CVE-2008-3121 | ByteOS Network

Vulnerability Details :

CVE-2008-3121

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-10 Jul, 2008 | 18:00

Updated At-07 Aug, 2024 | 09:28

Multiple cross-site scripting (XSS) vulnerabilities in Xerox CentreWare Web (CWW) before 4.6.46 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:10 Jul, 2008 | 18:00

Updated At:07 Aug, 2024 | 09:28

▼CVE Numbering Authority (CNA)

Multiple cross-site scripting (XSS) vulnerabilities in Xerox CentreWare Web (CWW) before 4.6.46 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Affected Products

Vendor

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://www.xerox.com/downloads/usa/en/c/cert_XRX08_008.pdf	x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/43671	vdb-entry x_refsource_XF
http://www.securityfocus.com/bid/30151	vdb-entry x_refsource_BID
http://secunia.com/advisories/30978	third-party-advisory x_refsource_SECUNIA

Hyperlink: http://www.xerox.com/downloads/usa/en/c/cert_XRX08_008.pdf

Resource:

x_refsource_CONFIRM

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/43671

Resource:

vdb-entry

x_refsource_XF

Hyperlink: http://www.securityfocus.com/bid/30151

Resource:

vdb-entry

x_refsource_BID

Hyperlink: http://secunia.com/advisories/30978

Resource:

third-party-advisory

x_refsource_SECUNIA

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://www.xerox.com/downloads/usa/en/c/cert_XRX08_008.pdf	x_refsource_CONFIRM x_transferred
https://exchange.xforce.ibmcloud.com/vulnerabilities/43671	vdb-entry x_refsource_XF x_transferred
http://www.securityfocus.com/bid/30151	vdb-entry x_refsource_BID x_transferred
http://secunia.com/advisories/30978	third-party-advisory x_refsource_SECUNIA x_transferred

Hyperlink: http://www.xerox.com/downloads/usa/en/c/cert_XRX08_008.pdf

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/43671

Resource:

vdb-entry

x_refsource_XF

x_transferred

Hyperlink: http://www.securityfocus.com/bid/30151

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: http://secunia.com/advisories/30978

Resource:

third-party-advisory

x_refsource_SECUNIA

x_transferred

▼National Vulnerability Database (NVD)

Source:cve@mitre.org

Published At:10 Jul, 2008 | 18:41

Updated At:23 Apr, 2026 | 00:35

Multiple cross-site scripting (XSS) vulnerabilities in Xerox CentreWare Web (CWW) before 4.6.46 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

Xerox Corporation

>>centreware_web>>Versions up to 1.0(inclusive)

cpe:2.3:a:xerox:centreware_web:*:*:*:*:*:*:*:*

Xerox Corporation

>>centreware_web>>Versions up to 2.0(inclusive)

cpe:2.3:a:xerox:centreware_web:*:*:*:*:*:*:*:*

Xerox Corporation

>>centreware_web>>Versions up to 3(inclusive)

cpe:2.3:a:xerox:centreware_web:*:*:*:*:*:*:*:*

Xerox Corporation

>>centreware_web>>Versions up to 4.6.42(inclusive)

cpe:2.3:a:xerox:centreware_web:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://secunia.com/advisories/30978	cve@mitre.org	Patch Vendor Advisory
http://www.securityfocus.com/bid/30151	cve@mitre.org	Patch
http://www.xerox.com/downloads/usa/en/c/cert_XRX08_008.pdf	cve@mitre.org	Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/43671	cve@mitre.org	N/A
http://secunia.com/advisories/30978	af854a3a-2127-422b-91ae-364da2661108	Patch Vendor Advisory
http://www.securityfocus.com/bid/30151	af854a3a-2127-422b-91ae-364da2661108	Patch
http://www.xerox.com/downloads/usa/en/c/cert_XRX08_008.pdf	af854a3a-2127-422b-91ae-364da2661108	Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/43671	af854a3a-2127-422b-91ae-364da2661108	N/A

Hyperlink: http://secunia.com/advisories/30978

Source: cve@mitre.org

Resource:

Patch

Vendor Advisory

Hyperlink: http://www.securityfocus.com/bid/30151

Source: cve@mitre.org

Resource:

Patch

Hyperlink: http://www.xerox.com/downloads/usa/en/c/cert_XRX08_008.pdf

Source: cve@mitre.org

Resource:

