Total
45368 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-21732 | 1 Rukovoditel | 1 Rukovoditel | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Rukovoditel Project Management app 2.6 is affected by: Cross Site Scripting (XSS). An attacker can add JavaScript code to the filename. | |||||
| CVE-2020-21731 | 1 Gazie Project | 1 Gazie | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Gazie 7.29 is affected by: Cross Site Scripting (XSS) via http://192.168.100.7/gazie/modules/config/admin_utente.php?user_name=amministratore&Update. An attacker can inject JavaScript code, and the webapplication stores the injected code. | |||||
| CVE-2020-21517 | 1 Metinfo | 1 Metinfo | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in MetInfo 7.0.0 via the gourl parameter in login.php. | |||||
| CVE-2020-21228 | 1 Jizhicms | 1 Jizhicms | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| JIZHICMS 1.5.1 contains a cross-site scripting (XSS) vulnerability in the component /user/release.html, which allows attackers to arbitrarily add an administrator cookie. | |||||
| CVE-2020-21161 | 1 Ruckuswireless | 2 Zonedirector, Zonedirector Firmware | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Ruckus Wireless ZoneDirector 9.8.3.0. | |||||
| CVE-2020-20584 | 1 Baigo | 1 Baigo Cms | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross site scripting vulnerability in baigo CMS v4.0-beta-1 allows attackers to execute arbitrary web scripts or HTML via the form parameter post to /public/console/profile/info-submit/. | |||||
| CVE-2020-20426 | 1 S-cms | 1 S-cms | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in /function/booksave.php. | |||||
| CVE-2020-20425 | 1 S-cms | 1 S-cms | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| S-CMS Government Station Building System v5.0 contains a cross-site scripting (XSS) vulnerability in the search function. | |||||
| CVE-2020-20363 | 1 Pbootcms | 1 Pbootcms | 2026-07-09 | 3.5 LOW | 4.8 MEDIUM |
| Crossi Site Scripting (XSS) vulnerability in PbootCMS 2.0.3 in admin.php. | |||||
| CVE-2020-20345 | 1 Wtcms Project | 1 Wtcms | 2026-07-09 | 3.5 LOW | 5.4 MEDIUM |
| WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows attackers to obtain cookies via a crafted payload entered into the search box. | |||||
| CVE-2020-19611 | 1 Racktables Project | 1 Racktables | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) in redirect module of Racktables version 0.21.2, allows an attacker to inject arbitrary web script or HTML via the op parameter. | |||||
| CVE-2020-18325 | 1 Intelliants | 1 Subrion Cms | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Multilple Cross Site Scripting (XSS) vulnerability exists in Intelliants Subrion CMS v4.2.1 in the Configuration panel. | |||||
| CVE-2020-18324 | 1 Intelliants | 1 Subrion Cms | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability exists in Subrion CMS 4.2.1 via the q parameter in the Kickstart template. | |||||
| CVE-2018-10228 | 1 Limesurvey | 1 Limesurvey | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inject arbitrary web script or HTML via the changes_cp parameter to the index.php/admin/themes/sa/templatesavechanges URI. | |||||
| CVE-2017-17678 | 1 Bmc | 1 Remedy Mid-tier | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| BMC Remedy Mid Tier 9.1SP3 is affected by cross-site scripting (XSS). A DOM-based cross-site scripting vulnerability was discovered in a legacy utility. | |||||
| CVE-2017-15682 | 1 Craftercms | 1 Crafter Cms | 2026-07-09 | 4.3 MEDIUM | 6.1 MEDIUM |
| In Crafter CMS Crafter Studio 3.0.1 an unauthenticated attacker is able to inject malicious JavaScript code resulting in a stored/blind XSS in the admin panel. | |||||
| CVE-2026-53641 | 2026-07-08 | N/A | N/A | ||
| FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email HTML content (`content_html`) is rendered into a JavaScript template literal using the `|raw` filter, bypassing all output escaping. An attacker with admin access can inject malicious JavaScript payloads into email content that execute in the browser of any client who views their email history. Version 0.8.0 contains a fix. Some workarounds are available. Restrict admin account access, audit email content in the database for suspicious payloads, and/or monitor client accounts for unusual activity. | |||||
| CVE-2026-50740 | 1 Revive-adserver | 1 Revive Adserver | 2026-07-08 | N/A | 5.4 MEDIUM |
| A missing sanitisation vulnerability of user input in the zone-include.php script exists in Revive Adserver 6.0.7 and earlier. A low‑privileged user could exploit the refresh parameter of the iFrame invocation tag to perform reflected XSS attacks. | |||||
| CVE-2026-41122 | 1 Dell | 1 Data Domain Operating System | 2026-07-08 | N/A | 7.1 HIGH |
| Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain a stored cross-site scripting vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability. Exploitation may lead to information disclosure, session theft, or client-side request forgery. | |||||
| CVE-2026-55437 | 1 Coder | 1 Coder | 2026-07-08 | N/A | 5.4 MEDIUM |
| Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2, the `AgentLogLine` dashboard component instantiated `ansi-to-html` without `escapeXML: true` and inserted the result via `dangerouslySetInnerHTML` so HTML embedded in workspace agent log lines was rendered as live markup. Server-side sanitization did not neutralize HTML metacharacters. Exploitation requires a victim to view attacker-controlled agent logs in the dashboard. The fix in versions 2.29.17, 2.32.7, 2.33.8, and 2.34.2 enables `escapeXML: true` so HTML metacharacters are escaped before DOM insertion. No known workarounds are available. | |||||