Search
Total
20468 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-36739 | 1 Apache | 1 Pluto | 2022-01-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| The "first name" and "last name" fields of the Apache Pluto 3.1.0 MVCBean JSP portlet maven archetype are vulnerable to Cross-Site Scripting (XSS) attacks. | |||||
| CVE-2021-44584 | 1 Emlog | 1 Emlog | 2022-01-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in index.php in emlog version <= pro-1.0.7 allows remote attackers to inject arbitrary web script or HTML via the s parameter. | |||||
| CVE-2021-45813 | 1 Slican | 1 Webcti | 2022-01-12 | 4.3 MEDIUM | 6.1 MEDIUM |
| SLICAN WebCTI 1.01 2015 is affected by a Cross Site Scripting (XSS) vulnerability. The attacker can steal the user's session by injecting malicious JavaScript codes which leads to Session Hijacking and cause user's credentials theft. | |||||
| CVE-2022-21650 | 1 Convos | 1 Convos | 2022-01-11 | 3.5 LOW | 5.4 MEDIUM |
| Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .html extension. By uploading an SVG file with an html extension the upload filter can be bypassed. This causes Stored XSS. Also, after uploading a file the XSS attack is triggered upon a user viewing the file. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible. | |||||
| CVE-2021-46074 | 1 Vehicle Service Management System Project | 1 Vehicle Service Management System | 2022-01-11 | 3.5 LOW | 4.8 MEDIUM |
| A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the Settings Section in login panel. | |||||
| CVE-2021-46073 | 1 Vehicle Service Management System Project | 1 Vehicle Service Management System | 2022-01-11 | 3.5 LOW | 4.8 MEDIUM |
| A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodester Vehicle Service Management System 1.0 via the User List Section in login panel. | |||||
| CVE-2021-42841 | 1 Practo | 1 Insta Hms | 2022-01-11 | 4.3 MEDIUM | 6.1 MEDIUM |
| Insta HMS before 12.4.10 is vulnerable to XSS because of improper validation of user-supplied input by multiple scripts. A remote attacker could exploit this vulnerability via a crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials. | |||||
| CVE-2021-43861 | 1 Mermaid Project | 1 Mermaid | 2022-01-11 | 3.5 LOW | 5.4 MEDIUM |
| Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading. | |||||
| CVE-2022-22293 | 1 Dolibarr | 1 Dolibarr | 2022-01-10 | 3.5 LOW | 5.4 MEDIUM |
| admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter. | |||||
| CVE-2021-46071 | 1 Vehicle Service Management System Project | 1 Vehicle Service Management System | 2022-01-10 | 3.5 LOW | 4.8 MEDIUM |
| A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Category List Section in login panel. | |||||
| CVE-2021-38876 | 1 Ibm | 1 I | 2022-01-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM i 7.2, 7.3, and 7.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 208404. | |||||
| CVE-2021-45815 | 1 Quectel | 2 Uc20, Uc20 Firmware | 2022-01-10 | 4.3 MEDIUM | 6.1 MEDIUM |
| Quectel UC20 UMTS/HSPA+ UC20 6.3.14 is affected by a Cross Site Scripting (XSS) vulnerability. | |||||
| CVE-2020-23986 | 1 Github Readme Stats Project | 1 Github Readme Stats | 2022-01-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| Github Read Me Stats commit 3c7220e4f7144f6cb068fd433c774f6db47ccb95 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the function renderError. | |||||
| CVE-2022-22109 | 1 Daybydaycrm | 1 Daybyday Crm | 2022-01-08 | 3.5 LOW | 5.4 MEDIUM |
| In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victim’s browser when they open the “/tasks” page to view all the tasks. | |||||
| CVE-2021-43677 | 1 Fluxbb | 1 Fluxbb | 2022-01-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| Fluxbb v1.4.12 is affected by a Cross Site Scripting (XSS) vulnerability. | |||||
| CVE-2022-21649 | 1 Convos | 1 Convos | 2022-01-08 | 3.5 LOW | 5.4 MEDIUM |
| Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> tag. Stored XSS vulnerability using onfocus and autofocus occurs because escaping exists for "<" or ">" but escaping for double quotes does not exist. Through this vulnerability, an attacker is capable to execute malicious scripts. Users are advised to update as soon as possible. | |||||
| CVE-2021-41236 | 1 Oroinc | 1 Oroplatform | 2022-01-08 | 3.5 LOW | 4.8 MEDIUM |
| OroPlatform is a PHP Business Application Platform. In affected versions the email template preview is vulnerable to XSS payload added to email template content. An attacker must have permission to create or edit an email template. For successful payload, execution the attacked user must preview a vulnerable email template. There are no workarounds that address this vulnerability. Users are advised to upgrade as soon as is possible. | |||||
| CVE-2021-43942 | 1 Atlassian | 1 Jira Server And Data Center | 2022-01-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. | |||||
| CVE-2021-46109 | 1 Asus | 1 Rt-ac52u B1 Firmware | 2022-01-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| Invalid input sanitizing leads to reflected Cross Site Scripting (XSS) in ASUS RT-AC52U_B1 3.0.0.4.380.10931 can lead to a user session hijack. | |||||
