ByteOS Network

Vulnerability Details :

CVE-2014-4555

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-02 Jul, 2014 | 20:00

Updated At-06 Aug, 2024 | 11:20

Cross-site scripting (XSS) vulnerability in fonts/font-form.php in the Style It plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the mode parameter.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:02 Jul, 2014 | 20:00

Updated At:06 Aug, 2024 | 11:20

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

n/a

Product

n/a

Versions

Affected

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

References

Hyperlink	Resource
http://codevigilant.com/disclosure/wp-plugin-style-it-a3-cross-site-scripting-xss	x_refsource_MISC

Hyperlink: http://codevigilant.com/disclosure/wp-plugin-style-it-a3-cross-site-scripting-xss

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
http://codevigilant.com/disclosure/wp-plugin-style-it-a3-cross-site-scripting-xss	x_refsource_MISC x_transferred

Hyperlink: http://codevigilant.com/disclosure/wp-plugin-style-it-a3-cross-site-scripting-xss

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:cve@mitre.org

Published At:02 Jul, 2014 | 20:55

Updated At:12 Apr, 2025 | 10:46

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

style_it_project>>style_it>>Versions up to 1.0(inclusive)

cpe:2.3:a:style_it_project:style_it:*:-:-:*:-:wordpress:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://codevigilant.com/disclosure/wp-plugin-style-it-a3-cross-site-scripting-xss	cve@mitre.org	Exploit
http://codevigilant.com/disclosure/wp-plugin-style-it-a3-cross-site-scripting-xss	af854a3a-2127-422b-91ae-364da2661108	Exploit

Hyperlink: http://codevigilant.com/disclosure/wp-plugin-style-it-a3-cross-site-scripting-xss

Source: cve@mitre.org

Resource:

Exploit

Hyperlink: http://codevigilant.com/disclosure/wp-plugin-style-it-a3-cross-site-scripting-xss

Source: af854a3a-2127-422b-91ae-364da2661108

Resource:

Exploit

Similar CVEs

12240Records found

CVE-2009-2352

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.91% / 75.44%

7 Day CHG~0.00%

Published-07 Jul, 2009 | 23:00

Updated-07 Aug, 2024 | 05:44

Google Chrome 1.0.154.48 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312. NOTE: it was later reported that 2.0.172.28, 2.0.172.37, and 3.0.193.2 Beta are also affected.

Vendor-n/a Google LLC

Product-chrome n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-8347

Matching Score-4

Assigner-Lenovo Group Ltd.

View Details

Matching Score-4

Assigner-Lenovo Group Ltd.

CVSS Score-6.1||MEDIUM

EPSS-0.70% / 71.61%

7 Day CHG~0.00%

Published-24 Sep, 2020 | 21:05

Updated-04 Aug, 2024 | 09:56

A reflective cross-site scripting (XSS) vulnerability was reported in Lenovo Enterprise Network Disk prior to version 6.1 patch 6 hotfix 4 that could allow execution of code in an authenticated user's browser if a crafted url is visited, possibly through phishing.

Vendor-Lenovo Group Limited

Product-enterprise_network_disk Enterprise Network Disk

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1536

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.79% / 73.49%

7 Day CHG~0.00%

Published-08 Nov, 2007 | 20:00

Updated-03 Apr, 2025 | 01:03

Multiple cross-site scripting (XSS) vulnerabilities in Codeworx Technologies DCP-Portal 5.3.1 allow remote attackers to inject arbitrary web script or HTML via (1) the q parameter to search.php and (2) the year parameter to calendar.php.

Vendor-dcp-portal n/a

Product-dcp-portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9711

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.74% / 72.50%

7 Day CHG~0.00%

Published-25 Mar, 2015 | 14:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site scripting (XSS) vulnerabilities in the Investigative Reports in Websense TRITON AP-WEB before 8.0.0 and Web Security and Filter, Web Security Gateway, and Web Security Gateway Anywhere 7.8.3 before Hotfix 02 and 7.8.4 before Hotfix 01 allow remote attackers to inject arbitrary web script or HTML via the (1) ReportName (Job Name) parameter to the Explorer report scheduler (cgi-bin/WsCgiExplorerSchedule.exe) in the Job Queue or the col parameter to the (2) Names or (3) Anonymous (explorer_wse/explorer_anon.exe) summary report page.

