Export limit exceeded: 13278 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 24325 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (24325 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-4787 | 1 Themify | 1 Shortcodes | 2025-03-27 | 5.4 Medium |
| Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. | ||||
| CVE-2016-15022 | 1 Cimage | 1 Cimage | 2025-03-27 | 2 Low |
| A vulnerability was found in mosbth cimage up to 0.7.18. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file check_system.php. The manipulation of the argument $_SERVER['SERVER_SOFTWARE'] leads to cross site scripting. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.7.19 is able to address this issue. The patch is named 401478c8393989836beeddfeac5ce44570af162b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-219715. | ||||
| CVE-2022-47698 | 1 Comfast Project | 2 Cf-wr623n, Cf-wr623n Firmware | 2025-03-27 | 6.1 Medium |
| COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS) via the URL filtering feature in the router. | ||||
| CVE-2022-45598 | 1 Joplin Project | 1 Joplin | 2025-03-27 | 6.1 Medium |
| Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization. | ||||
| CVE-2022-25979 | 1 Jsuites | 1 Jsuites | 2025-03-27 | 5.4 Medium |
| Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Editor() function. | ||||
| CVE-2022-4651 | 1 Justified Gallery Project | 1 Justified Gallery | 2025-03-27 | 5.4 Medium |
| The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. | ||||
| CVE-2022-46934 | 1 Keking | 1 Kkfileview | 2025-03-27 | 6.1 Medium |
| kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java. | ||||
| CVE-2023-23132 | 1 Selfwealth | 1 Selfwealth | 2025-03-27 | 7.5 High |
| Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. The application reveals hardcoded API keys. | ||||
| CVE-2023-23078 | 1 Zohocorp | 1 Manageengine Servicedesk Plus | 2025-03-27 | 6.1 Medium |
| Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the Assets. | ||||
| CVE-2023-23075 | 1 Zohocorp | 1 Manageengine Assetexplorer | 2025-03-27 | 6.1 Medium |
| Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation. | ||||
| CVE-2023-23073 | 1 Zohocorp | 1 Manageengine Servicedesk Plus | 2025-03-27 | 6.1 Medium |
| Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component. | ||||
| CVE-2022-4898 | 1 Octopus | 1 Octopus Server | 2025-03-27 | 5.4 Medium |
| In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS | ||||
| CVE-2022-47701 | 1 Comfast Project | 2 Cf-wr623n, Cf-wr623n Firmware | 2025-03-27 | 6.1 Medium |
| COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS). | ||||
| CVE-2022-44897 | 1 Apollotheme | 1 Ap Pagebuilder | 2025-03-27 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the show_number parameter. | ||||
| CVE-2023-0606 | 1 Ampache | 1 Ampache | 2025-03-27 | 6.1 Medium |
| Cross-site Scripting (XSS) - Reflected in GitHub repository ampache/ampache prior to 5.5.7. | ||||
| CVE-2023-0607 | 1 Projectsend | 1 Projectsend | 2025-03-27 | 4.8 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606. | ||||
| CVE-2023-0608 | 1 Microweber | 1 Microweber | 2025-03-26 | 5.4 Medium |
| Cross-site Scripting (XSS) - DOM in GitHub repository microweber/microweber prior to 1.3.2. | ||||
| CVE-2022-48113 | 1 Totolink | 2 N200re-v5, N200re-v5 Firmware | 2025-03-26 | 9.8 Critical |
| A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials. | ||||
| CVE-2023-24147 | 1 Totolink | 2 Ca300-poe, Ca300-poe Firmware | 2025-03-26 | 7.5 High |
| TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/config/product.ini. | ||||
| CVE-2023-23636 | 1 Jellyfin | 1 Jellyfin | 2025-03-26 | 5.4 Medium |
| In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS. This allows an attacker to steal access tokens from the localStorage of the victim. | ||||