Filtered by CWE-79
Filtered by vendor Subscriptions
Total 45117 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-38357 1 Elyazalee 1 Sms-ovh 2025-05-02 6.1 Medium
The SMS OVH WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the position parameter found in the ~/sms-ovh-sent.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.1.
CVE-2024-27684 1 Dlink 2 Go-rt-ac750, Go-rt-ac750 Firmware 2025-05-02 6.1 Medium
A Cross-site scripting (XSS) vulnerability in dlapn.cgi, dldongle.cgi, dlcfg.cgi, fwup.cgi and seama.cgi in D-Link GORTAC750_A1_FW_v101b03 allows remote attackers to inject arbitrary web script or HTML via the url parameter.
CVE-2022-44724 1 Stiltsoft 1 Handy Macros For Confluence 2025-05-02 8.9 High
The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability.
CVE-2022-3721 1 Froxlor 1 Froxlor 2025-05-02 4.6 Medium
Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39.
CVE-2022-2904 1 Gitlab 1 Gitlab 2025-05-02 7.3 High
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 It was possible to exploit a vulnerability in the external status checks feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.
CVE-2021-39473 1 Hotelmanager Project 1 Hotelmanager 2025-05-02 5.4 Medium
Saibamen HotelManager v1.2 is vulnerable to Cross Site Scripting (XSS) due to improper sanitization of comment and contact fields.
CVE-2022-27894 1 Palantir 1 Foundry Blobster 2025-05-02 4.8 Medium
The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Foundry to launch attacks against other users. This vulnerability is resolved in Blobster 3.228.0.
CVE-2022-3765 1 Phpmyfaq 1 Phpmyfaq 2025-05-02 5.4 Medium
Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8.
CVE-2024-5032 1 Toolstack 1 Sully 2025-05-02 4.7 Medium
The SULly WordPress plugin before 4.3.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2024-5074 1 Tipsandtricks-hq 1 Wp Emember 2025-05-02 5.4 Medium
The wp-eMember WordPress plugin before 10.6.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVE-2022-3462 1 Highlight Focus Project 1 Highlight Focus 2025-05-02 4.8 Medium
The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-3265 1 Gitlab 1 Gitlab 2025-05-01 7.3 High
A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side.
CVE-2024-37384 2 Debian, Roundcube 3 Debian Linux, Roundcube Webmail, Webmail 2025-05-01 6.1 Medium
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
CVE-2024-4621 1 Reputeinfosystems 1 Arforms 2025-05-01 4.8 Medium
The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-43568 1 Splunk 2 Splunk, Splunk Cloud Platform 2025-05-01 8.8 High
In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a query parameter when output_mode=radio.
CVE-2024-4934 1 Expresstech 1 Quiz And Survey Master 2025-05-01 5.5 Medium
The Quiz and Survey Master (QSM) WordPress plugin before 9.0.2 does not validate and escape some of its Quiz fields before outputting them back in a page/post where the Quiz is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2024-6130 1 10web 1 Form Maker 2025-05-01 4.8 Medium
The Form Maker by 10Web WordPress plugin before 1.15.26 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
CVE-2022-43144 1 Canteen Management System Project 1 Canteen Management System 2025-05-01 5.4 Medium
A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
CVE-2022-41434 1 Eyesofnetwork 1 Web Interface 2025-05-01 6.1 Medium
EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /lilac/main.php.
CVE-2022-41433 1 Eyesofnetwork 1 Web Interface 2025-05-01 4.8 Medium
EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/admin_bp/add_application.php.