Vendor-websense n/a

Product-triton_ap_web triton_web_security_gateway triton_web_security_gateway_anywhere triton_web_filter triton_web_security n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1549

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.50% / 65.65%

7 Day CHG~0.00%

Published-06 Mar, 2008 | 01:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in header.php in MyABraCaDaWeb 1.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the ma_kw parameter.

Vendor-myabracadaweb n/a

Product-myabracadaweb n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9443

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 57.50%

7 Day CHG~0.00%

Published-02 Jan, 2015 | 19:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-relevanssi n/a

Product-relevanssi n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9241

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.02% / 76.88%

7 Day CHG~0.00%

Published-03 Dec, 2014 | 21:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site scripting (XSS) vulnerabilities in MyBB (aka MyBulletinBoard) 1.8.x before 1.8.2 allow remote attackers to inject arbitrary web script or HTML via the (1) type parameter to report.php, (2) signature parameter in a do_editsig action to usercp.php, or (3) title parameter in the style-templates module in an edit_template action or (4) file parameter in the config-languages module in an edit action to admin/index.php.

Vendor-n/a MyBB

Product-mybb n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-6561

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.20% / 41.90%

7 Day CHG~0.00%

Published-02 Feb, 2018 | 15:00

Updated-16 Sep, 2024 | 23:41

dijit.Editor in Dojo Toolkit 1.13 allows XSS via the onload attribute of an SVG element.

Vendor-n/a Dojo (OpenJS Foundation)

Product-dojo n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9514

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.16% / 37.42%

7 Day CHG~0.00%

Published-28 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Cross-site scripting (XSS) vulnerability in BMC Footprints Service Core 11.5.

Vendor-bmc n/a

Product-footprints_service_core n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-6958

Matching Score-4

Assigner-VMware by Broadcom

View Details

Matching Score-4

Assigner-VMware by Broadcom

CVSS Score-6.1||MEDIUM

EPSS-0.22% / 44.64%

7 Day CHG~0.00%

Published-13 Apr, 2018 | 13:00

Updated-17 Sep, 2024 | 02:57

VMware vRealize Automation (vRA) prior to 7.3.1 contains a vulnerability that may allow for a DOM-based cross-site scripting (XSS) attack. Exploitation of this issue may lead to the compromise of the vRA user's workstation.

Vendor-VMware (Broadcom Inc.)

Product-vrealize_automation vRealize Automation

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-6528

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.63% / 69.93%

7 Day CHG~0.00%

Published-06 Mar, 2018 | 20:00

Updated-05 Aug, 2024 | 06:10

XSS vulnerability in htdocs/webinc/body/bsc_sms_send.php in D-Link DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-865L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to read a cookie via a crafted receiver parameter to soap.cgi.

Vendor-n/a D-Link Corporation

Product-dir-868l_firmware dir-865l_firmware dir-868l dir-860l dir-865l dir-860l_firmware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9919

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.21% / 43.44%

7 Day CHG~0.00%

Published-15 May, 2019 | 13:17

Updated-06 Aug, 2024 | 14:02

An issue was discovered in Bilboplanet 2.0. Stored XSS exists in the fullname parameter to signup.php.

Vendor-bilboplanet n/a

Product-bilboplanet n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-8340

Matching Score-4

Assigner-Lenovo Group Ltd.

View Details

Matching Score-4

Assigner-Lenovo Group Ltd.

CVSS Score-6.3||MEDIUM

EPSS-0.24% / 47.50%

7 Day CHG~0.00%

Published-15 Sep, 2020 | 14:20

Updated-17 Sep, 2024 | 01:25

A cross-site scripting (XSS) vulnerability was discovered in the legacy IBM and Lenovo System x IMM2 (Integrated Management Module 2), prior to version 5.60, embedded Baseboard Management Controller (BMC) web interface during an internal security review. This vulnerability could allow JavaScript code to be executed in the user's web browser if the user is convinced to visit a crafted URL, possibly through phishing. Successful exploitation requires specific knowledge about the user’s network to be included in the crafted URL. Impact is limited to the normal access restrictions and permissions of the user clicking the crafted URL, and subject to the user being able to connect to and already being authenticated to IMM2 or other systems. The JavaScript code is not executed on IMM2 itself.

