CWE-79

BigBlueButton is an open source web conferencing system. Users in meetings with private chat enabled are vulnerable to a

BigBlueButton is an open source web conferencing system. In affected versions an attacker can embed malicious JS in thei

In Nagios XI through 5.8.5, in the schedule report function, an authenticated attacker is able to inject HTML tags that

Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In versions prior

Reflected Cross Site Scripting (XSS) vulnerabilities in AST Agent Time Sheet interface (/vicidial/AST_agent_time_sheet.p

Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management i

insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this

insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that

Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convince

AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter calle

A correctness issue in the JIT was addressed with improved checks. This issue is fixed in tvOS 16.1, iOS 15.7.1 and iPad

Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to in

Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on W

Malicious websites could have confused Firefox into showing the wrong origin when asking to launch a program and handlin

Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. Th

An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so by

Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seein

The WHMCS Bridge WordPress plugin is vulnerable to Stored Cross-Site Scripting via the cc_whmcs_bridge_url parameter fou

The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site

The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log co

The Child Theme Generator WordPress plugin through 2.2.7 does not sanitise escape the parade parameter before outputting

The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and s

The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it

Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0.

The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured o

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter

In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in xss_clean() in class/KippoInput.cl

In kippo-graph before version 1.5.1, there is a cross-site scripting vulnerability in $file_link in class/KippoInput.cla

The Simple SEO plugin for WordPress is vulnerable to attribute-based stored Cross-Site Scripting in versions up to, and

The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Bloc

The Simple Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `pro_version_activation_code

The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caption

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption'

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Edi

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Image UR

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media Image U

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Video Link values

The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Descr

A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 1

In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin <= 2.2

The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malici

The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters sav

The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipula

Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5.

The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and incl

An authenticated user can create a hosts group from the configuration with XSS payload, which will be available for othe