Patch

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/43671

Source: cve@mitre.org

Resource: N/A

Hyperlink: http://secunia.com/advisories/30978

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Vendor Advisory

Hyperlink: http://www.securityfocus.com/bid/30151

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Hyperlink: http://www.xerox.com/downloads/usa/en/c/cert_XRX08_008.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Patch

Hyperlink: https://exchange.xforce.ibmcloud.com/vulnerabilities/43671

Source: af854a3a-2127-422b-91ae-364da2661108

Resource: N/A

Similar CVEs

12247Records found

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-3.59% / 87.89%

||

7 Day CHG~0.00%

Published-25 Nov, 2008 | 19:00

Updated-23 Apr, 2026 | 00:35

Multiple cross-site scripting (XSS) vulnerabilities in Xerox DocuShare 6 and earlier allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to the default URI under (1) SearchResults/ and (2) Services/ in dsdn/dsweb/, and (3) the default URI under unspecified docushare/dsweb/ServicesLib/Group-#/ directories.

Vendor-n/a Xerox Corporation

Product-docushare n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.47% / 65.05%

||

7 Day CHG~0.00%

Published-23 Jun, 2008 | 17:00

Updated-23 Apr, 2026 | 00:35

Cross-site scripting (XSS) vulnerability in the embedded Web Server in Xerox WorkCentre M123, M128, and 133 and WorkCentre Pro 123, 128, and 133 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Xerox Corporation

Product-workcentre n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.47% / 65.05%

||

7 Day CHG~0.00%

Published-17 Jun, 2008 | 15:00

Updated-23 Apr, 2026 | 00:35

Cross-site scripting (XSS) vulnerability in the embedded web server in Xerox 4110, 4590, and 4595 Copier/Printers allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.

Vendor-n/a Xerox Corporation

Product-xerox_4595 xerox_4110 xerox_4590 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.57% / 68.81%

||

7 Day CHG~0.00%

Published-13 Mar, 2020 | 18:24

Updated-04 Aug, 2024 | 23:41

Multiple Stored XSS vulnerabilities were found in the Xerox Web Application, used by the Phaser 3320 V53.006.16.000 and other printers. Successful exploitation of this vulnerability can lead to session hijacking of the administrator in the web application or the execution of unwanted actions.

Vendor-n/a Xerox Corporation

Product-phaser_3320 phaser_3320_firmware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.29%

||

7 Day CHG~0.00%

Published-13 May, 2019 | 12:46

Updated-05 Aug, 2024 | 09:54

Cross-site scripting (XSS) in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript code.

Vendor-n/a Xerox Corporation

Product-colorqube_8580 colorqube_8580_firmware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.52% / 66.85%

||

7 Day CHG~0.00%

Published-06 Mar, 2009 | 18:00

Updated-23 Apr, 2026 | 00:35

Cross-site scripting (XSS) vulnerability in the Web Server in Xerox WorkCentre 7132, 7228, 7235, and 7245 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-n/a Xerox Corporation

Product-workcentre n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-10

Assigner-MITRE Corporation

Matching Score-10

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.31% / 54.49%

||

7 Day CHG~0.00%

Published-09 Oct, 2020 | 06:42

Updated-04 Aug, 2024 | 15:49

Xerox WorkCentre EC7836 before 073.050.059.25300 and EC7856 before 073.020.059.25300 devices allow XSS via Description pages.

Vendor-n/a Xerox Corporation

Product-workcentre_ec7836 workcentre_ec7836_firmware workcentre_ec7856_firmware workcentre_ec7856 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.5||MEDIUM

EPSS-0.17% / 37.11%

||

7 Day CHG~0.00%

Published-13 Mar, 2020 | 18:18

Updated-04 Aug, 2024 | 23:41

Some Xerox printers (such as the Phaser 3320 V53.006.16.000) did not implement any mechanism to avoid CSRF attacks. Successful exploitation of this vulnerability can lead to the takeover of a local account on the device.

Vendor-n/a Xerox Corporation

Product-phaser_3320 phaser_3320_firmware n/a

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.54% / 67.83%

||

7 Day CHG~0.00%

Published-21 Aug, 2005 | 04:00

Updated-16 Apr, 2026 | 00:27

Cross-site scripting (XSS) vulnerability in Xerox MicroServer Web Server in Document Centre 220 through 265, 332 and 340, 420 through 490, and 535 through 555 allows remote attackers to inject arbitrary web script or HTML and modify web pages via unknown vectors.