| CVE-2021-25027 | 1 Ideabox | 1 Powerpack Addons For Elementor | 2022-01-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| The PowerPack Addons for Elementor WordPress plugin before 2.6.2 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting issue | |||||
| CVE-2021-25040 | 1 Booking Calendar Project | 1 Booking Calendar | 2022-01-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Booking Calendar WordPress plugin before 8.9.2 does not sanitise and escape the booking_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2021-25016 | 1 Premio | 2 Chaty, Chaty Pro | 2022-01-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Chaty WordPress plugin before 2.8.3 and Chaty Pro WordPress plugin before 2.8.2 do not sanitise and escape the search parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2021-25001 | 1 Booster | 1 Booster For Woocommerce | 2022-01-08 | 2.6 LOW | 6.1 MEDIUM |
| The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_create_products_xml_result parameter before outputting back in the admin dashboard when the Product XML Feeds module is enabled, leading to a Reflected Cross-Site Scripting issue | |||||
| CVE-2021-25022 | 1 Updraftplus | 1 Updraftplus | 2022-01-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.16.66 does not sanitise and escape the backup_timestamp and job_id parameter before outputting then back in admin pages, leading to Reflected Cross-Site Scripting issues | |||||
| CVE-2021-25000 | 1 Booster | 1 Booster For Woocommerce | 2022-01-08 | 2.6 LOW | 6.1 MEDIUM |
| The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_delete_role parameter before outputting back in the admin dashboard when the General module is enabled, leading to a Reflected Cross-Site Scripting issue | |||||
| CVE-2021-24999 | 1 Booster | 1 Booster For Woocommerce | 2022-01-08 | 2.6 LOW | 6.1 MEDIUM |
| The Booster for WooCommerce WordPress plugin before 5.4.9 does not sanitise and escape the wcj_notice parameter before outputting it back in the admin dashboard when the Pdf Invoicing module is enabled, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2021-24991 | 1 Wpovernight | 1 Woocommerce Pdf Invoices\& Packing Slips | 2022-01-08 | 3.5 LOW | 4.8 MEDIUM |
| The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.10.5 does not escape the tab and section parameters before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting in the admin dashboard | |||||
| CVE-2021-24973 | 1 Geminilabs | 1 Site Reviews | 2022-01-08 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Site Reviews WordPress plugin before 5.17.3 does not sanitise and escape the site-reviews parameter of the glsr_action AJAX action (available to unauthenticated and any authenticated users), allowing them to perform Cross-Site Scripting attacks against logged in admins viewing the Tool dashboard of the plugin | |||||
| CVE-2021-24963 | 1 Litespeedtech | 1 Litespeed Cache | 2022-01-08 | 3.5 LOW | 4.8 MEDIUM |
| The LiteSpeed Cache WordPress plugin before 4.4.4 does not escape the qc_res parameter before outputting it back in the JS code of an admin page, leading to a Reflected Cross-Site Scripting | |||||
| CVE-2021-24964 | 1 Litespeedtech | 1 Litespeed Cache | 2022-01-08 | 2.6 LOW | 6.1 MEDIUM |
| The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users. | |||||
| CVE-2021-46072 | 1 Vehicle Service Management System Project | 1 Vehicle Service Management System | 2022-01-07 | 3.5 LOW | 4.8 MEDIUM |
| A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service List Section in login panel. | |||||
| CVE-2021-46069 | 1 Vehicle Service Management System Project | 1 Vehicle Service Management System | 2022-01-07 | 3.5 LOW | 4.8 MEDIUM |
| A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Mechanic List Section in login panel. | |||||
| CVE-2021-46070 | 1 Vehicle Service Management System Project | 1 Vehicle Service Management System | 2022-01-07 | 3.5 LOW | 4.8 MEDIUM |
| A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the Service Requests Section in login panel. | |||||
| CVE-2021-46068 | 1 Vehicle Service Management System Project | 1 Vehicle Service Management System | 2022-01-07 | 3.5 LOW | 4.8 MEDIUM |
| A Stored Cross Site Scripting (XSS) vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel. | |||||
| CVE-2021-45744 | 1 Bludit | 1 Bludit | 2022-01-07 | 3.5 LOW | 5.4 MEDIUM |
| A Stored Cross Site Scripting (XSS) vulnerability exists in bludit 3.13.1 via the TAGS section in login panel. | |||||
| CVE-2021-45745 | 1 Bludit | 1 Bludit | 2022-01-07 | 3.5 LOW | 5.4 MEDIUM |
| A Stored Cross Site Scripting (XSS) vulnerability exists in Bludit 3.13.1 via the About Plugin in login panel. | |||||
| CVE-2021-24828 | 1 Mlcalc | 1 Mortgage Calculator\/loan Calculator | 2022-01-07 | 3.5 LOW | 5.4 MEDIUM |
| The Mortgage Calculator / Loan Calculator WordPress plugin before 1.5.17 does not escape the some of the attributes of its mlcalc shortcode before outputting them, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks | |||||
