Total
34649 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-29318 | 1 Personal-management-system | 1 Personal Management System | 2025-03-13 | N/A | 5.4 MEDIUM |
| Volmarg Personal Management System 1.4.64 is vulnerable to stored cross site scripting (XSS) via upload of a SVG file with embedded javascript code. | |||||
| CVE-2024-4381 | 1 Wielebenwir | 1 Commonsbooking | 2025-03-13 | N/A | 4.8 MEDIUM |
| The CB (legacy) WordPress plugin through 0.9.4.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2024-0756 | 1 Elearningfreak | 1 Insert Or Embed Articulate Content | 2025-03-13 | N/A | 5.4 MEDIUM |
| The Insert or Embed Articulate Content into WordPress plugin through 4.3000000023 lacks validation of URLs when adding iframes, allowing attackers to inject an iFrame in the page and thus load arbitrary content from any page. | |||||
| CVE-2024-26489 | 1 Flusity | 1 Flusity | 2025-03-13 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Social block links' module of flusity-CMS v2.33 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Profile Name text field. | |||||
| CVE-2024-28761 | 1 Ibm | 1 App Connect Enterprise | 2025-03-13 | N/A | 5.4 MEDIUM |
| IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 285245. | |||||
| CVE-2024-13431 | 1 Nsquared | 1 Appointment Booking Calendar | 2025-03-13 | N/A | 6.1 MEDIUM |
| The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the accent_color and background parameter in all versions up to, and including, 1.6.8.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | |||||
| CVE-2024-9502 | 1 Master-addons | 1 Master Addons | 2025-03-13 | N/A | 5.4 MEDIUM |
| The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Tooltip module in all versions up to, and including, 2.0.6.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-22277 | 1 Vmware | 1 Cloud Director | 2025-03-13 | N/A | 5.4 MEDIUM |
| VMware Cloud Director Availability contains an HTML injection vulnerability. A malicious actor with network access to VMware Cloud Director Availability can craft malicious HTML tags to execute within replication tasks. | |||||
| CVE-2024-25412 | 1 Flatpress | 1 Flatpress | 2025-03-13 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email field. | |||||
| CVE-2024-34577 | 1 Elecom | 6 Wrc-x3000gs2-b, Wrc-x3000gs2-b Firmware, Wrc-x3000gs2-w and 3 more | 2025-03-13 | N/A | 6.1 MEDIUM |
| Cross-site scripting vulnerability exists in WRC-X3000GS2-B, WRC-X3000GS2-W, and WRC-X3000GS2A-B due to improper processing of input values in easysetup.cgi. If a user views a malicious web page while logged in to the product, an arbitrary script may be executed on the user's web browser. | |||||
| CVE-2024-25300 | 1 Redaxo | 1 Redaxo | 2025-03-13 | N/A | 4.8 MEDIUM |
| A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Template section. | |||||
| CVE-2024-2324 | 1 Fileorganizer | 1 Fileorganizer | 2025-03-13 | N/A | 5.4 MEDIUM |
| The FileOrganizer – Manage WordPress and Website Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via svg file upload in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. For the free version, this is limited to administrators. The pro version is also vulnerable and exploitable by administrators, but also offers the functionality to lower level users (as low as subscribers) if enabled. | |||||
| CVE-2021-29669 | 3 Ibm, Linux, Microsoft | 3 Jazz Foundation, Linux Kernel, Windows | 2025-03-13 | N/A | 5.4 MEDIUM |
| IBM Jazz Foundation 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | |||||
| CVE-2024-25801 | 1 Skinsoft | 1 S-museum | 2025-03-13 | N/A | 6.1 MEDIUM |
| SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. Unlike in CVE-2024-25802, the attack payload is in the name (not the content) of a file. | |||||
| CVE-2024-26278 | 1 Joomla | 1 Joomla\! | 2025-03-13 | N/A | 6.1 MEDIUM |
| The Custom Fields component not correctly filter inputs, leading to a XSS vector. | |||||
| CVE-2024-46453 | 1 Honeywell | 2 Iq3xcite, Iq3xcite Firmware | 2025-03-13 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the component /test/ of iq3xcite v2.31 to v3.05 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | |||||
| CVE-2024-42008 | 1 Roundcube | 1 Webmail | 2025-03-13 | N/A | 9.3 CRITICAL |
| A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header. | |||||
| CVE-2024-39094 | 1 Friendica | 1 Friendica | 2025-03-13 | N/A | 5.4 MEDIUM |
| Friendica 2024.03 is vulnerable to Cross Site Scripting (XSS) in settings/profile via the homepage, xmpp, and matrix parameters. | |||||
| CVE-2024-21584 | 1 Pleasanter | 1 Pleasanter | 2025-03-13 | N/A | 6.1 MEDIUM |
| Pleasanter 1.3.49.0 and earlier contains a cross-site scripting vulnerability. If an attacker tricks the user to access the product with a specially crafted URL and perform a specific operation, an arbitrary script may be executed on the web browser of the user. | |||||
| CVE-2024-42918 | 1 Adonesevangelista | 1 Online Accreditation Management System | 2025-03-13 | N/A | 5.4 MEDIUM |
| itsourcecode Online Accreditation Management System contains a Cross Site Scripting vulnerability, which allows an attacker to execute arbitrary code via a crafted payload to the SCHOOLNAME, EMAILADDRES, CONTACTNO, COMPANYNAME and COMPANYCONTACTNO parameters in controller.php. | |||||