2019

studio/polyglot.php?page=etemplates in UNA 10.0.0-RC1 allows XSS via the System Name field under Emails during template

studio/builder_menu.php?page=sets in UNA 10.0.0-RC1 allows XSS via the System Name field under Sets during set editing.

A remote multiple cross-site scripting vulnerability was discovered in HPE 3PAR StoreServ Management and Core Software M

Adive Framework through 2.0.7 is affected by XSS in the Create New Table and Create New Navigation Link functions.

The toggle-the-title (aka Toggle The Title) plugin 1.4 for WordPress has XSS via the wp-admin/admin-ajax.php?action=upda

OpenCart 3.x, when the attacker has login access to the admin panel, allows stored XSS within the Source/HTML editing fe

An issue was discovered in WSO2 API Manager 2.6.0 before WSO2-CARBON-PATCH-4.4.0-4457. There is XSS via a crafted filena

A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow

An issue was discovered in the hyper crate before 0.9.4 for Rust on Windows. There is an HTTPS man-in-the-middle vulnera

The gigpress plugin before 2.3.11 for WordPress has XSS.

A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with

Symantec My VIP portal, previous version which has already been auto updated, was susceptible to a cross-site scripting

The photoblocks-grid-gallery plugin before 1.1.33 for WordPress has wp-admin/admin.php?page=photoblocks-edit&id= XSS.

A stored cross-site scripting (XSS) vulnerability was reported in Lenovo XClarity Administrator (LXCA) versions prior to

Gophish through 0.8.0 allows XSS via a username.

Various templates of the Optimization plugin in Jira before version 7.13.6, and from version 8.0.0 before version 8.4.0

In Bludit v3.9.2, there is a persistent XSS vulnerability in the Categories -> Add New Category -> Name field. NOTE: thi

A race condition in specific microprocessors using Intel (R) DDIO cache allocation and RDMA may allow an authenticated u

The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php edit_style id XSS.

An issue was discovered in ThinkSAAS 2.91. There is XSS via the index.php?app=group&ac=create&ts=do groupname parameter.

admin/infoclass_update.php in PHPMyWind 5.6 has stored XSS.

Jenkins 2.196 and earlier, LTS 2.176.3 and earlier did not restrict or filter values set as Jenkins URL in the global co

A vulnerability in the web framework code of Cisco IOS XE Software could allow an authenticated, remote attacker to cond

A vulnerability in the web framework code of Cisco IOS and Cisco IOS XE Software could allow an authenticated, remote at

The addthis plugin before 5.0.13 for WordPress has CSRF with resultant XSS via the wp-admin/options-general.php?page=add

The easy-fancybox plugin before 1.8.18 for WordPress (aka Easy FancyBox) is susceptible to Stored XSS in the Settings Me

Dell EMC Integrated Data Protection Appliance versions prior to 2.3 contain a stored cross-site scripting vulnerability.

Ilch 2.1.22 allows stored XSS via the title, text, or email id to the Jobs Tab.

An issue was discovered in the image-manager in Xoops 2.5.10. When the breadcrumb showing the category name is hovered o

An issue was discovered in the image-manager in Xoops 2.5.10. When any image with a JavaScript payload as its name is ho

IBM WebSphere eXtreme Scale 8.6 Admin Console is vulnerable to cross-site scripting. This vulnerability allows users to

CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field.

PbootCMS 2.0.2 allows XSS via vectors involving the Pboot/admin.php?p=/Single/index/mcode/1 and Pboot/?contact/ URIs.

z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation lo

The content-grabber plugin 1.0 for WordPress has XSS via obj_field_name or obj_field_id.

A stored XSS vulnerability was discovered in Hotaru CMS v1.7.2 via the admin_index.php?page=settings SITE NAME field (ak

CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "file manager > upload

CMS Made Simple (CMSMS) 2.2.11 allows stored XSS by an admin via a crafted image filename on the "News > Add Article" sc

The eu-cookie-law plugin through 3.0.6 for WordPress (aka EU Cookie Law (GDPR)) is susceptible to Stored XSS due to impr

Pivotal RabbitMQ, versions prior to v3.7.18, and RabbitMQ for PCF, versions 1.15.x prior to 1.15.13, versions 1.16.x pri

Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Scripting). Supported versions that

Vulnerability in the Java SE product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Ja

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an

A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an au

A malicious admin user could edit the state of objects in the Airflow metadata database to execute arbitrary javascript

TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot pass

A reflected cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 o

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated adm