Vendor-n/a Xerox Corporation

Product-document_centre_332 document_centre_555 document_centre_420 document_centre_535 document_centre_490 document_centre_340 document_centre_265 n/a

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 58.59%

||

7 Day CHG~0.00%

Published-11 Jul, 2005 | 04:00

Updated-16 Apr, 2026 | 00:27

Cross-site scripting (XSS) vulnerability in the MicroServer Web Server for Xerox WorkCentre Pro Color 2128, 2636, and 3545, version 0.001.04.044 through 0.001.04.504, allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

Vendor-n/a Xerox Corporation

Product-workcentre_3545 workcentre_2128 workcentre_2636 n/a

Matching Score-6

Assigner-MITRE Corporation

Matching Score-6

Assigner-MITRE Corporation

CVSS Score-4.8||MEDIUM

EPSS-0.39% / 60.16%

||

7 Day CHG~0.00%

Published-10 Feb, 2022 | 18:11

Updated-03 Aug, 2024 | 03:36

A persistent cross-site scripting (XSS) vulnerability exists on two input fields within the administrative panel when editing users in the XMPie UStore application on version 12.3.7244.0.

Vendor-n/a Xerox Corporation

Product-xmpie_ustore n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-6

Assigner-Xerox Corporation

Matching Score-6

Assigner-Xerox Corporation

CVSS Score-5.3||MEDIUM

EPSS-0.01% / 1.64%

||

7 Day CHG~0.00%

Published-06 Feb, 2026 | 17:19

Updated-24 Feb, 2026 | 20:58

Stored XSS on Xerox CentreWare Web 7.0.6

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Xerox CentreWare on Windows allows Stored XSS.This issue affects CentreWare: through 7.0.6. Consider upgrading Xerox® CentreWare Web® to v7.2.2.25 via the software available on Xerox.com

Vendor-Microsoft Corporation Xerox Corporation

Product-centreware_web windows CentreWare

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.48% / 65.15%

||

7 Day CHG~0.00%

Published-21 Dec, 2009 | 16:00

Updated-23 Apr, 2026 | 00:35

Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application Framework before 3.3.6, Horde Groupware before 1.2.5, and Horde Groupware Webmail Edition before 1.2.5 does not properly handle data: URIs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via data:text/html values for the HREF attribute of an A element in an HTML e-mail message. NOTE: the vendor states that the issue is caused by "an XSS vulnerability in Firefox browsers."

Vendor-n/a Horde LLC

Product-application_framework groupware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.33% / 55.84%

||

7 Day CHG~0.00%

Published-25 Oct, 2019 | 21:12

Updated-05 Aug, 2024 | 01:47

CoreHR Core Portal before 27.0.7 allows stored XSS.

Vendor-corehr n/a

Product-core_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.15% / 35.72%

||

7 Day CHG~0.00%

Published-05 Feb, 2019 | 16:00

Updated-16 Sep, 2024 | 23:10

An issue was discovered in PHPMyWind 5.5. The GetQQ function in include/func.class.php allows XSS via the cfg_qqcode parameter. This can be exploited via CSRF.

Vendor-phpmywind n/a

Product-phpmywind n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.52% / 66.85%

||

7 Day CHG~0.00%

Published-22 Dec, 2009 | 23:00

Updated-23 Apr, 2026 | 00:35

The cross-site scripting (XSS) protection mechanism in ShowInContentAreaAction.do in ManageEngine Password Manager Pro (PMP) before 6.1 Build 6104 uses case-sensitive checks for malicious inputs, which allows remote attackers to inject arbitrary web script or HTML via the searchtext parameter and other unspecified inputs.

Vendor-n/a ManageEngine (Zoho Corporation Pvt. Ltd.)

Product-password_manager_pro password_manager_pro6.1 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 52.03%

||

7 Day CHG~0.00%

Published-21 Apr, 2015 | 16:00

Updated-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in the Content Analysis module before 6.x-1.7 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a log message.

Vendor-levelteninteractive n/a

Product-content_analysis n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.50% / 66.17%

||

7 Day CHG~0.00%

Published-11 Dec, 2016 | 02:00

Updated-06 May, 2026 | 22:30

XSS issues were discovered in phpMyAdmin. This affects navigation pane and database/table hiding feature (a specially-crafted database name can be used to trigger an XSS attack); the "Tracking" feature (a specially-crafted query can be used to trigger an XSS attack); and GIS visualization feature. All 4.6.x versions (prior to 4.6.4) and 4.4.x versions (prior to 4.4.15.8) are affected.

Vendor-n/a phpMyAdmin

Product-phpmyadmin n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.42% / 61.86%

||

7 Day CHG~0.00%

Published-23 Jun, 2015 | 14:00

Updated-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in Cisco WebEx Meeting Center allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCur03806.

