframes when editing content using the TinyMCE rich-text editor as TinyMCE is configured to allow iframes by default in Umbraco CMS.


Codoforum 4.8.3 allows XSS in the user registration page: via the username field to the index.php?u=/user/register URI. The payload is for example executed on the admin/index.php?page=users/manage page.


In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466 a user with the ability to use the import functionality of the `ImportExportController` behavior can be socially engineered by an attacker to upload a maliciously crafted CSV file which could result in a reflected XSS attack on the user in question Issue has been patched in Build 466 (v1.0.466).


In OpenMRS 2.9 and prior the UI Framework Error Page reflects arbitrary user-supplied input back to the browser which can result in XSS. Any page that is able to trigger a UI Framework Error is susceptible to this issue.


Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen.


DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2).


Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user i.e. on the Manage Users screen.


In RedpwnCTF before version 2.3 there is a session fixation vulnerability in exploitable through the `#token=$ssid` hash when making a request to the `/verify` endpoint. An attacker team could potentially steal flags by for example exploiting a stored XSS payload in a CTF challenge so that victim teams who solve the challenge are unknowingly (and against their will) signed into the attacker team's account. Then the attacker can gain points / value off the backs of the victims. This is patched in version 2.3.


PrestaShop module ps_facetedsearch versions before 2.1.0 has a reflected XSS with social networks fields The problem is fixed in 2.1.0


The review coverage resource in Atlassian Fisheye and Crucible before version 4.8.2 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the committerFilter parameter.


In Bolt CMS before version 3.7.1 the filename of uploaded files was vulnerable to stored XSS. It is not possible to inject javascript code in the file name when creating/uploading the file. But once created/uploaded it can be renamed to inject the payload in it. Additionally the measures to prevent renaming the file to disallowed filename extensions could be circumvented. This is fixed in Bolt 3.7.1.


In affected versions of WordPress when uploading themes the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme and is low severity self-XSS. This has been patched in version 5.4.2 along with all the previously affected versions via a minor release (5.3.4 5.2.7 5.1.6 5.0.10 4.9.15 4.8.14 4.7.18 4.6.19 4.5.22 4.4.23 4.3.24 4.2.28 4.1.31 4.0.31 3.9.32 3.8.34 3.7.34).


In October from version 1.0.319 and before version 1.0.467 pasting content copied from malicious websites into the Froala richeditor could result in a successful self-XSS attack. This has been fixed in 1.0.467.


The review resource in Atlassian Fisheye and Crucible before version 4.8.1 allows remote attackers to inject arbitrary HTML or Javascript via a cross site scripting (XSS) vulnerability through the review objectives.


GraphQL Playground (graphql-playground-html NPM package) before version 1.6.22 have a severe XSS Reflection attack vulnerability. All unsanitized user input passed into renderPlaygroundPage() method could trigger this vulnerability. This has been patched in graphql-playground-html version 1.6.22. Note that some of the associated dependent middleware packages are also affected including but not limited to graphql-playground-middleware-express before version 1.7.16 graphql-playground-middleware-koa before version 1.6.15 graphql-playground-middleware-lambda before version 1.7.17 and graphql-playground-middleware-hapi before 1.6.13.


Affected versions are: Before 8.5.5 and from 8.6.0 before 8.8.1 of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the XML export view.


** DISPUTED ** jcore/portal/ajaxPortal.jsp in Jalios JCMS 10.0.2 build-20200224104759 allows XSS via the types parameter. Note: It is asserted that this vulnerability is not present in the standard installation of Jalios JCMS.


An issue was discovered in Gradle Enterprise 2017.3 - 2020.2.4 and Gradle Enterprise Build Cache Node 1.0 - 9.2. Unrestricted HTTP header reflection in Gradle Enterprise allows remote attackers to obtain authentication cookies if they are able to discover a separate XSS vulnerability. This potentially allows an attacker to impersonate another user. Gradle Enterprise affected application request paths:/info/headers /cache-info/headers /admin-info/headers /distribution-broker-info/headers. Gradle Enterprise Build Cache Node affected application request paths:/cache-node-info/headers.


The FileExplorer component in GleamTech FileUltimate 6.1.5.0 allows XSS via an SVG document.


A vulnerability has been identified in SICAM WEB firmware for SICAM A8000 RTUs (All versions < V05.30). The login screen does not sufficiently sanitize input which enables an attacker to generate specially crafted log messages. If an unsuspecting victim views the log messages via the web browser these log messages might be interpreted and executed as code by the web application. This Cross-Site-Scripting (XSS) vulnerability might compromize the confidentiality integrity and availability of the web application.


In platform before version 9.4.4 inline attributes are not properly escaped. If the data that came from users was not escaped then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.


Nozomi Guardian before 19.0.4 allows attackers to achieve stored XSS (in the web front end) by leveraging the ability to create a custom field with a crafted field name.


CakePHP before 4.0.6 mishandles CSRF token generation. This might be remotely exploitable in conjunction with XSS.


The SeedProd coming-soon plugin before 5.1.1 for WordPress allows XSS.


An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.


An issue was discovered in the Elementor plugin through 2.9.13 for WordPress. An authenticated attacker can achieve stored XSS via the Name Your Template field.


An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field a product field to the p/ URI or the Products Search box.


An issue was discovered in Quali CloudShell 9.3. An XSS vulnerability in the login page allows an attacker to craft a URL with a constructor.constructor substring in the username field that executes a payload when the user visits the /Account/Login page.


Victor CMS through 2019-02-28 allows XSS via the register.php user_firstname or user_lastname field.


TP-Link USB Network Server TL-PS310U devices before 2.079.000.t0210 allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.


An issue was discovered in the Gantt-Chart module before 5.5.4 for Jira. Due to a missing privilege check it is possible to read and write to the module configuration of other users. This can also be used to deliver an XSS payload to other users' dashboards. To exploit this vulnerability an attacker has to be authenticated.


The mm_forum extension through 1.9.5 for TYPO3 allows XSS that can be exploited via CSRF.


In TimelineJS before version 3.7.0 some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most TimelineJS users configure their timeline with a Google Sheets document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker if the access of a trusted user is compromised or if they grant public write access to the document. Some TimelineJS users configure their timeline with a JSON document. Those users are exposed to this vulnerability if they grant write access to the document to a malicious inside attacker if the access of a trusted user is compromised or if write access to the system hosting that document is otherwise compromised. Version 3.7.0 of TimelineJS addresses this in two ways. For content which is intended to support limited HTML markup for styling and linking that content is \sanitized\ before being added to the DOM. For content intended for simple text display all markup is stripped. Very few users of TimelineJS actually install the TimelineJS code on their server. Most users publish a timeline using a URL hosted on systems we control. The fix for this issue is published to our system such that **those users will automatically begin using the new code**. The only exception would be users who have deliberately edited the embed URL to \pin\ their timeline to an earlier version of the code. Some users of TimelineJS use it as a part of a wordpress plugin (knight-lab-timelinejs). Version 3.7.0.0 of that plugin and newer integrate the updated code. Users are encouraged to update the plugin rather than manually update the embedded version of TimelineJS.


baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) via arbitrary script execution. Admin access is required to exploit this vulnerability. The affected components are: content_fields.php content_info.php content_options.php content_related.php index_list_tree.php jquery.bcTree.js. The issue is fixed in version 4.3.7.


