Total
36737 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-5032 | 1 Toolstack | 1 Sully | 2025-05-02 | N/A | 4.7 MEDIUM |
| The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |||||
| CVE-2024-5074 | 1 Tipsandtricks-hq | 1 Wp Emember | 2025-05-02 | N/A | 5.4 MEDIUM |
| The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |||||
| CVE-2022-3462 | 1 Highlight Focus Project | 1 Highlight Focus | 2025-05-01 | N/A | 4.8 MEDIUM |
| The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-3265 | 1 Gitlab | 1 Gitlab | 2025-05-01 | N/A | 7.3 HIGH |
| A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. | |||||
| CVE-2024-37384 | 2 Debian, Roundcube | 2 Debian Linux, Webmail | 2025-05-01 | N/A | 6.1 MEDIUM |
| Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences. | |||||
| CVE-2024-4621 | 1 Reputeinfosystems | 1 Arforms | 2025-05-01 | N/A | 4.8 MEDIUM |
| The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2024-4934 | 1 Expresstech | 1 Quiz And Survey Master | 2025-05-01 | N/A | 5.5 MEDIUM |
| The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2024-6130 | 1 10web | 1 Form Maker | 2025-05-01 | N/A | 4.8 MEDIUM |
| The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2022-43144 | 1 Canteen Management System Project | 1 Canteen Management System | 2025-05-01 | N/A | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | |||||
| CVE-2022-41434 | 1 Eyesofnetwork | 1 Web Interface | 2025-05-01 | N/A | 6.1 MEDIUM |
| EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /lilac/main.php. | |||||
| CVE-2022-41433 | 1 Eyesofnetwork | 1 Web Interface | 2025-05-01 | N/A | 4.8 MEDIUM |
| EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/admin_bp/add_application.php. | |||||
| CVE-2022-41432 | 1 Eyesofnetwork | 1 Web Interface | 2025-05-01 | N/A | 4.8 MEDIUM |
| EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/report_event/index.php. | |||||
| CVE-2021-40289 | 1 Mm-wki Project | 1 Mm-wki | 2025-05-01 | N/A | 6.1 MEDIUM |
| mm-wki v0.2.1 is vulnerable to Cross Site Scripting (XSS). | |||||
| CVE-2023-4148 | 1 Metaphorcreations | 1 Ditty | 2025-05-01 | N/A | 6.1 MEDIUM |
| The Ditty WordPress plugin before 3.1.25 does not sanitise and escape some parameters and generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | |||||
| CVE-2022-43321 | 1 Shopwind | 1 Shopwind | 2025-05-01 | N/A | 6.1 MEDIUM |
| Shopwind v3.4.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the component /common/library/Page.php. | |||||
| CVE-2022-43320 | 1 Feehi | 1 Feehicms | 2025-05-01 | N/A | 6.1 MEDIUM |
| FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer. | |||||
| CVE-2022-43121 | 1 Intelliants | 1 Subrion Cms | 2025-05-01 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tooltip text field. | |||||
| CVE-2022-43118 | 1 Flatcore | 1 Flatcore-cms | 2025-05-01 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username text field. | |||||
| CVE-2022-31688 | 1 Vmware | 1 Workspace One Assist | 2025-05-01 | N/A | 6.1 MEDIUM |
| VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window. | |||||
| CVE-2021-40303 | 1 Perfexcrm | 1 Perfex Crm | 2025-05-01 | N/A | 5.4 MEDIUM |
| perfex crm 1.10 is vulnerable to Cross Site Scripting (XSS) via /clients/profile. | |||||