Export limit exceeded: 360766 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46898 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-4803 | 1 Proofpoint | 1 Insider Threat Management | 2024-11-21 | 4.8 Medium |
| A reflected cross-site scripting vulnerability in the WriteWindowTitle endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected. | ||||
| CVE-2023-4802 | 1 Proofpoint | 1 Insider Threat Management | 2024-11-21 | 4.8 Medium |
| A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected. | ||||
| CVE-2023-4799 | 1 Wpembedfb | 1 Magic Embeds | 2024-11-21 | 5.4 Medium |
| The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2023-4771 | 1 Cksource | 1 Ckeditor | 2024-11-21 | 6.1 Medium |
| A Cross-Site scripting vulnerability has been found in CKSource CKEditor affecting versions 4.15.1 and earlier. An attacker could send malicious javascript code through the /ckeditor/samples/old/ajax.html file and retrieve an authorized user's information. | ||||
| CVE-2023-4710 | 1 Totvs | 1 Rm | 2024-11-21 | 4.3 Medium |
| A vulnerability classified as problematic was found in TOTVS RM 12.1. Affected by this vulnerability is an unknown functionality of the component Portal. The manipulation of the argument d leads to cross site scripting. The attack can be launched remotely. The identifier VDB-238573 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2023-4707 | 1 Infosoftbd | 1 Clcknshop | 2024-11-21 | 3.5 Low |
| A vulnerability was found in Infosoftbd Clcknshop 1.0.0. It has been declared as problematic. This vulnerability affects unknown code of the file /collection/all. The manipulation of the argument q leads to cross site scripting. The attack can be initiated remotely. VDB-238570 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2023-4667 | 1 Idemia | 15 Morphowave Compact, Morphowave Compact Firmware, Morphowave Sp and 12 more | 2024-11-21 | 8.1 High |
| The web interface of the PAC Device allows the device administrator user profile to store malicious scripts in some fields. The stored malicious script is then executed when the GUI is opened by any users of the webserver administration interface. The root cause of the vulnerability is inadequate input validation and output encoding in the web administration interface component of the firmware. This could lead to unauthorized access and data leakage | ||||
| CVE-2023-4655 | 1 Instantcms | 1 Instantcms | 2024-11-21 | 6.1 Medium |
| Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1. | ||||
| CVE-2023-4653 | 1 Instantcms | 1 Instantcms | 2024-11-21 | 4.8 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. | ||||
| CVE-2023-4652 | 1 Instantcms | 1 Instantcms | 2024-11-21 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git. | ||||
| CVE-2023-4592 | 1 Wpn-xm | 1 Wpn-xm | 2024-11-21 | 6.1 Medium |
| A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send a specially crafted JavaScript payload through the /tools/webinterface/index.php parameter and retrieve the cookie session details of an authenticated user, resulting in a session hijacking. | ||||
| CVE-2023-4564 | 1 Capensis | 1 Canopsis | 2024-11-21 | 4.7 Medium |
| This vulnerability could allow an attacker to store a malicious JavaScript payload in the broadcast message parameter within the admin panel. | ||||
| CVE-2023-4561 | 1 Omeka | 1 Omeka S | 2024-11-21 | 4.8 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.4. | ||||
| CVE-2023-4555 | 1 Inventory Management System Project | 1 Inventory Management System | 2024-11-21 | 3.5 Low |
| A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file suppliar_data.php. The manipulation of the argument name/company leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-238153 was assigned to this vulnerability. | ||||
| CVE-2023-4547 | 1 Spa-cart | 1 Ecommerce Cms | 2024-11-21 | 3.5 Low |
| A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filter[brandid]/filter[price] leads to cross site scripting. The attack may be launched remotely. VDB-238058 is the identifier assigned to this vulnerability. | ||||
| CVE-2023-4534 | 1 Neomind | 1 Fusion Platform | 2024-11-21 | 3.5 Low |
| A vulnerability, which was classified as problematic, was found in NeoMind Fusion Platform up to 20230731. Affected is an unknown function of the file /fusion/portal/action/Link. The manipulation of the argument link leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-238026 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2023-4517 | 1 Hestiacp | 1 Hestiacp | 2024-11-21 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository hestiacp/hestiacp prior to 1.8.6. | ||||
| CVE-2023-4514 | 1 Mediamanifesto | 1 Mmm Simple File List | 2024-11-21 | 5.4 Medium |
| The Mmm Simple File List WordPress plugin through 2.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2023-4497 | 1 Easy Chat Server Project | 1 Easy Chat Server | 2024-11-21 | 6.1 Medium |
| Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /registresult.htm (POST method), in the Icon parameter. The XSS is loaded from /users.ghp. | ||||
| CVE-2023-4496 | 1 Easy Chat Server Project | 1 Easy Chat Server | 2024-11-21 | 6.1 Medium |
| Easy Chat Server, in its 3.1 version and before, does not sufficiently encrypt user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability stored via /body2.ghp (POST method), in the mtowho parameter. | ||||