An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_random_image.


An issue was discovered in Artica Proxy CE before 4.28.030.418. Reflected XSS exists via these search fields: real time request System Events Proxy Events Proxy Objects and Firewall objects.


SolarWinds Serv-U File Server before 15.2.1 allows XSS as demonstrated by Tenable Scan aka Case Number 00484194.


The ke_search (aka Faceted Search) extension through 2.8.2 and 3.x through 3.1.3 for TYPO3 allows XSS.


Zabbix

before

before

through

before

and

before

allows

stored

XSS

in

the

URL

Widget.


An issue was discovered in Gradle Enterprise 2020.2 - 2020.2.4. An XSS issue exists via the request URL.


Immuta v2.8.2 is affected by stored XSS that allows a low-privileged user to escalate privileges to administrative permissions. Additionally unauthenticated attackers can phish unauthenticated Immuta users to steal credentials or force actions on authenticated users through reflected DOM-based XSS.


An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag.


An issue was discovered in the bestsoftinc Hotel Booking System Pro plugin through 1.1 for WordPress. Persistent XSS can occur via any of the registration fields.


The Nexos theme through 1.7 for WordPress allows top-map/?search_location= reflected XSS.


An issue was discovered in the Gantt-Chart module before 5.5.5 for Jira. Due to missing validation of user input it is vulnerable to a persistent XSS attack. An attacker can embed the attack vectors in the dashboard of other users. To exploit this vulnerability an attacker has to be authenticated.


DIGITUS DA-70254 4-Port Gigabit Network Hub 2.073.000.E0008 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.


In

Wiki.js

before

version

an

XSS

payload

can

be

injected

in

a

page

title

and

executed

via

the

search

results.

While

the

title

is

properly

escaped

in

both

the

navigation

links

and

the

actual

page

title

it

is

not

the

case

in

the

search

results.

Commit

fixes

this

vulnerability

(version

by

properly

escaping

the

text

content

displayed

in

the

search

results.


An issue was discovered in Artica Proxy before 4.30.000000. Stored XSS exists via the Server Domain Name Your Email Address Group Name MYSQL Server Database MYSQL Username Group Name and Task Description fields.


Lindy 42633 4-Port USB 2.0 Gigabit Network Server 2.078.000 devices allow an attacker on the same network to conduct persistent XSS attacks by leveraging administrative privileges to set a crafted server name.


JetBrains TeamCity before 2019.2.3 is vulnerable to stored XSS in the administration UI.


In MyBB before version 1.8.24 the custom MyCode (BBCode) for the visual editor doesn't escape input properly when rendering HTML resulting in a DOM-based XSS vulnerability. The weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter or on reply pages where a previously saved malicious message is quoted. After upgrading MyBB to 1.8.24 make sure to update the version attribute in the `codebuttons` template for non-default themes to serve the latest version of the patched `jscripts/bbcodes_sceditor.js` file.


PHP-Fusion 9.03.60 allows XSS via the administration/site_links.php Add Site Link field.


eGain Chat 15.5.5 allows XSS via the Name (aka full_name) field.


An issue was discovered in Roundcube Webmail before 1.2.11 1.3.x before 1.3.14 and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message as demonstrated by a JavaScript payload in the xmlns (aka XML namespace) attribute of a HEAD element when an SVG element exists.


JetBrains TeamCity before 2019.2.3 is vulnerable to reflected XSS in the administration UI.


An issue was discovered in server.js in TileServer GL through 3.0.0. The content of the key GET parameter is reflected unsanitized in an HTTP response for the application's main page causing reflected XSS.


RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php.


content/content.blueprintsevents.php in Symphony CMS 3.0.0 allows XSS via fields'name' to appendSubheading.


SOPlanning 1.46.01 allows persistent XSS via the Project Name Statutes Comment Places Comment or Resources Comment field.


An issue was discovered in the bestsoftinc Car Rental System plugin through 1.3 for WordPress. Persistent XSS can occur via any of the registration fields.


Graph Explorer in Nagios XI before 5.7.2 allows XSS via the link url option.


An issue was discovered on ASUS RT-AC1900P routers before 3.0.0.4.385_20253. They allow XSS via spoofed Release Notes on the Firmware Upgrade page.


The

extension

through

and

through

for

allows

XSS.


In nodebb-plugin-blog-comments before version 0.7.0 a logged in user is vulnerable to an XSS attack which could allow a third party to post on their behalf on the forum. This is due to lack of CSRF validation.


An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37_wpl_import_template admin-post action (which will execute in an administrator's browser if the template is used to create a page).


In BookStack greater than or equal to 0.18.0 and less than 0.29.2 there is an XSS vulnerability in comment creation. A user with permission to create comments could POST HTML directly to the system to be saved in a comment which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. This has been fixed in 0.29.2.


Abe (aka bitcoin-abe) through 0.7.2 and 0.8pre allows XSS in __call__ in abe.py because the PATH_INFO environment variable is mishandled during a PageNotFound exception.


In Wiki.js before 2.3.81 there is a stored XSS in the Markdown editor. An editor with write access to a page using the Markdown editor could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the Markdown editor the XSS payload will be executed as part of the preview panel. The rendered result does not contain the XSS payload as it is stripped by the HTML Sanitization security module. This vulnerability only impacts editors loading the malicious page in the Markdown editor. This has been patched in 2.3.81.


cgi-bin/go in CyberSolutions CyberMail 5 or later allows XSS via the ACTION parameter.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

and

before


LibreHealth EMR v2.0.0 is vulnerable to XSS that results in the ability to force arbitrary actions on behalf of other users including administrators.


Grafana through 6.7.1 allows stored XSS due to insufficient input protection in the originalUrl field which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot.


An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. Two Cross Side Scripting (XSS) vulnerabilities have been found in the Public Web and the Certificate/CRL download servlets.


Microstrategy Web 10.4 is vulnerable to Stored XSS in the HTML Container and Insert Text features in the window allowing for the creation of a new dashboard. In order to exploit this vulnerability a user needs to get access to a shared dashboard or have the ability to create a dashboard on the application.


Certain

NETGEAR

devices

are

affected

by

Stored

XSS.