Vendor-IBM Corporation Lenovo Group Limited

Product-flex_system_x3750_m4 flex_system_nx360_m5 flex_system_x480_x6 flex_system_x240_m5 integrated_management_module_2 flex_system_x3950_x6 flex_system_x3500_m5 flex_system_x3250_m6 flex_system_x240 flex_system_x3550_m5 flex_system_x280_x6 flex_system_x880_x6 flex_system_x3850_x6 flex_system_x440 flex_system_x3650_m5 System x IMM2 firmware for: x240, Machine Types: 7162, 2588; x440, Machine Type 7167, 2590 ; x3750 M4, Machine Type: 8753 ; x3250 M6, Machine type 3633, 3943 ; nx360 M5, Machine type 5465, 5467 ; x280/x480/x880 X6 , Machine Type 7196, 4258 ; x3850 X6 and x3950 X6, Machine type 6241 ; x3550 M5, Machine Type 5463, 8869 ; x3650 M5, Machine Type 5462, 8871; x3500 M5, Machine Type 5464, 5478 System x IMM2 firmware System x IMM2 firmware for x240 M5, Machine Types: 9532, 2591

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-3017

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.25% / 48.51%

7 Day CHG~0.00%

Published-31 Aug, 2009 | 16:00

Updated-07 Aug, 2024 | 06:14

Orca Browser 1.2 build 5 does not properly block data: URIs in Refresh and Location headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header that contains JavaScript sequences in a data:text/html URI, (2) entering a data:text/html URI with JavaScript sequences when specifying the content of a Refresh header, (3) injecting a Location header that contains JavaScript sequences in a data:text/html URI, or (4) entering a data:text/html URI with JavaScript sequences when specifying the content of a Location header; and does not properly handle javascript: URIs in HTML links within 302 error documents sent from web servers, which allows user-assisted remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (5) injecting a Location HTTP response header or (6) specifying the content of a Location HTTP response header.

Vendor-orcabrowser n/a

Product-orca_browser n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9500

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 51.59%

7 Day CHG~0.00%

Published-09 Jan, 2015 | 18:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Moip module 7.x-1.x before 7.x-1.4 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors to the notification page callback.

Vendor-moip_project n/a

Product-moip n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9219

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 51.59%

7 Day CHG~0.00%

Published-08 Dec, 2014 | 11:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter.

Vendor-n/a phpMyAdmin

Product-phpmyadmin n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-8981

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.45% / 62.98%

7 Day CHG~0.00%

Published-13 Feb, 2020 | 16:46

Updated-04 Aug, 2024 | 10:19

A cross-site scripting (XSS) vulnerability was discovered in the Source Integration plugin before 1.6.2 and 2.x before 2.3.1 for MantisBT. The repo_delete.php Delete Repository page allows execution of arbitrary code via a repo name (if CSP settings permit it). This is related to CVE-2018-16362.

Vendor-n/a Mantis Bug Tracker (MantisBT)

Product-source_integration n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-8115

Matching Score-4

Assigner-HackerOne

View Details

Matching Score-4

Assigner-HackerOne

CVSS Score-6.1||MEDIUM

EPSS-55.79% / 98.03%

7 Day CHG~0.00%

Published-04 Feb, 2020 | 19:08

Updated-04 Aug, 2024 | 09:48

A reflected XSS vulnerability has been discovered in the publicly accessible afr.php delivery script of Revive Adserver <= 5.0.3 by Jacopo Tediosi. There are currently no known exploits: the session identifier cannot be accessed as it is stored in an http-only cookie as of v3.2.2. On older versions, however, under specific circumstances, it could be possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php script was printed back without proper escaping in a JavaScript context, allowing an attacker to execute arbitrary JS code on the browser of the victim.

