Total
36451 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-31801 | 1 Chamilo | 1 Chamilo Lms | 2025-01-29 | N/A | 6.1 MEDIUM |
| Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the skills wheel parameter. | |||||
| CVE-2023-31800 | 1 Chamilo | 1 Chamilo Lms | 2025-01-29 | N/A | 5.4 MEDIUM |
| Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via the forum title parameter. | |||||
| CVE-2024-8960 | 1 Codeless | 1 Cowidgets Elementor Addons | 2025-01-29 | N/A | 6.4 MEDIUM |
| The Cowidgets – Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. | |||||
| CVE-2023-31807 | 1 Chamilo | 1 Chamilo Lms | 2025-01-29 | N/A | 5.4 MEDIUM |
| Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the personal notes function. | |||||
| CVE-2023-31806 | 1 Chamilo | 1 Chamilo Lms | 2025-01-29 | N/A | 5.4 MEDIUM |
| Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local attacker to execute arbitrary code via a crafted payload to the My Progress function. | |||||
| CVE-2023-31805 | 1 Chamilo | 1 Chamilo Lms | 2025-01-29 | N/A | 4.8 MEDIUM |
| Cross Site Scripting vulnerability found in Chamilo Lms v.1.11.18 allows a local authenticated attacker to execute arbitrary code via the homepage function. | |||||
| CVE-2024-4484 | 1 Posimyth | 1 The Plus Addons For Elementor | 2025-01-29 | N/A | 6.4 MEDIUM |
| The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘xai_username’ parameter in versions up to, and including, 5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-4485 | 1 Posimyth | 1 The Plus Addons For Elementor | 2025-01-29 | N/A | 6.4 MEDIUM |
| The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_custom_attributes’ parameter in versions up to, and including, 5.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-0653 | 1 Wpgogo | 1 Custom Field Template | 2025-01-29 | N/A | 4.4 MEDIUM |
| The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. | |||||
| CVE-2024-5341 | 1 Posimyth | 1 The Plus Addons For Elementor | 2025-01-29 | N/A | 6.4 MEDIUM |
| The The Plus Addons for Elementor Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' attribute of the Heading Title widget in all versions up to, and including, 5.5.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-4983 | 1 Posimyth | 1 The Plus Addons For Elementor | 2025-01-29 | N/A | 6.4 MEDIUM |
| The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘video_color’ parameter in all versions up to, and including, 5.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2024-0627 | 1 Wpgogo | 1 Custom Field Template | 2025-01-29 | N/A | 6.4 MEDIUM |
| The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom field name column in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied custom fields. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-6745 | 1 Wpgogo | 1 Custom Field Template | 2025-01-29 | N/A | 6.4 MEDIUM |
| The Custom Field Template plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cpt' shortcode in all versions up to, and including, 2.6.1 due to insufficient input sanitization and output escaping on user supplied post meta. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-30619 | 1 Enalean | 1 Tuleap | 2025-01-29 | N/A | 5.4 MEDIUM |
| Tuleap Open ALM is a Libre and Open Source tool for end to end traceability of application and system developments. The title of an artifact is not properly escaped in the tooltip. A malicious user with the capability to create an artifact or to edit a field title could force victim to execute uncontrolled code. This issue has been patched in version 14.7.99.143. | |||||
| CVE-2023-2521 | 1 Ez-net | 2 Next-7004n, Next-7004n Firmware | 2025-01-29 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability was found in NEXTU NEXT-7004N 3.0.1. It has been classified as problematic. Affected is an unknown function of the file /boafrm/formFilter of the component POST Request Handler. The manipulation of the argument url with the input <svg onload=alert(1337)> leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-228012. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2023-23470 | 1 Ibm | 1 I | 2025-01-29 | N/A | 6.4 MEDIUM |
| IBM i 7.2, 7.3, 7.4, and 7.5 could allow an authenticated privileged administrator to gain elevated privileges in non-default configurations, as a result of improper SQL processing. By using a specially crafted SQL operation, the administrator could exploit the vulnerability to perform additional administrator operations. IBM X-Force ID: 244510. | |||||
| CVE-2023-1094 | 1 Monicahq | 1 Monica | 2025-01-29 | N/A | 8.8 HIGH |
| MonicaHQ version 4.0.0 allows an authenticated remote attacker to execute malicious code in the application via CSTI in the `people:id/food` endpoint and food parameter. | |||||
| CVE-2020-19660 | 1 Ipandao | 1 Editor.md | 2025-01-29 | N/A | 6.1 MEDIUM |
| Cross Site Scripting (XSS) pandao editor.md 1.5.0 allows attackers to execute arbitrary code via crafted linked url values. | |||||
| CVE-2020-18282 | 1 5none | 1 Nonecms | 2025-01-29 | N/A | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in NoneCms 1.3.0 allows remote attackers to inject arbitrary web script or HTML via feedback feature. | |||||
| CVE-2020-18132 | 1 Mipcms | 1 Mipcms | 2025-01-29 | N/A | 4.8 MEDIUM |
| Cross Site Scripting (XSS) vulnerability in MIPCMS 3.6.0 allows attackers to execute arbitrary code via the category name field to categoryEdit. | |||||