This

affects

before

before

before

before

before

before

before

and

before


An issue was discovered in Castle Rock SNMPc Online 12.10.10 before 2020-01-28. There are multiple persistent (stored) and reflected XSS vulnerabilities.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


eten PSG-6528VM 1.1 devices allow XSS via System Contact or System Location.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows logged-in users with minimal permissions to create or replace existing pages with a malicious page containing arbitrary JavaScript via the wp_ajax_core37_lp_save_page (aka core37_lp_save_page) AJAX action.


JetBrains Space through 2020-04-22 allows stored XSS in Chats.


The Media Library Assistant plugin before 2.82 for Wordpress suffers from multiple XSS vulnerabilities in all Settings/Media Library Assistant tabs which allow remote authenticated users to execute arbitrary JavaScript.


In GLPI before version 9.4.6 there are multiple related stored XSS vulnerabilities. The package is vulnerable to Stored XSS in the comments of items in the Knowledge base. Adding a comment with content \<script>alert(1)</script>\ reproduces the attack. This can be exploited by a user with administrator privileges in the User-Agent field. It can also be exploited by an outside party through the following steps: 1. Create a user with the surname `\ onmouseover=\alert(document.cookie)` and an empty first name. 2. With this user create a ticket 3. As an administrator (or other privileged user) open the created ticket 4. On the \last update\ field put your mouse on the name of the user 5. The XSS fires This is fixed in version 9.4.6.


A GET-based XSS reflected vulnerability in Plesk Obsidian 18.0.17 allows remote unauthenticated users to inject arbitrary JavaScript HTML or CSS via a GET parameter.


svg2png 4.1.1 allows XSS with resultant SSRF via JavaScript inside an SVG document.


An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The Admin Web Interface has Multiple Stored and Reflected XSS. GetInheritedProperties is Reflected via the groups parameter. GetUserInfo is Reflected via POST data. SetUserInfo is Stored via the general parameter.


Firmware

Analysis

and

Comparison

Tool

(FACT)

has

Stored

XSS

when

updating

analysis

details

via

a

localhost

web

request

as

demonstrated

by

mishandling

of

the

tags

and

version

fields

in

helperFunctions/mongo_task_conversion.py.


Certain

NETGEAR

devices

are

affected

by

Stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


pfSense before 2.4.5 has stored XSS in system_usermanager_addprivs.php in the WebGUI via the descr parameter (aka full name) of a user.


Open Upload through 0.4.3 allows XSS via index.php?action=u and the filename field.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

and

before


In Dolibarr 10.0.6 if USER_LOGIN_FAILED is active there is a stored XSS vulnerability on the admin tools --> audit page. This may lead to stealing of the admin account.


In Combodo iTop dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community essential professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.


NETGEAR JGS516PE devices before 2.6.0.43 are affected by reflected XSS.


Stored XSS in the IMPress for IDX Broker WordPress plugin before 2.6.2 allows authenticated attackers with minimal (subscriber-level) permissions to save arbitrary JavaScript in the plugin's settings panel via the idx_update_recaptcha_key AJAX action and a crafted idx_recaptcha_site_key parameter which would then be executed in the browser of any administrator visiting the panel. This could be used to create new administrator-level accounts.


An issue was discovered in ProVide (formerly zFTPServer) through 13.1. The User Web Interface has Multiple Stored and Reflected XSS issues. Collaborate is Reflected via the filename parameter. Collaborate is Stored via the displayname parameter. Deletemultiple is Reflected via the files parameter. Share is Reflected via the target parameter. Share is Stored via the displayname parameter. Waitedit is Reflected via the Host header.


Stored XSS in the Contact Form 7 Datepicker plugin through 2.6.0 for WordPress allows authenticated attackers with minimal permissions to save arbitrary JavaScript to the plugin's settings via the unprotected wp_ajax_cf7dp_save_settings AJAX action and the ui_theme parameter. If an administrator creates or modifies a contact form the JavaScript will be executed in their browser which can then be used to create new administrative users or perform other actions using the administrator's session.


An issue was found in Apache Airflow versions 1.10.10 and below. It was discovered that many of the admin management screens in the new/RBAC UI handled escaping incorrectly allowing authenticated users with appropriate permissions to create stored XSS attacks.


In Rukovoditel 2.5.2 there is a stored XSS vulnerability on the configuration page via the copyright text input. Thus an attacker can inject a malicious script to steal all users' valuable data. This copyright text is on every page so this attack vector can be very dangerous.


In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community essential professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.


An issue was discovered in Responsive Filemanager through 9.14.0. In the dialog.php page the session variable $_SESSION'RF'\view_type\ wasn't sanitized if it was already set. This made stored XSS possible if one opens ajax_calls.php and uses the \view\ action and places a payload in the type parameter and then returns to the dialog.php page. This occurs because ajax_calls.php was also able to set the $_SESSION'RF'\view_type\ variable but there it wasn't sanitized.


In GLPI after 0.68.1 and before 9.4.6 multiple reflexive XSS occur in Dropdown endpoints due to an invalid Content-Type. This has been fixed in version 9.4.6.


A GET-based XSS reflected vulnerability in Plesk Onyx 17.8.11 allows remote unauthenticated users to inject arbitrary JavaScript HTML or CSS via a GET parameter.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


LimeSurvey

before

has

stored

XSS

in

and

(aka

survey

groups).


python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \\w+ match succeeds. For example an attack might use elementname@ or elementname- with an onclick attribute.


In October from version 1.0.319 and before version 1.0.466 a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin this has also been fixed in 1.4.1.


The GTranslate plugin before 2.8.52 for WordPress has Reflected XSS via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option.


Certain

NETGEAR

devices

are

affected

by

stored

XSS.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923 CVE-2020-0924 CVE-2020-0925 CVE-2020-0926 CVE-2020-0927 CVE-2020-0930 CVE-2020-0933 CVE-2020-0973 CVE-2020-0978.


A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server aka 'Microsoft Exchange Server Spoofing Vulnerability'.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923 CVE-2020-0924 CVE-2020-0925 CVE-2020-0927 CVE-2020-0930 CVE-2020-0933 CVE-2020-0954 CVE-2020-0973 CVE-2020-0978.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0693.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923 CVE-2020-0924 CVE-2020-0925 CVE-2020-0926 CVE-2020-0930 CVE-2020-0933 CVE-2020-0954 CVE-2020-0973 CVE-2020-0978.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0924 CVE-2020-0925 CVE-2020-0926 CVE-2020-0927 CVE-2020-0930 CVE-2020-0933 CVE-2020-0954 CVE-2020-0973 CVE-2020-0978.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0894.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923 CVE-2020-0924 CVE-2020-0925 CVE-2020-0926 CVE-2020-0927 CVE-2020-0930 CVE-2020-0954 CVE-2020-0973 CVE-2020-0978.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923 CVE-2020-0924 CVE-2020-0925 CVE-2020-0926 CVE-2020-0927 CVE-2020-0930 CVE-2020-0933 CVE-2020-0954 CVE-2020-0973.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923 CVE-2020-0924 CVE-2020-0926 CVE-2020-0927 CVE-2020-0930 CVE-2020-0933 CVE-2020-0954 CVE-2020-0973 CVE-2020-0978.