Vendor-n/a Cisco Systems, Inc.

Product-webex_meeting_center n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.17% / 37.23%

||

7 Day CHG~0.00%

Published-12 Nov, 2010 | 21:00

Updated-29 Apr, 2026 | 01:13

Mozilla Firefox before 3.6 Beta 3 does not properly handle overlong UTF-8 encoding, which makes it easier for remote attackers to bypass cross-site scripting (XSS) protection mechanisms via a crafted string, a different vulnerability than CVE-2010-1210.

Vendor-n/a Mozilla Corporation

Product-firefox n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-4.7||MEDIUM

EPSS-0.24% / 47.29%

||

7 Day CHG~0.00%

Published-02 Jul, 2020 | 16:50

Updated-04 Aug, 2024 | 13:08

Reflected XSS when uploading an image in the Product page in PrestaShop

In PrestaShop from version 1.7.0.0 and before version 1.7.6.6, if a target sends a corrupted file, it leads to a reflected XSS. The problem is fixed in 1.7.6.6

Vendor-PrestaShop S.A

Product-prestashop PrestaShop

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.56% / 68.51%

||

7 Day CHG~0.00%

Published-09 Jul, 2010 | 17:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in Online Contact Manager (formerly EContact PRO) 3.0 allow remote attackers to inject arbitrary web script or HTML via the (1) showGroup parameter to (a) index.php and the (2) id parameter to (b) view.php, (c) email.php, (d) edit.php, and (e) delete.php.

Vendor-esoftpro n/a

Product-online_contact_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-1.56% / 81.68%

||

7 Day CHG~0.00%

Published-07 May, 2019 | 18:27

Updated-04 Aug, 2024 | 20:46

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/linkdownalertConfig.jsp" file in the groupDesc, groupName, groupID, or task parameter.

Vendor-n/a Zoho Corporation Pvt. Ltd.

Product-manageengine_netflow_analyzer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 49.71%

||

7 Day CHG~0.00%

Published-22 Jul, 2010 | 18:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the Visitor Tracking (ws_stats) extension before 0.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-wapplersystems n/a TYPO3 Association

Product-ws_stats typo3 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Adobe Systems Incorporated

Matching Score-4

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.18% / 78.96%

||

7 Day CHG~0.00%

Published-18 Jul, 2019 | 21:49

Updated-04 Aug, 2024 | 21:02

Adobe Experience Manager version 6.4 and ealier have a Stored Cross-site Scripting vulnerability. Successful exploitation could lead to Sensitive Information disclosure in the context of the current user.

Vendor-n/a Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.24% / 46.94%

||

7 Day CHG~0.00%

Published-18 Jan, 2010 | 20:00

Updated-23 Apr, 2026 | 00:35

Cross-site scripting (XSS) vulnerability in search.php in MYRE Holiday Rental Manager allows remote attackers to inject arbitrary web script or HTML via the cat_id1 parameter.

Vendor-myrephp n/a

Product-myre_holiday_rental_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.34% / 56.83%

||

7 Day CHG~0.00%

Published-06 Jan, 2010 | 21:33

Updated-23 Apr, 2026 | 00:35

Multiple cross-site scripting (XSS) vulnerabilities in Hasta Blog 2.3 allow remote attackers to inject arbitrary web script or HTML via the id parameter to (1) yorumyaz.php and (2) blog.php.

Vendor-hastablog n/a

Product-hasta_blog n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-8||HIGH

EPSS-0.31% / 54.36%

||

7 Day CHG~0.00%

Published-19 Oct, 2020 | 20:35

Updated-04 Aug, 2024 | 13:15

XSS in platform

In platform before version 9.4.4, inline attributes are not properly escaped. If the data that came from users was not escaped, then an XSS vulnerability is possible. The issue was introduced in 9.0.0 and fixed in 9.4.4.

Vendor-orchid orchidsoftware

Product-platform platform

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.91% / 76.00%

||

7 Day CHG~0.00%

Published-15 Dec, 2015 | 02:00

Updated-06 May, 2026 | 22:30

Cisco Unified Communications Manager (UCM) 8.0 through 8.6 allows remote attackers to bypass an XSS protection mechanism via a crafted parameter, aka Bug ID CSCuu15266.

Vendor-n/a Cisco Systems, Inc.

