Export limit exceeded: 416276 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 51139 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (51139 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2017-16962 | 1 Communigate | 1 Communigate Pro | 2025-04-20 | N/A |
| The WebMail components (Crystal, pronto, and pronto4) in CommuniGate Pro before 6.2.1 have stored XSS vulnerabilities via (1) the location or details field of a Google Calendar invitation, (2) a crafted Outlook.com calendar (aka Hotmail Calendar) invitation, (3) e-mail granting access to a directory that has JavaScript in its name, (4) JavaScript in a note name, (5) JavaScript in a task name, or (6) HTML e-mail that is mishandled in the Inbox component. | ||||
| CVE-2017-5998 | 1 Intersect Alliance | 1 Snare Epilog | 2025-04-20 | N/A |
| Cross-site scripting (XSS) vulnerability in InterSect Alliance SNARE Epilog for UNIX version 1.5 allows remote authenticated users to inject arbitrary web script or HTML via the str_log_name parameter in a "Web Admin Portal > Log Configuration > Add" action. | ||||
| CVE-2017-12810 | 1 Stivasoft | 1 Phpjabbers Newsletter Script | 2025-04-20 | N/A |
| PHPJabbers PHP Newsletter Script 4.2 has stored XSS in lists in the admin panel. | ||||
| CVE-2017-3848 | 1 Cisco | 1 Prime Infrastructure | 2025-04-20 | N/A |
| A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected system. More Information: CSCuw63001 CSCuw63003. Known Affected Releases: 2.2(2). Known Fixed Releases: 3.1(0.0). | ||||
| CVE-2016-6800 | 1 Apache | 1 Ofbiz | 2025-04-20 | N/A |
| The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are related to specific parties. In the form field for the creation of new blog articles the user input of the summary field as well as the article field is not properly sanitized. It is possible to inject arbitrary JavaScript code in these form fields. This code gets executed from the browser of every user who is visiting this article. Mitigation: Upgrade to Apache OFBiz 16.11.01. | ||||
| CVE-2017-1000109 | 1 Jenkins | 1 Owasp Dependency-check | 2025-04-20 | N/A |
| The custom Details view of the Static Analysis Utilities based OWASP Dependency-Check Plugin, was vulnerable to a persisted cross-site scripting vulnerability: Malicious users able to influence the input to this plugin could insert arbitrary HTML into this view. | ||||
| CVE-2016-10699 | 1 Dlink | 2 Dsl-2740e, Dsl-2740e Firmware | 2025-04-20 | N/A |
| D-Link DSL-2740E 1.00_BG_20150720 devices are prone to persistent XSS attacks in the username and password fields: a remote unauthenticated user may craft logins and passwords with script tags in them. Because there is no sanitization in the input fields, an unaware logged-in administrator may be a victim when checking the router logs. | ||||
| CVE-2016-8213 | 1 Emc | 4 Documentum Administrator, Documentum Capital Projects, Documentum Taskspace and 1 more | 2025-04-20 | N/A |
| EMC Documentum WebTop Version 6.8, prior to P18 and Version 6.8.1, prior to P06; and EMC Documentum TaskSpace version 6.7SP3, prior to P02; and EMC Documentum Capital Projects Version 1.9, prior to P30 and Version 1.10, prior to P17; and EMC Documentum Administrator Version 7.0, Version 7.1, and Version 7.2 prior to P18 contain a Stored Cross-Site Scripting Vulnerability that could potentially be exploited by malicious users to compromise the affected system. | ||||
| CVE-2017-2929 | 2 Adobe, Microsoft | 2 Acrobat, Windows | 2025-04-20 | N/A |
| Adobe Acrobat Chrome extension version 15.1.0.3 and earlier have a DOM-based cross-site scripting vulnerability. Successful exploitation could lead to JavaScript code execution. | ||||
| CVE-2024-31741 | 2 1234n, Minicms Project | 2 Minicms, Minicms | 2025-04-18 | 6.1 Medium |
| Cross Site Scripting vulnerability in MiniCMS v.1.11 allows a remote attacker to run arbitrary code via crafted string in the URL after login. | ||||
| CVE-2024-2603 | 1 Salonbookingsystem | 1 Salon Booking System | 2025-04-18 | 6.3 Medium |
| The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin (or editor depending on Salon booking system WordPress plugin through 9.6.5 configuration) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-31609 | 2 Bosscms, Code-projects | 2 Bosscms, Simple School Management System | 2025-04-18 | 7.1 High |
| Cross Site Scripting (XSS) vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuration. | ||||
| CVE-2024-55342 | 1 Dotnetfoundation | 1 Piranha Cms | 2025-04-18 | 4.7 Medium |
| A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media. This PDF can contain malicious JavaScript code, which is executed when a victim user opens or interacts with the PDF in their web browser, leading to a XSS vulnerability. | ||||
| CVE-2020-22540 | 1 Codologic | 1 Codoforum | 2025-04-18 | 5.4 Medium |
| Stored Cross-Site Scripting (XSS) vulnerability in Codoforum v4.9, allows attackers to execute arbitrary code and obtain sensitive information via crafted payload to Category name component. | ||||
| CVE-2024-4061 | 1 Ays-pro | 1 Survey Maker | 2025-04-18 | 4.8 Medium |
| The Survey Maker WordPress plugin before 4.2.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2022-38653 | 1 Hcltech | 1 Digital Experience | 2025-04-18 | 2 Low |
| In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded. | ||||
| CVE-2024-51055 | 1 Hoosk | 1 Hoosk | 2025-04-18 | 6.5 Medium |
| An issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component. | ||||
| CVE-2023-46950 | 1 Contribsys | 1 Sidekiq | 2025-04-18 | 6.1 Medium |
| Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL to the filter functions. | ||||
| CVE-2022-37832 | 1 Mutiny | 1 Mutiny | 2025-04-18 | 9.8 Critical |
| Mutiny 7.2.0-10788 suffers from Hardcoded root password. | ||||
| CVE-2022-36223 | 1 Emby | 1 Emby | 2025-04-18 | 6.1 Medium |
| In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the media server administrator account. | ||||