CWE-79

The redirect URI in the LTI authorization endpoint required extra sanitizing to prevent reflected XSS and open redirect

A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the (1) pageSize and (2) pageNo param

Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.

XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.

phpLiteAdmin through 1.9.8.2 allows XSS via the index.php newRows parameter (aka num or number).

The Persian Woocommerce WordPress plugin through 5.8.0 does not escape the s parameter before outputting it back in an a

The IDPay for Contact Form 7 WordPress plugin through 2.1.2 does not sanitise and escape the idpay_error parameter befor

The MOLIE WordPress plugin through 0.5 does not escape the course_id parameter before outputting it back in the admin da

The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outpu

The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it

The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outpu

The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact for

The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting i

The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter b

The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_s

The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in so

The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s paramete

The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter be

The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos par

Sylius is an open source eCommerce platform. In versions prior to 1.9.10, 1.10.11, and 1.11.2, it is possible to upload

File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.

HMS v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via treatmentrecord.php.

Cross-site Scripting (XSS) vulnerability in ArchivistaBox webclient allows an attacker to craft a malicious link, execut

Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.

A cross-site scripting vulnerability is present in Xbtit 3.1. The stored XSS vulnerability occurs because /ajaxchat/send

An issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by defau

TMS v2.28.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /TMS/admin/setting/mai

HexoEditor 1.1.8 is affected by Cross Site Scripting (XSS). By putting a common XSS payload in a markdown file, if opene

The SEO Plugin by Squirrly SEO WordPress plugin before 11.1.12 does not escape the type parameter before outputting it b

The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in a

The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it bac

The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputt

A Cross Site Scripting (XSS) vulnerabililty exists in enhanced-github v5.0.11 via the file name parameter.

Money Transfer Management System Version 1.0 allows an attacker to inject JavaScript code in the URL and then trick a us

Passwork On-Premise Edition before 4.6.13 has multiple XSS issues.

Multiple cross-site scripting (XSS) vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitr

phpIPAM 1.4.4 allows Reflected XSS and CSRF via app/admin/subnets/find_free_section_subnets.php of the subnets functiona

Yonyou u8 v13.0 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability via the component /u8sl/W

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.

Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/a

Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/plog/index

Maccms v10 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities in /admin.php/admin/w

Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/ulog/index

Maccms v10 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in /admin.php/admin/vod/data.h

libkiwix 10.0.0 and 10.0.1 allows XSS in the built-in webserver functionality via the search suggestions URL parameter.

CheckMK Raw Edition software (versions 1.5.0 to 1.6.0) does not sanitise the input of a web service parameter that is in

OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat.

OX App Suite through 7.10.5 allows XSS via an HTML 5 element such as AUDIO.

OX App Suite through 7.10.5 allows XSS via NIFF (Notation Interchange File Format) data.

OX App Suite through 7.10.5 allows XSS via a trailing control character such as the SCRIPT\t substring.