This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server aka 'Microsoft SharePoint Reflective XSS Vulnerability'. This CVE ID is unique from CVE-2020-0891.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0694.


This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server aka 'Microsoft SharePoint Reflective XSS Vulnerability'. This CVE ID is unique from CVE-2020-0795.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923 CVE-2020-0924 CVE-2020-0925 CVE-2020-0926 CVE-2020-0927 CVE-2020-0933 CVE-2020-0954 CVE-2020-0973 CVE-2020-0978.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0893.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923 CVE-2020-0925 CVE-2020-0926 CVE-2020-0927 CVE-2020-0930 CVE-2020-0933 CVE-2020-0954 CVE-2020-0973 CVE-2020-0978.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-0923 CVE-2020-0924 CVE-2020-0925 CVE-2020-0926 CVE-2020-0927 CVE-2020-0930 CVE-2020-0933 CVE-2020-0954 CVE-2020-0978.


In Ericsson BSCS iX R18 Billing & Rating iX R18 MX is a web base module in BSCS iX that is vulnerable to stored XSS via an Alert Dashboard comment. In most test cases session hijacking was also possible by utilizing the XSS vulnerability. This potentially allows for full account takeover or exploiting admins' browsers by using the beef framework.


XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name field


The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field.


A vulnerability in web UI input field of GateManager allows authenticated attacker to enter script tags that could cause XSS. This issue affects: GateManager all versions prior to 9.3.


In

Ericsson

BSCS

iX

Billing

Rating

iX

ADMX

is

a

web

base

module

in

BSCS

iX

that

is

vulnerable

to

stored

XSS

via

the

name

or

description

field

to

a

solutionUnitServlet?SuName=UserReferenceDataSU

Access

Rights

Group.

In

most

test

cases

session

hijacking

was

also

possible

by

utilizing

the

XSS

vulnerability.

This

potentially

allows

for

full

account

takeover

or

exploiting

admins'

browsers

by

using

the

beef

framework.


In NetArt News Lister 1.0.0 the news headlines vulnerable to stored xss attacks. Attackers can inject codes in news titles.


XXL-JOB

allows

Stored

XSS

(in

Add

User)

to

bypass

the

limit

via


cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577).


jsp/upload.jsp in Coremail XT 5.0 allows XSS via an uploaded personal signature as demonstrated by a .jpg.html filename in the signImgFile parameter.


osCommerce 2.3.4.1 has XSS vulnerability via the authenticated user entering the XSS payload into the title section of newsletters.


CXUUCMS V3 allows class=\layui-input\ XSS.


includes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS via a qbfind message supplied by an administrator.


ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML.


SimplCommerce 1.0.0-rc uses the Bootbox.js library which allows creation of programmatic dialog boxes using Bootstrap modals. The Bootbox.js library intentionally does not perform any sanitization of user input which results in a DOM XSS because it uses the jQuery .html() function to directly append the payload to a dialog.


The PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll question entered during Special:CreatePoll or Special:UpdatePoll.


in

MISP

has

XSS

via

the

authkey

comment

field.


An XSS issue was found in the Shares feature of LiquidFiles before 3.3.19. The issue arises from the insecure rendering of HTML files uploaded to the platform as attachments when the -htmlview URL is directly accessed. The impact ranges from executing commands as root on the server to retrieving sensitive information about encrypted e-mails depending on the permissions of the target user.


CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php.


Archer before 6.8 P4 (6.8.0.4) contains a stored XSS vulnerability. A remote authenticated malicious Archer user could potentially exploit this vulnerability to store malicious HTML or JavaScript code in a trusted application data store. When application users access the corrupted data store through their browsers the malicious code gets executed by the web browser in the context of the vulnerable web application.


An issue was discovered in Orchard before 1.10. The Media Settings Allowed File Types list field allows an attacker to add a XSS payload that will execute when users attempt to upload a disallowed file type causing the error to display.


The messaging subsystem in the Online Discussion Forum 1.0 is vulnerable to XSS in the message body. An authenticated user can send messages to arbitrary users on the system that include javascript that will execute when viewing the messages page.


AudimexEE before 14.1.1 is vulnerable to Reflected XSS (Cross-Site-Scripting). If the recommended security configuration parameter \unique_error_numbers\ is not set remote attackers can inject arbitrary web script or HTML via 'action cargo panel' parameters that can lead to data leakage.


The

Stockdio

Historical

Chart

plugin

before

for

WordPress

is

affected

by

Cross

Site

Scripting

(XSS)

via

in

wp-content/plugins/stockdio-historical-chart/assets/

because

the

origin

of

a

postMessage()

event

is

not

validated.

The

function

listens

for

any

postMessage

event.

After

a

message

event

is

sent

to

the

application

this

function

sets

the

\e\

variable

as

the

event

and

checks

that

the

types

of

the

data

and

data.method

are

not

undefined

(empty)

before

proceeding

to

eval

the

data.method

received

from

the

postMessage.

However

on

a

different

website.

JavaScript

code

can

call

window.open

for

the

vulnerable

WordPress

instance

and

do

a

postMessage(msg

for

that

object.


The server in Dundas BI through 8.0.0.1001 allows XSS via addition of a Component (e.g. a button) when events such as click hover etc. occur.


OpenClinic version 0.8.2 is affected by a stored XSS vulnerability in lib/Check.php that allows users of the application to force actions on behalf of other users.


WordPress before 5.5.2 allows XSS associated with global variables.


In MISP 2.4.134 XSS exists in the template element index view because the id parameter is mishandled.


PESCMS

Team

has

multiple

reflected

XSS

via

the

id

parameter:?g=Team&m=Task&a=my&status=3&id=


The server in Dundas BI through 8.0.0.1001 allows XSS via an HTML label when creating or editing a dashboard.


WordPress before 5.5.2 allows stored XSS via post slugs.


There is a Stored XSS in Magicpin v2.1 in the User Registration section. Each time an admin visits the manage user section from the admin panel the XSS triggers and the attacker can able to steal the cookie according to the crafted payload.


OX App Suite 7.10.4 and earlier allows XSS via crafted content to reach an undocumented feature such as !(http://onerror=Function.constructor in a Notes item.


Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.


The WPBakery plugin before 6.4.1 for WordPress allows XSS because it calls kses_remove_filters to disable the standard WordPress XSS protection mechanism for the Author and Contributor roles.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1227 CVE-2020-1345 CVE-2020-1482 CVE-2020-1514 CVE-2020-1575.


It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms and possibly conduct further attacks.


Data sent with contentId to /control/stream is not sanitized allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1573.


