2019

cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).

cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).

cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).

cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).

cPanel before 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).

The animate-it plugin before 2.3.4 for WordPress has XSS.

The animate-it plugin before 2.3.5 for WordPress has XSS.

An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to injec

In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors.

The liquid-speech-balloon (aka LIQUID SPEECH BALLOON) plugin before 1.0.7 for WordPress allows XSS with Internet Explore

The client-dash (aka Client Dash) plugin 2.1.4 for WordPress allows XSS.

EyouCms through 2019-07-11 has XSS related to the login.php web_recordnum parameter.

The searchterms-tagging-2 plugin through 1.535 for WordPress has XSS via the wp-admin/options-general.php count paramete

The broken-link-manager plugin 0.4.5 for WordPress has XSS via the page parameter in a delURL action.

The incoming-links plugin before 0.9.10b for WordPress has referrers.php XSS via the Referer HTTP header.

prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS.

b3log Symphony (aka Sym) before 3.6.0 has XSS via the HTTP User-Agent header.

Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[title] parameter to web/polygon/problem/create or web/pol

Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[description] parameter to web/admin/problem/create or web

Jiangnan Online Judge (aka jnoj) 0.8.0 has XSS via the Problem[sample_input] parameter to web/admin/problem/create or we

laravel-bjyblog 6.1.1 has XSS via a crafted URL.

Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion.

IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: admin/login.html with the parameter username is persis

IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][contro

IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][action

IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/basic/ with the parameter _dlg[captcha][uid] i

IceWarp Webclient before 10.2.1 has XSS via an HTTP POST request: webmail/ with the parameter password is non-persistent

An issue was discovered in Kirona Dynamic Resource Scheduling (DRS) 5.5.3.5. A reflected Cross-site scripting (XSS) vuln

Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, Clie

Gila CMS through 1.11.4 allows blog-list.php XSS, in both the gila-blog and gila-mag themes, via the search parameter, a

A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attac

SonarSource SonarQube before 7.8 has XSS in project links on account/projects.

OX App Suite 7.10.1 and 7.10.2 allows XSS.

There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php.

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like <

A reflected Cross-Site Scripting (XSS) vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote

NETGEAR JNR1010 devices before 1.0.0.32 allow webproc?getpage= XSS.

The broken-link-checker plugin through 1.11.8 for WordPress (aka Broken Link Checker) is susceptible to Reflected XSS du

A cross-site scripting (XSS) vulnerability in admin/translate/translateheader_view.php in LimeSurvey 3.19.1 and earlier

D-Link DIR-866L 1.03B04 devices allow XSS via HtmlResponseMessage in the device common gateway interface, leading to com

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Services). The supported version that

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Sample apps). The supported

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported v

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versi

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versi

Vulnerability in the Oracle Hospitality Reporting and Analytics component of Oracle Food and Beverage Applications. The

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported v

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). Su

A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communicat

A vulnerability in the web-based interface of Cisco Small Business Smart and Managed Switches could allow an unauthentic