2018

IBM MQ Appliance 9.0.1, 9.0.2, 9.0.3, amd 9.0.4 is vulnerable to cross-site scripting. This vulnerability allows users t

CoverCMS v1.1.6 has XSS via the fourth input box to index.php, related to admina/mconfigs.inc.php.

Bose SoundTouch devices allow XSS via crafted song data from a music service, as demonstrated by Pandora.

Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify.

dsmall v20180320 allows XSS via the public/index.php/home/predeposit/index.html pdr_sn parameter (aka the CMS search box

dsmall v20180320 allows XSS via the member search box at the public/index.php/home/membersnsfriend/findlist.html URI.

Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.

The Events Manager plugin before 5.8.1.2 for WordPress allows XSS via the events-manager.js mapTitle parameter in the Go

Multiple cross-site scripting (XSS) vulnerabilities in IBM InfoSphere Master Data Management (MDM) - Collaborative Editi

Tenable Appliance versions 4.6.1 and earlier have been found to contain a single XSS vulnerability. Utilizing a speciall

In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post.

In Crea8social 2018.2, there is Stored Cross-Site Scripting via a post comment.

In Crea8social 2018.2, there is Reflected Cross-Site Scripting via the term parameter to the /search URI.

In Crea8social 2018.2, there is Stored Cross-Site Scripting via a User Profile.

IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra

IBM Business Process Manager 8.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitra

IBM Financial Transaction Manager for Check Services for Multi-Platform 3.0, 3.0.2, and 3.0.2.1 is vulnerable to cross-s

The Iptanus WordPress File Upload plugin before 4.3.3 for WordPress mishandles shortcode attributes.

A stored Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Recovery Manager Plus before 5.3 (Build 5350) all

The Joom Sky JS Jobs extension before 1.2.1 for Joomla! has XSS.

iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site title" field.

iScripts EasyCreate 3.2.1 has Stored Cross-Site Scripting in the "Site Description" field.

Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote

Cross-site scripting (XSS) vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers (users) to inject JavaS

The Trello board importer resource in Atlassian Jira before version 7.6.1 allows remote attackers who can convince a Jir

register.jsp in Coremail XT3.0 allows stored XSS, as demonstrated by the third form field to a URI under register/, a di

An issue was discovered in idreamsoft iCMS through 7.0.7. XSS exists via the nickname field in an admincp.php?app=user&d

Under certain conditions, SAP Disclosure Management 10.1 allows an attacker to access information which would otherwise

SAP Solution Manager, 7.10, 7.20, Incident Management Work Center allows an attacker to upload a malicious script as an

SAP Business One, 9.2, 9.3, browser access does not sufficiently encode user controlled inputs, which results in a Cross

SAP Disclosure Management 10.1 does not perform necessary authorization checks for an authenticated user, resulting in e

Dolibarr ERP/CRM is affected by stored Cross-Site Scripting (XSS) in versions through 7.0.0.

Dolibarr ERP/CRM is affected by multiple reflected Cross-Site Scripting (XSS) vulnerabilities in versions before 5.0.4:

In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Stored Cross-Site Scripting Vulnerability could potentially be e

In OpenText Documentum D2 Webtop v4.6.0030 build 059, a Reflected Cross-Site Scripting Vulnerability could potentially b

Jenkins before versions 2.44 and 2.32.2 is vulnerable to an insufficient permission check. This allows users with permis

Catfish CMS V4.7.21 allows XSS via the pinglun parameter to cat/index/index/pinglun (aka an authenticated comment).

OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of s

iScripts SupportDesk v4.3 has XSS via the staff/inteligentsearchresult.php txtinteligentsearch parameter.

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially c

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially c

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially c

An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially c

IBM DOORS Next Generation (DNG/RRC) 5.0, 5.0.1, 5.0.2, and 6.0 through 6.0.5 is vulnerable to cross-site scripting. This

Cross-site scripting (XSS) vulnerability in Open-AudIT Professional 2.1.1 allows remote attackers to inject arbitrary we

Cacti before 1.1.37 has XSS because the get_current_page function in lib/functions.php relies on $_SERVER['PHP_SELF'] in

Cacti before 1.1.37 has XSS because it does not properly reject unintended characters, related to use of the sanitize_ur

Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls occ

Cross-site scripting (XSS) vulnerability in IBM Forms Experience Builder 8.5.0 and 8.5.1 allows remote attackers to inje

PHP Scripts Mall Website Broker Script 3.0.6 has XSS via the Last Name field on the My Profile page.