A flaw was found in the OpenShift web console where the access token is stored in the browser's local storage. An attacker can use this flaw to get the access token via physical access or an XSS attack on the victim's browser. This flaw affects openshift/console versions before openshift/console-4.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1198 CVE-2020-1227 CVE-2020-1482 CVE-2020-1514 CVE-2020-1575.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1198 CVE-2020-1227 CVE-2020-1345 CVE-2020-1514 CVE-2020-1575.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1198 CVE-2020-1227 CVE-2020-1345 CVE-2020-1482 CVE-2020-1514.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1099 CVE-2020-1100 CVE-2020-1101.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1450 CVE-2020-1451.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177 CVE-2020-1183 CVE-2020-1298 CVE-2020-1318 CVE-2020-1320.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1198 CVE-2020-1345 CVE-2020-1482 CVE-2020-1514 CVE-2020-1575.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1099 CVE-2020-1101 CVE-2020-1106.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1580.


This vulnerability is caused when SharePoint Server does not properly sanitize a specially crafted request to an affected SharePoint server.An authenticated attacker could exploit this vulnerability by sending a specially crafted request to an affected SharePoint server aka 'Microsoft SharePoint Reflective XSS Vulnerability'.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177 CVE-2020-1183 CVE-2020-1297 CVE-2020-1298 CVE-2020-1320.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177 CVE-2020-1297 CVE-2020-1298 CVE-2020-1318 CVE-2020-1320.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1451 CVE-2020-1456.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1100 CVE-2020-1101 CVE-2020-1106.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1183 CVE-2020-1297 CVE-2020-1298 CVE-2020-1318 CVE-2020-1320.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1450 CVE-2020-1456.


Scripts in Sling CMS before 0.16.0 do not property escape the Sling Selector from URLs when generating navigational elements for the administrative consoles and are vulnerable to reflected XSS attacks.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1099 CVE-2020-1100 CVE-2020-1106.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177 CVE-2020-1183 CVE-2020-1297 CVE-2020-1298 CVE-2020-1318.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1198 CVE-2020-1227 CVE-2020-1345 CVE-2020-1482 CVE-2020-1575.


A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE-2020-1177 CVE-2020-1183 CVE-2020-1297 CVE-2020-1318 CVE-2020-1320.


In Apache ActiveMQ 5.0.0 to 5.15.11 the webconsole admin GUI is open to XSS in the view that lists the contents of a queue.


An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several of the popup's fields by sending a request to wp-admin/admin-ajax.php with the POST action parameter of sgpb_autosave and including additional data in an allPopupData parameter including the popup's ID (which is visible in the source of the page in which the popup is inserted) and arbitrary JavaScript which will then be executed in the browsers of visitors to that page. Because the plugin functionality automatically adds script tags to data entered into these fields this injection will typically bypass most WAF applications.


An XSS vulnerability resides in the hostname field of the diag_ping.php page in pfsense before 2.4.5 version. After passing inputs to the command and executing this command the $result variable is not sanitized before it is printed.


An issue was discovered in Munkireport before 5.3.0.3923. An unauthenticated actor can send a custom XSS payload through the /report/broken_client endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/views/listings/default.php.


Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.


Gambio GX before 4.0.1.0 allows XSS in admin/coupon_admin.php.


The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in /home.jsp. The vulnerable parameter is openSI. NOTE: this is fixed in the latest version.


An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Email functionality. The malicious JavaScript will execute within the browser of any user who opens the Ticket with the Article created from that Email.


The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file as demonstrated by m1_files to admin/moduleinterface.php.


An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter.


Sonatype Nexus Repository before 3.21.2 allows XSS.


The web application exposed by the Canon Oce Colorwave 500 4.0.0.0 printer is vulnerable to Reflected XSS in the parameter settingId of the settingDialogContent.jsp page. NOTE: this is fixed in the latest version.


An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the Ticket functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens the ticket or has the ticket within the Toolbar.


cPanel before 84.0.20 allows stored self-XSS via the HTML file editor (SEC-535).


A vulnerability has been identified in SICAM MMU (All versions < V2.05) SICAM SGU (All versions) SICAM T (All versions < V2.18). A stored Cross-Site-Scripting (XSS) vulnerability is present in different locations of the web application. An attacker might be able to take over a session of a legitimate user.


The way comments in article.php (vulnerable function in include/functions-article.php) are handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored (Blind) XSS (injecting arbitrary web script or HTML) in admin/manage-comments.php via the GET parameter cmt.


Nagios

XI

allows

XSS

via

the

includes/components/ldap_ad_integration/

username

parameter.


Nagios

XI

allows

XSS

via

the

password

parameter.


Ramp

AltitudeCDN

Altimeter

before

allows

authenticated

Stored

XSS

via

the

vdms/ipmapping.jsp

location

field

to

the

dms/rest/services/datastore/createOrEditValueForKey

URI.


In

phpMyAdmin

before

and

before

a

SQL

injection

vulnerability

was

discovered

where

malicious

code

could

be

used

to

trigger

an

XSS

attack

through

retrieving

and

displaying

results

(in

and

The

attacker

must

be

able

to

insert

crafted

data

into

certain

database

tables

which

when

retrieved

(for

instance

through

the

Browse

tab)

can

trigger

the

XSS

attack.


An issue was discovered in MunkiReport before 5.3.0. An authenticated actor can send a custom XSS payload through the /module/comment/save endpoint. The payload will be executed by any authenticated users browsing the application. This concerns app/controllers/client.php:detail.


MISP

has

Persistent

XSS

in

the

sighting

popover

tool.

This

is

related

to


openITCOCKPIT before 3.7.3 has unnecessary files (such as Lodash files) under the web root which leads to XSS.


The

web

application

exposed

by

the

Canon

Oce

Colorwave

printer

is

vulnerable

to

Stored

XSS

in

The

vulnerable

parameter

is

NOTE:

this

is

fixed

in

the

latest

version.


An issue was discovered in Joomla! before 3.9.16. Inadequate handling of CSS selectors in the Protostar and Beez3 JavaScript allows XSS attacks.


PHPGurukul Daily Expense Tracker System 1.0 is vulnerable to stored XSS as demonstrated by the ExpenseItem or ExpenseCost parameter in manage-expense.php.


An XSS issue was discovered in Zammad 3.0 through 3.2. Malicious code can be provided by a low-privileged user through the File Upload functionality in Zammad. The malicious JavaScript will execute within the browser of any user who opens a specially crafted link to the uploaded file with an active Zammad session.


cPanel before 84.0.20 allows self XSS via a temporary character-set specification (SEC-515).


Zulip Server before 2.1.3 allows XSS via a Markdown link with resultant account takeover.


The way the Referer header in article.php is handled in Chadha PHPKB Standard Multi-Language 9 allows attackers to execute Stored (Blind) XSS (injecting arbitrary web script or HTML) in admin/report-referrers.php (vulnerable file admin/include/functions-articles.php).


VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which will be executed.


An XSS vulnerability exists in modules/wysiwyg/save.php of LeptonCMS 4.5.0. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT elements. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT elements.


An XSS vulnerability exists in the banners.php page of PHP-Fusion 9.03.50. This can be exploited because the only security measure used against XSS is the stripping of SCRIPT tags. A malicious actor can use HTML event handlers to run JavaScript instead of using SCRIPT tags.


GNU Mailman 2.x before 2.1.30 uses the .obj extension for scrubbed application/octet-stream MIME parts. This behavior may contribute to XSS attacks against list-archive visitors because an HTTP reply from an archive web server may lack a MIME type and a web browser may perform MIME sniffing conclude that the MIME type should have been text/html and execute JavaScript code.


UliCMS before 2020.2 has XSS during PackageController uninstall.


GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.


RainbowFish PacsOne Server 6.8.4 allows XSS.


Intelbras

and

devices

allow

/cgi-bin/cgiServer.exx?page=

XSS.


OX App Suite 7.10.3 and earlier allows XSS via text/x-javascript text/rdf or a PDF document.


The data-tables-generator-by-supsystic plugin before 1.9.92 for WordPress lacks CSRF nonce checks for AJAX actions. One consequence of this is stored XSS.


phpList before 3.5.3 allows XSS with resultant privilege elevation via lists/admin/template.php.


The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS.


Katyshop2 before 2.12 has multiple stored XSS issues.


Zulip Server before 2.1.5 allows reflected XSS via the Dropbox webhook.


BigBlueButton before 2.2.4 allows XSS via closed captions because dangerouslySetInnerHTML in React is used.


include/class.sla.php in osTicket before 1.14.2 allows XSS via the SLA Name.


MonoX through 5.1.40.5152 allows stored XSS via User Status Blog Comments or Blog Description.


Grafana version < 6.7.3 is vulnerable for annotation popup XSS.


Combodo iTop does not validate inputted parameters attackers can inject malicious commands and launch XSS attack.


Fifthplay S.A.M.I before 2019.3_HP2 allows unauthenticated stored XSS via a POST request.


XSS exists in Webmin 1.941 and earlier affecting the Save function of the Read User Email Module / mailboxes Endpoint when attempting to save HTML emails. This module parses any output without sanitizing SCRIPT elements as opposed to the View function which sanitizes the input correctly. A malicious user can send any JavaScript payload into the message body and execute it if the user decides to save that email.


Several XSS vulnerabilities in osCommerce CE Phoenix before 1.0.6.0 allow an attacker to inject and execute arbitrary JavaScript code. The malicious code can be injected as follows: the page parameter to catalog/admin/order_status.php catalog/admin/tax_rates.php catalog/admin/languages.php catalog/admin/countries.php catalog/admin/tax_classes.php catalog/admin/reviews.php or catalog/admin/zones.php; or the zpage or spage parameter to catalog/admin/geo_zones.php.


Anchor 0.12.7 allows admins to cause XSS via crafted post content.


Open-AudIT 3.3.0 allows an XSS attack after login.


Pydio Cells 2.0.4 allows XSS. A malicious user can either upload or create a new file that contains potentially malicious HTML and JavaScript code to personal folders or accessible cells.


XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal credentials or data via browser JavaScript.


UliCMS before 2020.2 has PageController stored XSS.


The AirDisk Pro app 5.5.3 for iOS allows XSS via the deleteFile parameter of the Delete function.


The Catch Breadcrumb plugin before 1.5.4 for WordPress allows Reflected XSS via the s parameter (a search query). Also affected are 16 themes (if the plugin is enabled) by the same author: Alchemist and Alchemist PRO Izabel and Izabel PRO Chique and Chique PRO Clean Enterprise and Clean Enterprise PRO Bold Photography PRO Intuitive PRO Devotepress PRO Clean Blocks PRO Foodoholic PRO Catch Mag PRO Catch Wedding PRO and Higher Education PRO.


In administration/comments.php in PHP-Fusion 9.03.50 an authenticated attacker can take advantage of a stored XSS vulnerability in the Preview Comment feature. The protection mechanism can be bypassed by using HTML event handlers such as ontoggle.


The AirDisk Pro app 5.5.3 for iOS allows XSS via the createFolder parameter of the Create Folder function.


The AirDisk Pro app 5.5.3 for iOS allows XSS via the devicename parameter (shown next to the UI logo).


An improper neutralization of script-related HTML tags in a web page in FortiManager 6.2.0 6.2.1 6.2.2 and 6.2.3and FortiAnalyzer 6.2.0 6.2.1 6.2.2 and 6.2.3 may allow an attacker to execute a cross site scripting (XSS) via the Identify Provider name field.


Submitty through 20.04.01 allows XSS via upload of an SVG document as demonstrated by an attack by a Student against a Teaching Fellow.


Grafana before 6.7.3 allows table-panel XSS via column.title or cellLinkTooltip.


The WOPI API integration for Vereign Collabora CODE through 4.2.2 does not properly restrict delivery of JavaScript to a victim's browser and lacks proper MIME type access control which could lead to XSS that steals account credentials via cookies or local storage. The attacker must first obtain an API access token which can be accomplished if the attacker is able to upload a .docx or .odt file. The associated API endpoints for exploitation are /wopi/files and /wopi/getAccessToken.


An issue was discovered in MB connect line mymbCONNECT24 and mbCONNECT24 software in all versions through V2.6.2. There is an XSS issue in the redirect.php allowing an attacker to inject code via a get parameter.


showAlert() in the administration panel in Bludit 3.12.0 allows XSS.


The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.


OpenIAM before 4.2.0.3 allows XSS in the Add New User feature.


A stored XSS vulnerability was discovered in the ECT Provider in OutSystems before 2020-09-04 affecting generated applications. It could allow an unauthenticated remote attacker to craft and store malicious Feedback content into /ECT_Provider/ such that when the content is viewed (it can only be viewed by Administrators) attacker-controlled JavaScript will execute in the security context of an administrator's browser. This is fixed in Outsystems 10.0.1005.2 Outsystems 11.9.0 Platform Server and Outsystems 11.7.0 LifeTime Management Console.


legend.ts in the piechart-panel (aka Pie Chart Panel) plugin before 1.5.0 for Grafana allows XSS via the Values Header (aka legend header) option.


An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter.


NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.


An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.


The bbPress plugin through 2.6.4 for WordPress has stored XSS in the Forum creation section resulting in JavaScript execution at wp-admin/edit.php?post_type=forum (aka the Forum listing page) for all users. An administrator can exploit this at the wp-admin/post.php?action=edit URI.