| CVE-2021-24680 | 1 Wptravelengine | 1 Wp Travel Engine | 2022-01-07 | 3.5 LOW | 5.4 MEDIUM |
| The WP Travel Engine WordPress plugin before 5.3.1 does not escape the Description field in the Trip Destination/Activities/Trip Type and Pricing Category pages, allowing users with a role as low as editor to perform Stored Cross-Site Scripting attacks, even when the unfiltered_html capability is disallowed | |||||
| CVE-2021-44896 | 1 Dmproadmap Project | 1 Dmproadmap | 2022-01-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| DMP Roadmap before 3.0.4 allows XSS. | |||||
| CVE-2021-43856 | 1 Requarks | 1 Wiki.js | 2022-01-07 | 3.5 LOW | 5.4 MEDIUM |
| Wiki.js is a wiki app built on Node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through non-image file uploads for file types that can be viewed directly inline in the browser. By creating a malicious file which can execute inline JS when viewed in the browser (e.g. XML files), a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the file is viewed directly by other users. The file must be opened directly by the user and will not trigger directly in a normal Wiki.js page. A patch in version 2.5.264 fixes this vulnerability by adding an optional (enabled by default) force download flag to all non-image file types, preventing the file from being viewed inline in the browser. As a workaround, disable file upload for all non-trusted users. --- Thanks to @Haxatron for reporting this vulnerability. Initially reported via https://huntr.dev/bounties/266bff09-00d9-43ca-a4bb-bb540642811f/ | |||||
| CVE-2021-45812 | 1 Nuuo | 2 Nvrsolo, Nvrsolo Firmware | 2022-01-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| NUUO Network Video Recorder NVRsolo 3.9.1 is affected by a Cross Site Scripting (XSS) vulnerability. An attacker can steal the user's session by injecting malicious JavaScript codes which leads to session hijacking. | |||||
| CVE-2021-38680 | 1 Qnap | 1 Kazoo Server | 2022-01-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability has been reported to affect QNAP device running Kazoo Server. If exploited, this vulnerability allows remote attackers to inject malicious code. We have already fixed this vulnerability in the following versions of Kazoo Server: Kazoo Server 4.11.20 and later | |||||
| CVE-2021-43853 | 1 Ajax.net Professional Project | 1 Ajax.net Professional | 2022-01-07 | 3.5 LOW | 5.4 MEDIUM |
| Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious user. The affected core relates to JavaScript object creation when parsing json input. Releases before version 21.12.22.1 are affected. A workaround exists that replaces one of the core JavaScript files embedded in the library. See the GHSA-5q7q-qqw2-hjq7 for workaround details. | |||||
| CVE-2021-4139 | 1 Pimcore | 1 Pimcore | 2022-01-07 | 6.0 MEDIUM | 9.0 CRITICAL |
| pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | |||||
| CVE-2021-45895 | 1 Netgen | 1 Tags Bundle | 2022-01-07 | 4.3 MEDIUM | 6.1 MEDIUM |
| Netgen Tags Bundle 3.4.x before 3.4.11 and 4.0.x before 4.0.15 allows XSS in the Tags Admin interface. | |||||
| CVE-2021-43855 | 1 Requarks | 1 Wiki.js | 2022-01-07 | 3.5 LOW | 5.4 MEDIUM |
| Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the SVG is viewed directly by other users. Scripts do not execute when loaded inside a page via normal `<img>` tags. The malicious SVG can only be uploaded by crafting a custom request to the server with a fake MIME type. A patch in version 2.5.264 fixes this vulnerability by adding an additional file extension verification check to the optional (enabled by default) SVG sanitization step to all file uploads that match the SVG mime type. As a workaround, disable file upload for all non-trusted users. | |||||
| CVE-2021-38961 | 1 Ibm | 6 Power System Ac922 \(8335-gtc\), Power System Ac922 \(8335-gtc\) Firmware, Power System Ac922 \(8335-gtg\) and 3 more | 2022-01-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049. | |||||
| CVE-2021-25993 | 1 Requarks | 1 Wiki.js | 2022-01-06 | 3.5 LOW | 5.4 MEDIUM |
| In Requarks wiki.js, versions 2.0.0-beta.147 to 2.5.255 are affected by Stored XSS vulnerability, where a low privileged (editor) user can upload a SVG file that contains malicious JavaScript while uploading assets in the page. That will send the JWT tokens to the attacker’s server and will lead to account takeover when accessed by the victim. | |||||
| CVE-2021-45903 | 1 Salesagility | 1 Suitecrm | 2022-01-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| A persistent cross-site scripting (XSS) issue in the web interface of SuiteCRM before 7.10.35, and 7.11.x and 7.12.x before 7.12.2, allows a remote attacker to introduce arbitrary JavaScript via attachments upload, a different vulnerability than CVE-2021-39267 and CVE-2021-39268. | |||||
| CVE-2021-45425 | 1 Safarimontage | 1 Safari Montage | 2022-01-06 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reflected Cross Site Scripting (XSS) in SAFARI Montage versions 8.3 and 8.5 allows remote attackers to execute JavaScript codes. | |||||