Export limit exceeded: 339475 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 44417 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (44417 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-35792 | 1 Vound-software | 1 Intella Connect | 2025-05-30 | 5.4 Medium |
| Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS). | ||||
| CVE-2023-31223 | 1 Dradisframework | 1 Dradis | 2025-05-30 | 8.7 High |
| Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars. | ||||
| CVE-2022-38481 | 1 Mega | 1 Hopex | 2025-05-30 | 6.1 Medium |
| An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several features. | ||||
| CVE-2022-37028 | 1 Iris | 1 Isams | 2025-05-30 | 5.4 Medium |
| ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScript payload that will be executed when another user uses the application. | ||||
| CVE-2022-29931 | 1 Raytion | 1 Custom Security Manager | 2025-05-30 | 6.1 Medium |
| The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XSS). | ||||
| CVE-2022-24967 | 1 Blackrainbow | 1 Nimbus | 2025-05-30 | 6.5 Medium |
| Black Rainbow NIMBUS before 3.7.0 allows stored Cross-site Scripting (XSS). | ||||
| CVE-2021-41320 | 1 Iongroup | 1 Wallstreet Suite | 2025-05-30 | 5.5 Medium |
| A technical user has hardcoded credentials in Wallstreet Suite TRM 7.4.83 (64-bit edition) with higher privilege than the average authenticated user. NOTE: the vendor disputes this because the password is not hardcoded (it can be changed during installation or at any later time). | ||||
| CVE-2019-7161 | 1 Zohocorp | 1 Manageengine Adselfservice Plus | 2025-05-30 | N/A |
| An issue was discovered in Zoho ManageEngine ADSelfService Plus 5.x through build 5704. It uses fixed ciphering keys to protect information, giving the capacity for an attacker to decipher any protected data. | ||||
| CVE-2019-6514 | 1 Wso2 | 1 Dashboard Server | 2025-05-30 | N/A |
| An issue was discovered in WSO2 Dashboard Server 2.0.0. It is possible to inject a JavaScript payload that will be stored in the database and then displayed and executed on the same page, aka XSS. | ||||
| CVE-2018-10213 | 1 Vaultize | 1 Enterprise File Sharing | 2025-05-30 | N/A |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is XSS in invitation mail received from a different user, who can modify the HTML in that mail before sending it. | ||||
| CVE-2018-10209 | 1 Vaultize | 1 Enterprise File Sharing | 2025-05-30 | N/A |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS on the file or folder download pop-up via a crafted file or folder name. | ||||
| CVE-2018-10208 | 1 Vaultize | 1 Enterprise File Sharing | 2025-05-30 | N/A |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is anonymous reflected XSS on the error page via a /share/error?message= URI. | ||||
| CVE-2018-10206 | 1 Vaultize | 1 Enterprise File Sharing | 2025-05-30 | N/A |
| An issue was discovered in Vaultize Enterprise File Sharing 17.05.31. There is Stored XSS via the optional message field of a file request. | ||||
| CVE-2024-3580 | 1 Ivanweb | 1 Popup4phone | 2025-05-30 | 6.1 Medium |
| The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-3231 | 1 Ivanweb | 1 Popup4phone | 2025-05-30 | 6.1 Medium |
| The Popup4Phone WordPress plugin through 1.3.2 does not sanitise and escape some parameters, which could allow unauthenticated users to perform Cross-Site Scripting attacks against admins. | ||||
| CVE-2024-2761 | 1 Wpengine | 1 Genesis Blocks | 2025-05-30 | 6.8 Medium |
| The Genesis Blocks WordPress plugin before 3.1.3 does not properly escape data input provided to some of its blocks, allowing using with at least contributor privileges to conduct Stored XSS attacks. | ||||
| CVE-2024-2309 | 1 Wp-staging | 1 Wp Staging | 2025-05-30 | 4.8 Medium |
| The WP STAGING WordPress Backup Plugin WordPress plugin before 3.4.0, wp-staging-pro WordPress plugin before 5.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2024-4924 | 1 Heateor | 1 Sassy Social Share | 2025-05-30 | 6.1 Medium |
| The Social Sharing Plugin WordPress plugin before 3.3.63 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | ||||
| CVE-2025-48252 | 1 Wpfactory | 1 Back Button Widget | 2025-05-30 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Back Button Widget allows Stored XSS. This issue affects Back Button Widget: from n/a through 1.6.8. | ||||
| CVE-2024-23726 | 1 Ubeeinteractive | 2 Ddw365, Ddw365 Firmware | 2025-05-30 | 8.8 High |
| Ubee DDW365 XCNDDW365 devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. A remote attacker (in proximity to a Wi-Fi network) can derive the default WPA2-PSK value by observing a beacon frame. A PSK is generated by using the first six characters of the SSID and the last six of the BSSID, decrementing the last digit. | ||||