An issue was discovered in RouterNanoHTTPD.java in NanoHTTPD through 2.3.1. The GeneralHandler class implements a basic GET handler that prints debug information as an HTML page. Any web server that extends this class without implementing its own GET handler is vulnerable to reflected XSS because the GeneralHandler GET handler prints user input passed through the query string without any sanitization.


Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in the value is reflected back to the user but is also stored within the DB and can be later triggered again by the same victim or also later by different users). Both stored and reflected payloads are triggerable by admin so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS which can be executed by admin potentially elevating privileges and obtaining admin access. (issue 2 of 3)


An XSS vulnerability exists in the Webmail component of Zimbra Collaboration Suite before 8.8.15 Patch 11. It allows an attacker to inject executable JavaScript into the account name of a user's profile. The injected code can be reflected and executed when changing an e-mail signature.


phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.


The

Web

Application

Firewall

in

through

allows

XSS

via

the

itemsITEMSID

parameter

to

the

components/bitrix/mobileapp.list/ajax.php/

URI.


Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter the response from the POST request is displayed and any JavaScript returned from the external server is executed in the browser. This is related to CVE-2019-16951.


phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widget.


In Joomla! before 3.9.19 lack of input validation in the heading tag option of the \Articles - Newsflash\ and \Articles - Categories\ modules allows XSS.


Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself) and can exploit (be triggered by) unauthenticated users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1


An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name.


Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in the value is reflected back to the user but is also stored within the DB and can be later triggered again by the same victim or also later by different users). Both stored and reflected payloads are triggerable by admin so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS which can be executed by admin potentially elevating privileges and obtaining admin access. (issue 3 of 3)


Your Online Shop 1.8.0 allows authenticated users to trigger XSS via a Change Name or Change Surname operation.


The DMS/ECM module in Dolibarr 11.0.4 renders user-uploaded .html files in the browser when the attachment parameter is removed from the direct download link. This causes XSS.


OWASP json-sanitizer before 1.2.1 allows XSS. An attacker who controls a substring of the input JSON and controls another substring adjacent to a SCRIPT element in which the output is embedded as JavaScript may be able to confuse the HTML parser as to where the SCRIPT element ends and cause non-script content to be interpreted as JavaScript.


Kordil EDMS through 2.2.60rc3 allows stored XSS in users_edit.php users_management_edit.php and user_management.php.


in

the

Web

Application

Firewall

in

through

allows

XSS

by

placing

before

the

payload.


SysAid 20.1.11b26 allows reflected XSS via the ForgotPassword.jsp accountid parameter.


An issue was discovered in Navigate CMS through 2.8.7. It allows XSS because of a lack of purify calls in lib/packages/feeds/feed.class.php.


The Neon theme 2.0 before 2020-06-03 for Bootstrap allows XSS via an Add Task Input operation in a dashboard.


The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities by using a crafted link in the custom URL or by applying custom attributes.


Studio in Open edX Ironwood 2.5 allows users to upload SVG files via the \Content>File Uploads\ screen. These files can contain JavaScript code and thus lead to Stored XSS.


An issue was discovered in Mods for HESK 3.1.0 through 2019.1.0. A Stored XSS issue allows remote unauthenticated attackers to abuse a helpdesk user's logged in session. A user with sufficient privileges to change their login-page image must open a crafted ticket.


OpenText Carbonite Server Backup Portal before 8.8.7 allows XSS by an authenticated user via policy creation.


Grafana before 7.0.0 allows tag value XSS via the OpenTSDB datasource.


Apache Atlas before 2.1.0 contain a XSS vulnerability. While saving search or rendering elements values are not sanitized correctly and because of that it triggers the XSS vulnerability.


app/View/Events/resolved_attributes.ctp in MISP before 2.4.126 has XSS in the resolved attributes view.


Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.


An

XSS

issue

in

emfd

in

Ruckus

Wireless

Unleashed

through

allows

a

remote

attacker

to

execute

JavaScript

code

via

an

unauthenticated

crafted

HTTP

request.

This

affects

and

devices.


** DISPUTED ** OpenCart 3.0.3.3 allows remote authenticated users to conduct XSS attacks via a crafted filename in the users' image upload section because of a lack of entity encoding. NOTE: this issue exists because of an incomplete fix for CVE-2020-10596. The vendor states \this is not a massive issue as you are still required to be logged into the admin.\


CRK Business Platform <= 2019.1 allows reflected XSS via erro.aspx on 'CRK' 'IDContratante' 'Erro' or 'Mod' parameter. This is path-independent.


An

issue

was

discovered

in

Navigate

CMS

through

It

allows

XSS

because

of

a

lack

of

purify

calls

in


In Shopware before 6.2.3 authenticated users are allowed to use the Mediabrowser fileupload feature to upload SVG images containing JavaScript. This leads to Persistent XSS. An uploaded image can be accessed without authentication.


Extreme EAC Appliance 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.


Ivanti

Endpoint

Manager

through

allows

XSS

via

and


An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.


Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in the value is reflected back to the user but is also stored within the DB and can be later triggered again by the same victim or also later by different users). Both stored and reflected payloads are triggerable by admin so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS which can be executed by admin potentially elevating privileges and obtaining admin access. (issue 1 of 3)


The SportsPress plugin before 2.7.2 for WordPress allows XSS.


An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7. Query parameters generated by the Django admin ForeignKeyRawIdWidget were not properly URL encoded leading to a possibility of an XSS attack.


In Apache ActiveMQ Artemis 2.5.0 to 2.13.0 a specially crafted MQTT packet which has an XSS payload as client-id or topic name can exploit this vulnerability. The XSS payload is being injected into the admin console's browser. The XSS payload is triggered in the diagram plugin; queue node and the info section.


A

vulnerability

in

the

web-based

management

interface

of

RAD

through

could

allow

an

authenticated

attacker

to

upload

a

JavaScript

file

with

a

stored

XSS

payload

that

will

remain

stored

in

the

system

as

an

OVPN

file

in

Configuration-Services-Security-OpenVPN-Config

or

as

the

static

key

file

in

Configuration-Services-Security-OpenVPN-Static

Keys.

This

payload

will

execute

each

time

a

user

opens

an

affected

web

page.

This

could

be

exploited

in

conjunction

with


Artica Pandora FMS 7.44 has persistent XSS in the Messages feature.


An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.


BooleBox Secure File Sharing Utility before 4.2.3.0 allows stored XSS via a crafted avatar field within My Account JSON data to Account.aspx.


HESK before 3.1.10 allows reflected XSS.


An issue was discovered in Collabtive 3.0 and later. managefile.php is vulnerable to XSS: when the action parameter is set to movefile and the id parameter corresponds to a project the current user has access to the file and target parameters are reflected.


Dolibarr before 11.0.4 allows XSS.


Victor CMS 1.0 has Persistent XSS in admin/users.php?source=add_user via the user_name user_firstname or user_lastname parameter.


