CWE-79

Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/ma

Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v

A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute

layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.

IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in th

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA WHA Puzzle plugin <= 1.0.9 versions.

In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage

ARC (aka ARC2) through 2011-12-01 allows reflected XSS via the end_point.php query parameter in an output=htmltab action

An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall

Meldekarten generator is an open source project to create a program, running locally in the browser without the need for

There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading,

All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to

In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potential

Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all

There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An a

Stored cross-site scripting vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a

A Cross-site scripting (XSS) vulnerability in the System Log/General Log page of the administrator web UI in ASUS RT-AC5

Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a cr

A cross-site scripting (XSS) vulnerability in the CGI program of the Zyxel ATP series firmware versions 5.10 through 5.3

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Supersoju Block Referer Spam plugin <= 1.1.9.4 version

Discourse Mermaid (discourse-mermaid-theme-component) allows users of Discourse, open-source forum software, to create g

Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. Thi

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This

Pimcore Admin Classic Bundle provides a Backend UI for Pimcore based on the ExtJS framework. An admin who has not setup

The Groundhogg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gh_form' shortcode in versions

The Metform Elementor Contact Form Builder for WordPress is vulnerable to Cross-Site Scripting by using the 'fname' attr

The CHP Ads Block Detector plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings reachabl

The Delete Me plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'plugin_delete_me' shortcode in vers

PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. A user with the RA Administrator role can

An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS).

The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow hi

Auth. Stored Cross-Site Scripting (XSS) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions.

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugi

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, re

Cross-site Scripting (XSS) - Stored in GitHub repository projectsend/projectsend prior to r1606.

A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.

An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importi

A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows

A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of In

A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inven

A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of

A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventor

PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Stored Cross-site Scripting Vulnerabilit

Cross-site Scripting (XSS) - Reflected in GitHub repository modoboa/modoboa prior to 2.0.5.

Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a

The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow hi

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.

An issue was discovered in Online Reviewer Management System v1.0. There is a XSS vulnerability via reviewer_0/admins/as

Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a