Vendor-revive-adserver n/a

Product-revive_adserver https://github.com/revive-adserver/revive-adserver

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2009-2153

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 54.90%

7 Day CHG~0.00%

Published-22 Jun, 2009 | 14:00

Updated-07 Aug, 2024 | 05:44

Cross-site scripting (XSS) vulnerability in index.php in Impleo Music Collection 2.0 allows remote attackers to inject arbitrary web script or HTML via the sort parameter.

Vendor-sappy.dk n/a

Product-impleo_music_collection n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9580

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-3.80% / 87.84%

7 Day CHG~0.00%

Published-08 Jan, 2015 | 19:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in ProjectSend (formerly cFTP) r561 allows remote attackers to inject arbitrary web script or HTML via the Description field in a file upload. NOTE: this issue was originally incorrectly mapped to CVE-2014-1155; see CVE-2014-1155 for more information.

Vendor-projectsend n/a

Product-projectsend n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1348

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-3.48% / 87.32%

7 Day CHG~0.00%

Published-14 Oct, 2007 | 19:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in guestbook.cgi in ftls.org Guestbook 1.1 allows remote attackers to inject arbitrary web script or HTML via the (1) comment, (2) name, or (3) title field.

Vendor-ftls n/a

Product-guestbook n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1519

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.56% / 67.95%

7 Day CHG~0.00%

Published-25 Oct, 2007 | 19:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in Vivisimo clustering engine allows remote attackers to inject arbitrary web script or HTML via the query parameter to the search program.

Vendor-vivisimo n/a

Product-clustering_engine n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-8198

Matching Score-4

Assigner-HackerOne

View Details

Matching Score-4

Assigner-HackerOne

CVSS Score-6.1||MEDIUM

EPSS-0.39% / 59.60%

7 Day CHG~0.00%

Published-10 Jul, 2020 | 15:39

Updated-04 Aug, 2024 | 09:56

Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 resulting in Stored Cross-Site Scripting (XSS).

Vendor-n/a Citrix (Cloud Software Group, Inc.)

Product-4000-wo 4100-wo 5000-wo netscaler_gateway sd-wan_wanop gateway_firmware 5100-wo application_delivery_controller gateway netscaler_gateway_firmware application_delivery_controller_firmware Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-6940

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-8.09% / 91.98%

7 Day CHG~0.00%

Published-20 Feb, 2018 | 15:00

Updated-05 Aug, 2024 | 06:17

A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF.

Vendor-nat32 n/a

Product-nat32 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE ID-CWE-352

Cross-Site Request Forgery (CSRF)

CVE-2020-8238

Matching Score-4

Assigner-HackerOne

View Details

Matching Score-4

Assigner-HackerOne

CVSS Score-6.1||MEDIUM

EPSS-0.13% / 32.64%

7 Day CHG~0.00%

Published-29 Sep, 2020 | 13:41

Updated-04 Aug, 2024 | 09:56

A vulnerability in the authenticated user web interface of Pulse Connect Secure and Pulse Policy Secure < 9.1R8.2 could allow attackers to conduct Cross-Site Scripting (XSS).

Vendor-Ivanti Software Pulse Secure

Product-pulse_policy_secure policy_secure pulse_connect_secure connect_secure Pulse Connect Secure/ Pulse Policy Secure

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1522

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.56% / 67.95%

7 Day CHG~0.00%

Published-25 Oct, 2007 | 19:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in PSCS VPOP3 Web Mail server 2.0e and 2.0f allows remote attackers to inject arbitrary web script or HTML via the redirect parameter to the admin/index.html page.

Vendor-pscs n/a

Product-vpop3_web_mail_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-8035

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.45% / 63.23%

7 Day CHG~0.00%

Published-18 May, 2020 | 14:55

Updated-04 Aug, 2024 | 09:48

The image view functionality in Horde Groupware Webmail Edition before 5.2.22 is affected by a stored Cross-Site Scripting (XSS) vulnerability via an SVG image upload containing a JavaScript payload. An attacker can obtain access to a victim's webmail account by making them visit a malicious URL.

Vendor-n/a Horde LLC

Product-groupware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-8421

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-1.26% / 79.12%

7 Day CHG~0.00%

Published-28 Jan, 2020 | 20:58

Updated-04 Aug, 2024 | 09:56

An issue was discovered in Joomla! before 3.9.15. Inadequate escaping of usernames allows XSS attacks in com_actionlogs.

