Total
34649 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-10206 | 1 Vaultize | 1 Enterprise File Sharing | 2025-05-30 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS via the optional message field of a file request. | |||||
| CVE-2019-6514 | 1 Wso2 | 1 Dashboard Server | 2025-05-30 | 3.5 LOW | 4.8 MEDIUM |
| An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page, aka XSS. | |||||
| CVE-2023-35792 | 1 Vound-software | 1 Intella Connect | 2025-05-30 | N/A | 6.1 MEDIUM |
| Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS). | |||||
| CVE-2023-41103 | 1 Interactsoftware | 1 Interact | 2025-05-30 | N/A | 5.4 MEDIUM |
| Interact 7.9.79.5 allows stored Cross-site Scripting (XSS) attacks in several locations, allowing an attacker to store a JavaScript payload. | |||||
| CVE-2022-29931 | 1 Raytion | 1 Custom Security Manager | 2025-05-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XSS). | |||||
| CVE-2018-10209 | 1 Vaultize | 1 Enterprise File Sharing | 2025-05-30 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS on the file or folder download pop-up via a crafted file or folder name. | |||||
| CVE-2024-3231 | 1 Ivanweb | 1 Popup4phone | 2025-05-30 | N/A | N/A |
| The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins. | |||||
| CVE-2024-2761 | 1 Wpengine | 1 Genesis Blocks | 2025-05-30 | N/A | N/A |
| The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor privileges to conduct Stored XSS attacks. | |||||
| CVE-2024-2309 | 1 Wp-staging | 1 Wp Staging | 2025-05-30 | N/A | N/A |
| The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2025-48252 | 1 Wpfactory | 1 Back Button Widget | 2025-05-30 | N/A | 5.4 MEDIUM |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget allows Stored XSS. This issue affects Back Button Widget: from n/a through 1.6.8. | |||||
| CVE-2023-52328 | 1 Trendmicro | 1 Apex Central | 2025-05-30 | N/A | 6.1 MEDIUM |
| Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an attacker to achieve remote code execution on affected servers. Please note this vulnerability is similar, but not identical to CVE-2023-52329. | |||||
| CVE-2023-6626 | 1 Gravitymaster | 1 Product Enquiry For Woocommerce | 2025-05-30 | N/A | 4.8 MEDIUM |
| The Product Enquiry for WooCommerce WordPress plugin before 3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2023-52046 | 1 Webmin | 1 Webmin | 2025-05-30 | N/A | 4.8 MEDIUM |
| Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payload to the "Execute cron job as" tab Input field. | |||||
| CVE-2023-41177 | 1 Trendmicro | 1 Mobile Security | 2025-05-30 | N/A | 6.1 MEDIUM |
| Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker. Please note, this vulnerability is similar to, but not identical to, CVE-2023-41178. | |||||
| CVE-2024-22497 | 1 Jfinalcms Project | 1 Jfinalcms | 2025-05-30 | N/A | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL. | |||||
| CVE-2023-7194 | 1 Meris Wp Theme Project | 1 Meris Wp Theme | 2025-05-30 | N/A | 6.1 MEDIUM |
| The Meris WordPress theme through 1.1.2 does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |||||
| CVE-2024-23725 | 1 Ghost | 1 Ghost | 2025-05-30 | N/A | 6.1 MEDIUM |
| Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. An XSS payload can be rendered in post summaries. | |||||
| CVE-2023-7063 | 1 Wpforms | 1 Wpforms | 2025-05-30 | N/A | 6.1 MEDIUM |
| The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and including, 1.8.5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-41178 | 1 Trendmicro | 1 Mobile Security | 2025-05-30 | N/A | 6.1 MEDIUM |
| Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticated victim that visits a malicious link provided by an attacker. Please note, this vulnerability is similar to, but not identical to, CVE-2023-41176. | |||||
| CVE-2024-23387 | 1 Fusionpbx | 1 Fusionpbx | 2025-05-30 | N/A | 4.8 MEDIUM |
| FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. If this vulnerability is exploited by a remote authenticated attacker with an administrative privilege, an arbitrary script may be executed on the web browser of the user who is logging in to the product. | |||||