Total
34649 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-40303 | 1 Perfexcrm | 1 Perfex Crm | 2025-05-01 | N/A | 5.4 MEDIUM |
| perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile. | |||||
| CVE-2022-33322 | 1 Mitsubishielectric | 238 Ma-ew85s-e, Ma-ew85s-e Firmware, Ma-ew85s-uk and 235 more | 2025-05-01 | N/A | 6.1 MEDIUM |
| Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch and Air Purifier) allows a remote unauthenticated attacker to execute an malicious script on a user's browser to disclose information, etc. The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability. As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section. | |||||
| CVE-2022-43120 | 1 Intelliants | 1 Subrion Cms | 2025-05-01 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field default value text field. | |||||
| CVE-2023-0878 | 1 Nuxt | 1 Nuxt | 2025-05-01 | N/A | 6.1 MEDIUM |
| Cross-site Scripting (XSS) - Generic in GitHub repository nuxt/framework prior to 3.2.1. | |||||
| CVE-2023-7167 | 1 Danialhatami | 1 Persian Fonts | 2025-05-01 | N/A | N/A |
| The Persian Fonts WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2024-10276 | 1 Telestream | 1 Sentry | 2025-05-01 | N/A | 6.1 MEDIUM |
| A vulnerability has been found in Telestream Sentry 6.0.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /?page=reports of the component Reports Page. The manipulation of the argument z leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | |||||
| CVE-2024-1106 | 1 Datenverwurstungszentrale | 1 Shariff Wrapper | 2025-05-01 | N/A | N/A |
| The Shariff Wrapper WordPress plugin before 4.6.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-38167 | 1 Nintex | 1 Workflow | 2025-05-01 | N/A | 6.1 MEDIUM |
| The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS. | |||||
| CVE-2022-26088 | 1 Bmc | 1 Remedy It Service Management Suite | 2025-05-01 | N/A | 5.4 MEDIUM |
| An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such as an SSRF payload) into the Activity Log by placing it in the To: field. This affects rendering that occurs upon a click in the "number of recipients" field. NOTE: the vendor's position is that "no real impact is demonstrated." | |||||
| CVE-2022-35740 | 1 Dotcms | 1 Dotcms | 2025-05-01 | N/A | 6.1 MEDIUM |
| dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. (This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users.) Some Java application frameworks, including those used by Spring or Tomcat, allow the use of matrix parameters: these are URI parameters separated by semicolons. Through precise semicolon placement in a URI, it is possible to exploit this feature to avoid dotCMS's path-based XSS prevention (such as "require login" filters), and consequently access restricted resources. For example, an attacker could place a semicolon immediately before a / character that separates elements of a filesystem path. This could reveal file content that is ordinarily only visible to signed-in users. This issue can be chained with other exploit code to achieve XSS attacks against dotCMS. | |||||
| CVE-2024-1273 | 1 Squirrly | 1 Starbox | 2025-05-01 | N/A | N/A |
| The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks | |||||
| CVE-2024-4957 | 1 J-breuer | 1 Frontend Checklist | 2025-04-30 | N/A | N/A |
| The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2024-4959 | 1 J-breuer | 1 Frontend Checklist | 2025-04-30 | N/A | N/A |
| The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2021-25929 | 1 Opennms | 2 Horizon, Meridian | 2025-04-30 | 3.5 LOW | 4.8 MEDIUM |
| In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files. | |||||
| CVE-2021-25933 | 1 Opennms | 2 Horizon, Meridian | 2025-04-30 | 3.5 LOW | 4.8 MEDIUM |
| In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms. | |||||
| CVE-2021-40272 | 1 Op5 | 1 Monitor | 2025-04-30 | N/A | 6.1 MEDIUM |
| OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS). | |||||
| CVE-2018-15574 | 1 Reprisesoftware | 1 Reprise License Manager | 2025-04-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in the license editor in Reprise License Manager (RLM) through 12.2BL2. It is a cross-site scripting vulnerability in the /goform/edit_lf_get_data lf parameter via GET or POST. NOTE: the vendor has stated "We do not consider this a vulnerability." | |||||
| CVE-2021-45422 | 1 Reprisesoftware | 1 Reprise License Manager | 2025-04-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_process "count" parameter via GET. No authentication is required. | |||||
| CVE-2022-28364 | 1 Reprisesoftware | 1 Reprise License Manager | 2025-04-30 | 3.5 LOW | 5.4 MEDIUM |
| Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process file parameter via GET. Authentication is required. | |||||
| CVE-2022-28363 | 1 Reprisesoftware | 1 Reprise License Manager | 2025-04-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process username parameter via GET. No authentication is required. | |||||