Total
36451 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-0746 | 2025-01-30 | N/A | 6.1 MEDIUM | ||
| A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to craft a malicious URL leveraging the"/embedai/users/show/<SCRIPT>" endpoint to inject the malicious JavaScript code. This JavaScript code will be executed when a user opens the malicious URL. | |||||
| CVE-2024-12524 | 2025-01-30 | N/A | 6.4 MEDIUM | ||
| The Clinked Client Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'clinked-login-button' shortcode in all versions up to, and including, 1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-12921 | 2025-01-30 | N/A | 6.4 MEDIUM | ||
| The EthereumICO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ethereum-ico shortcode in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-24744 | 1 Rediker | 1 Adminplus | 2025-01-29 | N/A | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in Rediker Software AdminPlus 6.1.91.00 allows remote attackers to run arbitrary code via the onload function within the application DOM. | |||||
| CVE-2024-2619 | 1 Brainstormforce | 1 Elementor Header \& Footer Builder | 2025-01-29 | N/A | 5.0 MEDIUM |
| The Elementor Header & Footer Builder for WordPress is vulnerable to HTML Injection in all versions up to, and including, 1.6.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level permissions and above, to inject arbitrary HTML in pages that will be shown whenever a user accesses an injected page. | |||||
| CVE-2024-3134 | 1 Master-addons | 1 Master Addons | 2025-01-29 | N/A | 6.4 MEDIUM |
| The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title_html_tag attribute in all versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-22359 | 1 Ibm | 2 Devops Deploy, Urbancode Deploy | 2025-01-29 | N/A | 6.1 MEDIUM |
| IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.20, 7.1 through 7.1.2.16, 7.2 through 7.2.3.9, 7.3 through 7.3.2.4 and IBM DevOps Deploy 8.0 through 8.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 280897. | |||||
| CVE-2023-31799 | 1 Chamilo | 1 Chamilo Lms | 2025-01-29 | N/A | 4.8 MEDIUM |
| Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the system annnouncements parameter. | |||||
| CVE-2023-30334 | 1 Asmbb Project | 1 Asmbb | 2025-01-29 | N/A | 6.1 MEDIUM |
| AsmBB v2.9.1 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the MiniMag.asm and bbcode.asm libraries. | |||||
| CVE-2023-30184 | 1 Typecho | 1 Typecho | 2025-01-29 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in Typecho v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter at /index.php/archives/1/comment. | |||||
| CVE-2023-30097 | 1 Totaljs | 1 Messenger | 2025-01-29 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the private task field. | |||||
| CVE-2023-30096 | 1 Totaljs | 1 Messenger | 2025-01-29 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user information field. | |||||
| CVE-2023-30095 | 1 Totaljs | 1 Messenger | 2025-01-29 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in TotalJS messenger commit b6cf1c9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the channel description field. | |||||
| CVE-2023-30094 | 1 Totaljs | 1 Flow | 2025-01-29 | N/A | 5.4 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in TotalJS Flow v10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the platform name field in the settings module. | |||||
| CVE-2023-30093 | 1 Onosproject | 1 Onos | 2025-01-29 | N/A | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the url parameter of the API documentation dashboard. | |||||
| CVE-2023-27075 | 1 Microbin | 1 Microbin | 2025-01-29 | N/A | 5.4 MEDIUM |
| A cross-site scripting vulnerability (XSS) in the component microbin/src/pasta.rs of Microbin v1.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. | |||||
| CVE-2020-35241 | 1 Flatpress | 1 Flatpress | 2025-01-29 | 3.5 LOW | 4.8 MEDIUM |
| FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie according to the crafted payload. | |||||
| CVE-2024-11230 | 1 Brainstormforce | 1 Elementor Header \& Footer Builder | 2025-01-29 | N/A | 6.4 MEDIUM |
| The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘size’ parameter in all versions up to, and including, 1.6.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-31803 | 1 Chamilo | 1 Chamilo Lms | 2025-01-29 | N/A | 4.8 MEDIUM |
| Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the resource sequencing parameters. | |||||
| CVE-2023-31802 | 1 Chamilo | 1 Chamilo Lms | 2025-01-29 | N/A | 5.4 MEDIUM |
| Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skype and linedin_url parameters. | |||||