Export limit exceeded: 395693 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (49425 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-45387 | 1 Osticket | 1 Osticket | 2025-06-05 | 5.4 Medium |
| osTicket prior to v1.17.6 and v1.18.2 are vulnerable to Broken Access Control Vulnerability in /scp/ajax.php. | ||||
| CVE-2025-3584 | 1 Thenewsletterplugin | 1 Newsletter | 2025-06-05 | 4.8 Medium |
| The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2025-3662 | 1 Colorlib | 1 Fancybox | 2025-06-05 | 6.1 Medium |
| The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher (Marc Montpas) escalated it to an Unauthenticated Stored XSS | ||||
| CVE-2024-39031 | 1 Silverpeas | 1 Silverpeas | 2025-06-05 | 5.4 Medium |
| In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an XSS payload into the "Titre" and "Description" fields when creating an event and then add the administrator or any user to the event. When the invited user (victim) views their own profile, the payload will be executed on their side, even if they do not click on the event. | ||||
| CVE-2023-5942 | 2 Drelton, Medialist | 2 Medialist, Medialist | 2025-06-05 | 5.4 Medium |
| The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2023-2707 | 1 Gappointments | 1 Gappointments | 2025-06-05 | 4.8 Medium |
| The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2023-44383 | 1 Octobercms | 1 October | 2025-06-05 | 5.4 Medium |
| October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG files could create a stored XSS attack against themselves and any other user with access to the media manager when SVG files are supported. This issue has been patched in version 3.5.2. | ||||
| CVE-2024-22725 | 1 Orthanc-server | 1 Orthanc | 2025-06-04 | 6.1 Medium |
| Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability. The vulnerability was present in the server's error reporting. | ||||
| CVE-2024-27186 | 1 Joomla | 1 Joomla\! | 2025-06-04 | 6.1 Medium |
| The mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. | ||||
| CVE-2024-40743 | 1 Joomla | 1 Joomla\! | 2025-06-04 | 6.1 Medium |
| The stripImages and stripIframes methods didn't properly process inputs, leading to XSS vectors. | ||||
| CVE-2024-40745 | 1 Convert Forms Project | 1 Convert Forms | 2025-06-04 | 5.4 Medium |
| Reflected Cross site scripting vulnerability in Convert Forms component for Joomla in versions before 4.4.8. | ||||
| CVE-2024-40747 | 1 Joomla | 1 Joomla\! | 2025-06-04 | 6.1 Medium |
| Various module chromes didn't properly process inputs, leading to XSS vectors. | ||||
| CVE-2024-40748 | 1 Joomla | 1 Joomla\! | 2025-06-04 | 7.5 High |
| Lack of output escaping in the id attribute of menu lists. | ||||
| CVE-2024-10144 | 1 Robosoft | 1 Robo Gallery | 2025-06-04 | 4.8 Medium |
| The Photo Gallery, Images, Slider in Rbs Image Gallery WordPress plugin before 3.2.22 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-10054 | 1 Happyforms | 1 Happyforms | 2025-06-04 | 4.8 Medium |
| The Happyforms WordPress plugin before 1.26.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-10107 | 1 Seedprod | 1 Rafflepress | 2025-06-04 | 4.8 Medium |
| The Giveaways and Contests by RafflePress WordPress plugin before 1.12.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-10145 | 1 Devpups | 1 Social Pug | 2025-06-04 | 4.8 Medium |
| The Hubbub Lite WordPress plugin before 1.34.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2024-10504 | 1 Reputeinfosystems | 1 Arforms | 2025-06-04 | 5.4 Medium |
| The Contact Form, Survey, Quiz & Popup Form Builder WordPress plugin before 1.7.1 does not sanitise and escape some parameters when outputting them in the page, which could allow unauthenticated users to perform Cross-Site Scripting attacks. | ||||
| CVE-2024-11109 | 1 Ljapps | 1 Wp Google Review Slider | 2025-06-04 | 4.8 Medium |
| The WP Google Review Slider WordPress plugin before 15.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2025-4852 | 1 Totolink | 2 A3002r, A3002r Firmware | 2025-06-04 | 2.4 Low |
| A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknown processing of the component VPN Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||