Product-unified_communications_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.25% / 48.83%

||

7 Day CHG~0.00%

Published-02 Dec, 2009 | 18:00

Updated-23 Apr, 2026 | 00:35

Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the WP-Cumulus Plug-in before 1.22 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-roytanck n/a WordPress.org

Product-wp-cumulus wordpress n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-1.10% / 78.21%

||

7 Day CHG~0.00%

Published-17 Mar, 2019 | 20:00

Updated-04 Aug, 2024 | 20:46

XSS exists in Zoho ManageEngine Netflow Analyzer Professional v7.0.0.2 in the Administration zone "/netflow/jspui/addMailSettings.jsp" file in the gF parameter.

Vendor-n/a Zoho Corporation Pvt. Ltd.

Product-manageengine_netflow_analyzer n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.91% / 86.52%

||

7 Day CHG~0.00%

Published-22 Jul, 2010 | 10:00

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the (1) uid parameter, (2) uid parameter in a login_lookup action, (3) uid parameter in an adminlogin action, (4) campaignid parameter in a createcampaign action, (5) type parameter in a view_account_stats action, (6) period parameter in a view_account_stats action, (7) uid parameter in a view_adrates action, (8) accname parameter in an account_confirmation action, (9) loginpass parameter in an account_confirmation action, (10) e9 parameter in a setup_account action, (11) from parameter in an email_advertisers action, (12) message parameter in an email_advertisers action, (13) idno parameter in an edit_ad_package action, (14) Advertiser Name field, (15) First Name field, (16) Last Name field, (17) Address field, (18) Phone Number field, (19) Password Hint field, or (20) URL field; and (21) allow remote authenticated users to inject arbitrary web script or HTML via an unspecified form associated with a view_adrates action.

Vendor-impactsoftcompany n/a

Product-adpeeps n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.95%

||

7 Day CHG~0.00%

Published-27 Jul, 2010 | 18:39

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in index.php (aka the log in page) in SimpleID before 0.6.5 allows remote attackers to inject arbitrary web script or HTML via the s parameter.

Vendor-kelvin_mo n/a

Product-simpleid n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.28% / 51.86%

||

7 Day CHG~0.00%

Published-04 Feb, 2019 | 19:00

Updated-16 Sep, 2024 | 16:27

Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'username' parameter value in the view user (user.php) because proper filtration is omitted.

Vendor-zoneminder n/a

Product-zoneminder n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Cisco Systems, Inc.

Matching Score-4

Assigner-Cisco Systems, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 49.71%

||

7 Day CHG~0.00%

Published-01 Aug, 2015 | 01:00

Updated-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in Cisco IM and Presence Service before 10.5 MR1 allows remote attackers to inject arbitrary web script or HTML by constructing a crafted URL that leverages incomplete filtering of HTML elements, aka Bug ID CSCut41766.

Vendor-n/a Cisco Systems, Inc.

Product-unified_communications_manager_im_and_presence_service n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.99% / 83.82%

||

7 Day CHG~0.00%

Published-27 Apr, 2010 | 15:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in Wolfram Research webMathematica allows remote attackers to inject arbitrary web script or HTML via the URI to the MSP script.

Vendor-wolfram n/a

Product-webmathematica n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 49.71%

||

7 Day CHG~0.00%

Published-15 Mar, 2010 | 21:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in the Twitter Search (twittersearch) extension before 0.1.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-thomas_loeffler n/a TYPO3 Association

Product-twittersearch typo3 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.35% / 80.26%

||

7 Day CHG~0.00%

Published-10 May, 2010 | 20:00

Updated-29 Apr, 2026 | 01:13

Cross-site scripting (XSS) vulnerability in login.php in PHP Photo Vote 1.3F allows remote attackers to inject arbitrary web script or HTML via the page parameter.

Vendor-ecomstudio n/a

Product-php_photo_vote1.3f n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Adobe Systems Incorporated

Matching Score-4

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-1.38% / 80.47%

||

7 Day CHG~0.00%

Published-25 Oct, 2019 | 14:55

Updated-04 Aug, 2024 | 21:10

Adobe Experience Manager versions 6.5, 6.4 and 6.3 have a cross site scripting vulnerability. Successful exploitation could lead to sensitive information disclosure.

Vendor-Adobe Inc.

Product-experience_manager Adobe Experience Manager

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.72% / 72.73%

||

7 Day CHG~0.00%

Published-30 Dec, 2009 | 20:00

Updated-23 Apr, 2026 | 00:35

Multiple cross-site scripting (XSS) vulnerabilities in pagenumber.inc.php in phpPowerCards 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) PATH_INFO, the (2) archiv parameter, and the (3) subcat parameter.

