Export limit exceeded: 372093 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47766 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-25960 | 1 Phpcms | 1 Phpcms | 2025-04-22 | 6.1 Medium |
| Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the background administrator. | ||||
| CVE-2022-45028 | 1 Arris | 2 Nvg443b, Nvg443b Firmware | 2025-04-22 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request sent to /cgi-bin/logs.ha. | ||||
| CVE-2022-44575 | 1 Siemens | 1 Plm Help Server | 2025-04-22 | 6.1 Medium |
| A vulnerability has been identified in PLM Help Server V4.2 (All versions). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected application that could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link. | ||||
| CVE-2022-46350 | 1 Siemens | 10 6gk5204-0ba00-2kb2, 6gk5204-0ba00-2kb2 Firmware, 6gk5204-0ba00-2mb2 and 7 more | 2025-04-22 | 6.1 Medium |
| A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. This can be used by an attacker to trigger a malicious request on the affected device. | ||||
| CVE-2022-46073 | 1 Helmet Store Showroom Project | 1 Helmet Store Showroom | 2025-04-22 | 6.1 Medium |
| Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS). | ||||
| CVE-2020-9419 | 1 Arcadyan | 2 Vrv9506jac23, Vrv9506jac23 Firmware | 2025-04-22 | 5.4 Medium |
| Multiple stored cross-site scripting (XSS) vulnerabilities in Arcadyan Wifi routers VRV9506JAC23 allow remote attackers to inject arbitrary web script or HTML via the hostName and domain_name parameters present in the LAN configuration section of the administrative dashboard. | ||||
| CVE-2025-0448 | 1 Google | 1 Chrome | 2025-04-21 | 4.3 Medium |
| Inappropriate implementation in Compositing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2025-0447 | 1 Google | 1 Chrome | 2025-04-21 | 8.8 High |
| Inappropriate implementation in Navigation in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2025-0443 | 1 Google | 1 Chrome | 2025-04-21 | 8.8 High |
| Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2020-36607 | 1 Feehi | 1 Feehicms | 2025-04-21 | 6.1 Medium |
| Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag. | ||||
| CVE-2020-20589 | 1 Feehi | 1 Feehicms | 2025-04-21 | 6.1 Medium |
| Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.0.8 allows remote attackers to run arbitrary code via tha lang attribute of an html tag. | ||||
| CVE-2021-39428 | 1 Eyoucms | 1 Eyoucms | 2025-04-21 | 5.4 Medium |
| Cross Site Scripting (XSS) vulnerability in Users.php in eyoucms 1.5.4 allows remote attackers to run arbitrary code and gain escalated privilege via the filename for edit_users_head_pic. | ||||
| CVE-2021-39427 | 1 Vtimecn | 1 188jianzhan | 2025-04-21 | 5.4 Medium |
| Cross site scripting vulnerability in 188Jianzhan 2.10 allows attackers to execute arbitrary code via the username parameter to /admin/reg.php. | ||||
| CVE-2021-36573 | 1 Feehi | 1 Feehicms | 2025-04-21 | 5.4 Medium |
| File Upload vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via crafted image upload. | ||||
| CVE-2021-36572 | 1 Feehi | 1 Feehicms | 2025-04-21 | 6.1 Medium |
| Cross Site Scripting (XSS) vulnerability in Feehi CMS thru 2.1.1 allows attackers to run arbitrary code via the user name field of the login page. | ||||
| CVE-2025-29015 | 1 Codeastro | 1 Internet Banking System | 2025-04-21 | 6.1 Medium |
| Code Astro Internet Banking System 2.0.0 is vulnerable to Cross Site Scripting (XSS) via the name parameter in /admin/pages_account.php. | ||||
| CVE-2022-40004 | 1 Thingsboard | 1 Thingsboard | 2025-04-21 | 9.6 Critical |
| Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log. | ||||
| CVE-2024-56409 | 1 Phpoffice | 1 Phpspreadsheet | 2025-04-21 | 5.4 Medium |
| PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to unauthorized reflected cross-site scripting in the `Currency.php` file. Using the `/vendor/phpoffice/phpspreadsheet/samples/Wizards/NumberFormat/Currency.php` script, an attacker can perform a cross-site scripting attack. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue. | ||||
| CVE-2024-12717 | 1 Aklamator | 1 Infeed | 2025-04-21 | 4.8 Medium |
| The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-12731 | 1 Aklamator | 1 Infeed | 2025-04-21 | 6.1 Medium |
| The Aklamator INfeed WordPress plugin through 2.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||