Total
35462 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-35740 | 1 Dotcms | 1 Dotcms | 2025-05-01 | N/A | 6.1 MEDIUM |
| dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. (This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users.) Some Java application frameworks, including those used by Spring or Tomcat, allow the use of matrix parameters: these are URI parameters separated by semicolons. Through precise semicolon placement in a URI, it is possible to exploit this feature to avoid dotCMS's path-based XSS prevention (such as "require login" filters), and consequently access restricted resources. For example, an attacker could place a semicolon immediately before a / character that separates elements of a filesystem path. This could reveal file content that is ordinarily only visible to signed-in users. This issue can be chained with other exploit code to achieve XSS attacks against dotCMS. | |||||
| CVE-2022-26088 | 1 Bmc | 1 Remedy It Service Management Suite | 2025-05-01 | N/A | 5.4 MEDIUM |
| An issue was discovered in BMC Remedy before 22.1. Email-based Incident Forwarding allows remote authenticated users to inject HTML (such as an SSRF payload) into the Activity Log by placing it in the To: field. This affects rendering that occurs upon a click in the "number of recipients" field. NOTE: the vendor's position is that "no real impact is demonstrated." | |||||
| CVE-2022-46091 | 1 Oretnom23 | 1 Online Flight Booking Management System | 2025-05-01 | N/A | 4.7 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in the feedback form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the airline parameter. | |||||
| CVE-2024-0561 | 1 Inisev | 1 Ultimate Posts Widget | 2025-05-01 | N/A | 5.4 MEDIUM |
| The Ultimate Posts Widget WordPress plugin before 2.3.1 does not validate and escape some of its Widget options before outputting them back in attributes, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2024-1273 | 1 Squirrly | 1 Starbox | 2025-05-01 | N/A | 6.1 MEDIUM |
| The Starbox WordPress plugin before 3.5.0 does not sanitise and escape some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks | |||||
| CVE-2024-37622 | 1 Rockoa | 1 Xinhu | 2025-04-30 | N/A | 6.1 MEDIUM |
| Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the num parameter at /flow/flow.php. | |||||
| CVE-2024-37623 | 1 Rockoa | 1 Xinhu | 2025-04-30 | N/A | 6.1 MEDIUM |
| Xinhu RockOA v2.6.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the /kaoqin/tpl_kaoqin_locationchange.html component. | |||||
| CVE-2024-38470 | 1 Ibarn Project | 1 Ibarn | 2025-04-30 | N/A | 6.1 MEDIUM |
| zhimengzhe iBarn v1.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the $search parameter at /own.php. | |||||
| CVE-2024-4957 | 1 J-breuer | 1 Frontend Checklist | 2025-04-30 | N/A | 4.3 MEDIUM |
| The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2024-4959 | 1 J-breuer | 1 Frontend Checklist | 2025-04-30 | N/A | 4.8 MEDIUM |
| The Frontend Checklist WordPress plugin through 2.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2021-40272 | 1 Op5 | 1 Monitor | 2025-04-30 | N/A | 6.1 MEDIUM |
| OP5 Monitor 8.3.1, 8.3.2, and OP5 8.3.3 are vulnerable to Cross Site Scripting (XSS). | |||||
| CVE-2021-25933 | 1 Opennms | 2 Horizon, Meridian | 2025-04-30 | 3.5 LOW | 4.8 MEDIUM |
| In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting, since the function `validateFormInput()` performs improper validation checks on the input sent to the `groupName` and `groupComment` parameters. Due to this flaw, an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files which can cause severe damage to the organization using opennms. | |||||
| CVE-2021-25929 | 1 Opennms | 2 Horizon, Meridian | 2025-04-30 | 3.5 LOW | 4.8 MEDIUM |
| In OpenNMS Horizon, versions opennms-1-0-stable through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meridian-foundation-2019.1.18-1; meridian-foundation-2020.1.0-1 through meridian-foundation-2020.1.6-1 are vulnerable to Stored Cross-Site Scripting since there is no validation on the input being sent to the `name` parameter in `noticeWizard` endpoint. Due to this flaw an authenticated attacker could inject arbitrary script and trick other admin users into downloading malicious files. | |||||
| CVE-2018-15574 | 1 Reprisesoftware | 1 Reprise License Manager | 2025-04-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in the license editor in Reprise License Manager (RLM) through 12.2BL2. It is a cross-site scripting vulnerability in the /goform/edit_lf_get_data lf parameter via GET or POST. NOTE: the vendor has stated "We do not consider this a vulnerability." | |||||
| CVE-2021-45422 | 1 Reprisesoftware | 1 Reprise License Manager | 2025-04-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability in the /goform/activate_process "count" parameter via GET. No authentication is required. | |||||
| CVE-2022-28364 | 1 Reprisesoftware | 1 Reprise License Manager | 2025-04-30 | 3.5 LOW | 5.4 MEDIUM |
| Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/rlmswitchr_process file parameter via GET. Authentication is required. | |||||
| CVE-2022-28363 | 1 Reprisesoftware | 1 Reprise License Manager | 2025-04-30 | 4.3 MEDIUM | 6.1 MEDIUM |
| Reprise License Manager 14.2 is affected by a reflected cross-site scripting vulnerability (XSS) in the /goform/login_process username parameter via GET. No authentication is required. | |||||
| CVE-2022-30519 | 1 Reprisesoftware | 1 Reprise License Manager | 2025-04-30 | N/A | 6.1 MEDIUM |
| XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password field. | |||||
| CVE-2022-3415 | 1 Bluecoral | 1 Chat Bubble | 2025-04-30 | N/A | 6.1 MEDIUM |
| The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact message | |||||
| CVE-2015-4582 | 1 Thecartpress | 1 Boot Store | 2025-04-30 | N/A | 7.2 HIGH |
| The TheCartPress boot-store (aka Boot Store) theme 1.6.4 for WordPress allows header.php tcp_register_error XSS. NOTE: CVE-2015-4582 is not assigned to any Oracle product. | |||||