Vendor-giombetti n/a

Product-phppowercards n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.36% / 58.16%

||

7 Day CHG~0.00%

Published-04 Feb, 2019 | 19:00

Updated-17 Sep, 2024 | 02:41

POST - Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'filter[Query][terms][0][val]' parameter value in the view filter (filter.php) because proper filtration is omitted.

Vendor-zoneminder n/a

Product-zoneminder n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-CERT/CC

Matching Score-4

Assigner-CERT/CC

CVSS Score-6.1||MEDIUM

EPSS-3.48% / 87.70%

||

7 Day CHG~0.00%

Published-15 Jul, 2016 | 18:00

Updated-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in AttachmentsList.aspx in Accela Civic Platform Citizen Access portal allows remote attackers to inject arbitrary web script or HTML via the iframeid parameter.

Vendor-accela n/a

Product-civic_platform n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.82% / 74.56%

||

7 Day CHG~0.00%

Published-28 Jun, 2015 | 10:00

Updated-06 May, 2026 | 22:30

Cross-site scripting (XSS) vulnerability in the integrated web server on the Siemens Climatix BACnet/IP communication module with firmware before 10.34 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

Vendor-n/a Siemens AG

Product-climatix_bacnet\/ip n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.19% / 78.99%

||

7 Day CHG~0.00%

Published-18 Jun, 2015 | 18:00

Updated-06 May, 2026 | 22:30

Multiple cross-site scripting (XSS) vulnerabilities in Opsview 4.6.2 and earlier allow remote attackers to inject arbitrary web script or HTML via a (1) crafted check plugin, the (2) description in a host profile, or the (3) plugin_args parameter to a Test service check page.

Vendor-opsview n/a

Product-opsview n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.33% / 55.84%

||

7 Day CHG~0.00%

Published-04 Feb, 2019 | 19:00

Updated-17 Sep, 2024 | 01:20

Self - Stored Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Host' parameter value in the view console (console.php) because proper filtration is omitted. This relates to the index.php?view=monitor Host Name field.

Vendor-zoneminder n/a

Product-zoneminder n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.41% / 61.66%

||

7 Day CHG~0.00%

Published-12 Apr, 2018 | 15:00

Updated-06 Aug, 2024 | 06:18

Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in nextend-Twitter-connect.php in the Nextend Twitter Connect plugin before 1.5.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirect_to parameter. NOTE: this may overlap CVE-2015-4413.

Vendor-nextendweb n/a

Product-nextend_twitter_connect n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.36% / 58.16%

||

7 Day CHG~0.00%

Published-04 Feb, 2019 | 19:00

Updated-17 Sep, 2024 | 01:01

Reflected Cross Site Scripting (XSS) exists in ZoneMinder through 1.32.3, allowing an attacker to execute HTML or JavaScript code via a vulnerable 'Exportfile' parameter value in the view download (download.php) because proper filtration is omitted.

Vendor-zoneminder n/a

Product-zoneminder n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 49.71%

||

7 Day CHG~0.00%

Published-07 May, 2010 | 18:23

Updated-29 Apr, 2026 | 01:13

Multiple cross-site scripting (XSS) vulnerabilities in SemanticScuttle before 0.94.1 allow remote attackers to inject arbitrary web script or HTML via the sort parameter to index.php, and other unspecified vectors, a different issue than CVE-2008-6113. NOTE: some of these details are obtained from third party information.

Vendor-festic n/a

Product-semanticscuttle n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Adobe Systems Incorporated

Matching Score-4

Assigner-Adobe Systems Incorporated

CVSS Score-6.1||MEDIUM

EPSS-0.05% / 14.78%

||

7 Day CHG~0.00%

Published-05 Nov, 2019 | 23:49

Updated-04 Aug, 2024 | 21:10

A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Successful exploitation of this vulnerability would result in an attacker being able to bypass the `escapeURL()` function and execute a malicious XSS payload.

Vendor-magento Adobe Inc.

Product-magento Magento 2

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.26% / 49.45%

||

7 Day CHG~0.00%

Published-13 May, 2019 | 13:52

Updated-04 Aug, 2024 | 20:46

Multiple cross-site scripting (XSS) vulnerabilities in ProfileDesign CMS v6.0.2.5 allows remote attackers to inject arbitrary web script or HTML via the (1) page, (2) gbs, (3) side, (4) id, (5) imgid, (6) cat, or (7) orderby parameter.

Vendor-vegadesign n/a

Product-profiledesign_cms n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')