Export limit exceeded: 370450 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47649 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-28070 | 1 Mitel | 1 Micontact Center Business | 2025-06-02 | 6.8 Medium |
| A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. A successful exploit could allow an attacker to access sensitive information and gain unauthorized access. | ||||
| CVE-2024-26468 | 1 Jstrieb | 1 Url Pages | 2025-06-02 | 6.1 Medium |
| A DOM based cross-site scripting (XSS) vulnerability in the component index.html of jstrieb/urlpages before commit 035b647 allows attackers to execute arbitrary Javascript via sending a crafted URL. | ||||
| CVE-2024-26467 | 1 Tabatkins | 1 Railroad-diagram Generator | 2025-06-02 | 6.1 Medium |
| A DOM based cross-site scripting (XSS) vulnerability in the component generator.html of tabatkins/railroad-diagrams before commit ea9a123 allows attackers to execute arbitrary Javascript via sending a crafted URL. | ||||
| CVE-2024-22569 | 1 Poscms | 1 Poscms | 2025-05-30 | 5.4 Medium |
| Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index.php?c=install&m=index&step=2&is_install_db=0. | ||||
| CVE-2024-6487 | 1 Data443 | 1 Inline Related Posts | 2025-05-30 | 5.9 Medium |
| The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-6021 | 1 Bharatkambariya | 1 Donation Block For Paypal | 2025-05-30 | 6.8 Medium |
| The Donation Block For PayPal WordPress plugin through 2.1.0 does not sanitise and escape form submissions, leading to a stored cross-site scripting vulnerability | ||||
| CVE-2024-3113 | 1 Devsabbirahmed | 1 Simple Form | 2025-05-30 | 5.9 Medium |
| The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-36782 | 1 Totolink | 2 Cp300, Cp300 Firmware | 2025-05-30 | 9.8 Critical |
| TOTOLINK CP300 V2.0.4-B20201102 was discovered to contain a hardcoded password vulnerability in /etc/shadow.sample, which allows attackers to log in as root. | ||||
| CVE-2024-34000 | 1 Moodle | 1 Moodle | 2025-05-30 | 4.3 Medium |
| ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk. | ||||
| CVE-2024-33998 | 1 Moodle | 1 Moodle | 2025-05-30 | 5.4 Medium |
| Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features. | ||||
| CVE-2024-33997 | 1 Moodle | 1 Moodle | 2025-05-30 | 6.1 Medium |
| Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation. | ||||
| CVE-2023-41103 | 1 Interactsoftware | 1 Interact | 2025-05-30 | 5.4 Medium |
| Interact 7.9.79.5 allows stored Cross-site Scripting (XSS) attacks in several locations, allowing an attacker to store a JavaScript payload. | ||||
| CVE-2023-35792 | 1 Vound-software | 1 Intella Connect | 2025-05-30 | 5.4 Medium |
| Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS). | ||||
| CVE-2023-31223 | 1 Dradisframework | 1 Dradis | 2025-05-30 | 8.7 High |
| Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars. | ||||
| CVE-2022-38481 | 1 Mega | 1 Hopex | 2025-05-30 | 6.1 Medium |
| An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several features. | ||||
| CVE-2022-37028 | 1 Iris | 1 Isams | 2025-05-30 | 5.4 Medium |
| ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScript payload that will be executed when another user uses the application. | ||||
| CVE-2022-29931 | 1 Raytion | 1 Custom Security Manager | 2025-05-30 | 6.1 Medium |
| The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XSS). | ||||
| CVE-2022-24967 | 1 Blackrainbow | 1 Nimbus | 2025-05-30 | 6.5 Medium |
| Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting (XSS). | ||||
| CVE-2021-41320 | 1 Iongroup | 1 Wallstreet Suite | 2025-05-30 | 5.5 Medium |
| A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authenticated user. NOTE: the vendor disputes this because the password is not hardcoded (it can be changed during installation or at any later time). | ||||
| CVE-2019-7161 | 1 Zohocorp | 1 Manageengine Adselfservice Plus | 2025-05-30 | N/A |
| An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data. | ||||