In Joomla! before 3.9.19 incorrect input validation of the module tag option in com_modules allows XSS.


The default error page for VelocityView in Apache Velocity Tools prior to 3.1 reflects back the vm file that was entered as part of the URL. An attacker can set an XSS payload file as this vm file in the URL which results in this payload being executed. XSS vulnerabilities allow attackers to execute arbitrary JavaScript in the context of the attacked website and the attacked user. This can be abused to steal session cookies perform requests in the name of the victim or for phishing attacks.


Contentful through 2020-05-21 for Python allows reflected XSS as demonstrated by the api parameter to the-example-app.py.


CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.


An

issue

was

discovered

in

Navigate

CMS

through

It

allows

XSS

because

of

a

lack

of

purify

calls

in


Fork before 5.8.3 allows XSS via navigation_title or title.


The DMS/ECM module in Dolibarr 11.0.4 allows users with the 'Setup documents directories' permission to rename uploaded files to have insecure file extensions. This bypasses the .noexe protection mechanism against XSS.


An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action.


Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself) and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1.


Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Current_url or email field or the User-Agent HTTP header.


Jenkins Gatling Plugin 1.2.7 and earlier prevents Content-Security-Policy headers from being set for Gatling reports served by the plugin resulting in an XSS vulnerability exploitable by users able to change report content.


Jenkins Gitlab Hook Plugin 1.4.2 and earlier does not escape project names in the build_now endpoint resulting in a reflected XSS vulnerability.


Jenkins 2.227 and earlier LTS 2.204.5 and earlier does not properly escape node labels that are shown in the form validation for label expressions on job configuration pages resulting in a stored XSS vulnerability exploitable by users able to define node labels.


A form validation endpoint in Jenkins Queue cleanup Plugin 1.3 and earlier does not properly escape a query parameter displayed in an error message resulting in a reflected XSS vulnerability.


Jenkins RapidDeploy Plugin 4.2 and earlier does not escape package names in the table of packages obtained from a remote server resulting in a stored XSS vulnerability.


Jenkins Timestamper Plugin 1.11.1 and earlier does not sanitize HTML formatting of its output resulting in a stored XSS vulnerability exploitable by attackers with Overall/Administer permission.


Jenkins Code Coverage API Plugin 1.1.2 and earlier does not escape the filename of the coverage report used in its view resulting in a stored XSS vulnerability exploitable by users able to change job configurations.


An issue was discovered in phpMyAdmin. XSS is possible because of a weakness in a regular expression used in some JavaScript processing. All 4.6.x versions (prior to 4.6.5) 4.4.x versions (prior to 4.4.15.9) and 4.0.x versions (prior to 4.0.10.18) are affected.


Cloudera Manager 5.7.x before 5.7.6 5.8.x before 5.8.4 and 5.9.x before 5.9.1 allows XSS in the help search feature.


Nextcloud Server before 9.0.52 & ownCloud Server before 9.0.4 are vulnerable to a log pollution vulnerability potentially leading to a local XSS. The download log functionality in the admin screen is delivering the log in JSON format to the end-user. The file was delivered with an attachment disposition forcing the browser to download the document. However Firefox running on Microsoft Windows would offer the user to open the data in the browser as an HTML document. Thus any injected data in the log would be executed.


Revive Adserver before 3.2.3 suffers from reflected XSS. The affiliate-preview.php script in www/admin is vulnerable to a reflected XSS attack. This vulnerability could be used by an attacker to steal the session ID of an authenticated user by tricking them into visiting a specifically crafted URL.


Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists requiring a trusted (non-admin) account. The website name wasn't properly escaped when displayed in the campaign-zone.php script.


Revive Adserver before 3.2.3 suffers from Persistent XSS. A vector for persistent XSS attacks via the Revive Adserver user interface exists requiring a trusted (non-admin) account. The banner image URL for external banners wasn't properly escaped when displayed in most of the banner related pages.


Multiple

stored

Cross-Site-Scripting

(XSS)

vulnerabilities

in

com.trend.iwss.gui.servlet.updateaccountadministration

in

Trend

Micro

InterScan

Web

Security

Virtual

Appliance

(IWSVA)

version

and

earlier

allow

authenticated

remote

users

with

least

privileges

to

inject

arbitrary

HTML/JavaScript

code

into

web

pages.

This

was

resolved

in

Version

CP


In F5 BIG-IP APM 12.0.0 through 12.1.2 non-authenticated users may be able to inject JavaScript into a request that will then be rendered and executed in the context of the Administrative user when the Administrative user is viewing the Access System Logs allowing the non-authenticated user to carry out a Cross Site Scripting (XSS) attack against the Administrative user.


Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to access the administrator account.


Some forms with the parameter geo_zoomlevel_to_found_location in Tiki Wiki CMS 12.x before 12.10 LTS 15.x before 15.3 LTS and 16.x before 16.1 don't have the input sanitized related to tiki-setup.php and article_image.php. The impact is XSS.


Revive Adserver before 3.2.3 suffers from Reflected XSS. `www/admin/stats.php` is vulnerable to reflected XSS attacks via multiple parameters that are not properly sanitised or escaped when displayed such as setPerPage pageId bannerid period_start period_end and possibly others.


Nextcloud Server before 10.0.1 & ownCloud Server before 9.0.6 and 9.1.2 suffer from Reflected XSS in the Gallery application. The gallery app was not properly sanitizing exception messages from the Nextcloud/ownCloud server. Due to an endpoint where an attacker could influence the error message this led to a reflected Cross-Site-Scripting vulnerability.


A reflected XSS vulnerability exists in the web console of the Document Viewer Agent in Novell GroupWise before 2014 R2 Support Pack 1 Hot Patch 2 that may enable a remote attacker to execute JavaScript in the context of a valid user's browser session by getting the user to click on a specially crafted link. This could lead to session compromise or other browser-based attacks.


Revive Adserver before 3.2.5 and 4.0.0 suffers from Reflected XSS. The Revive Adserver web installer scripts were vulnerable to a reflected XSS attack via the dbHost dbUser and possibly other parameters. It has to be noted that the window for such attack vectors to be possible is extremely narrow and it is very unlikely that such an attack could be actually effective.


A vulnerability was found in foreman 1.14.0. When creating an organization or location in Foreman if the name contains HTML then the second step of the wizard (/organizations/id/step2) will render the HTML. This occurs in the alertbox on the page. The result is a stored XSS attack if an organization/location with HTML in the name is created then a user is linked directly to this URL.


JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via business process editor. The flaw is due to an incomplete fix for CVE-2016-5398. Remote authenticated attackers that have privileges to create business processes can store scripts in them which are not properly sanitized before showing to other users including admins.


XSS in Yandex Browser Translator in Yandex browser for desktop for versions from 15.12 to 16.2 could be used by remote attacker for evaluation arbitrary javascript code.