Vendor-n/a Joomla!

Product-joomla\!n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1585

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.06%

7 Day CHG~0.00%

Published-05 Feb, 2010 | 22:13

Updated-11 Apr, 2025 | 00:51

Cross-site scripting (XSS) vulnerability in WebLogExpert allows remote attackers to inject arbitrary web script or HTML via a crafted client domain name, related to an "Inverse Lookup Log Corruption (ILLC)" issue.

Vendor-alentum n/a

Product-weblog_expert n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1334

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.25% / 47.66%

7 Day CHG~0.00%

Published-23 Aug, 2007 | 01:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in Kai Blankenhorn Bitfolge simple and nice index file (aka snif) before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-kai_blankenhorn_bitfolge n/a

Product-simple_and_nice_index_file n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9582

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.45% / 63.33%

7 Day CHG~0.00%

Published-08 Jan, 2015 | 20:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in components/filemanager/dialog.php in Codiad 2.4.3 allows remote attackers to inject arbitrary web script or HTML via the short_name parameter in a rename action. NOTE: this issue was originally incorrectly mapped to CVE-2014-1137; see CVE-2014-1137 for more information.

Vendor-codiad n/a

Product-codiad n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1539

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 51.60%

7 Day CHG~0.00%

Published-10 Jan, 2008 | 01:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in ONEdotOH Simple File Manager (SFM) before 0.21 allows remote attackers to inject arbitrary web script or HTML via (1) file names and (2) directory names.

Vendor-onedotoh n/a

Product-simple_file_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-8788

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.33% / 55.49%

7 Day CHG~0.00%

Published-07 Feb, 2020 | 13:07

Updated-04 Aug, 2024 | 10:12

Synaptive Medical ClearCanvas ImageServer 3.0 Alpha allows XSS (and HTML injection) via the Default.aspx UserName parameter. NOTE: the issues/227 reference does not imply that the affected product can be downloaded from GitHub. It was simply a convenient location for a public bug report.

Vendor-synaptivemedical n/a

Product-clearcanvas n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9607

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-8.96% / 92.43%

7 Day CHG~0.00%

Published-19 Feb, 2020 | 19:39

Updated-06 Aug, 2024 | 13:47

Cross-site scripting (XSS) vulnerability in remotereporter/load_logfiles.php in Netsweeper 4.0.3 and 4.0.4 allows remote attackers to inject arbitrary web script or HTML via the url parameter.

Vendor-netsweeper n/a

Product-netsweeper n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9557

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.33% / 55.30%

7 Day CHG~0.00%

Published-28 Aug, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

Multiple cross-site scripting (XSS) vulnerabilities in SmartCMS v.2.

Vendor-smartwebsites n/a

Product-smartcms n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9429

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.03%

7 Day CHG~0.00%

Published-31 Dec, 2014 | 22:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site scripting (XSS) vulnerabilities in Smoothwall Express 3.1 and 3.0 SP3 allow remote attackers to inject arbitrary web script or HTML via the (1) PROFILENAME parameter in a Save action to httpd/cgi-bin/pppsetup.cgi or (2) COMMENT parameter in an Add action to httpd/cgi-bin/ddns.cgi.

Vendor-smoothwall n/a

Product-smoothwall n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-8262

Matching Score-4

Assigner-HackerOne

View Details

Matching Score-4

Assigner-HackerOne

CVSS Score-6.1||MEDIUM

EPSS-0.14% / 34.75%

7 Day CHG~0.00%

Published-28 Oct, 2020 | 12:47

Updated-04 Aug, 2024 | 09:56

A vulnerability in the Pulse Connect Secure / Pulse Policy Secure below 9.1R9 could allow attackers to conduct Cross-Site Scripting (XSS) and Open Redirection for authenticated user web interface.

Vendor-n/a Ivanti Software Pulse Secure

Product-pulse_policy_secure policy_secure pulse_connect_secure connect_secure Pulse Connect Secure / Pulse Policy Secure

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9649

Matching Score-4

Assigner-Canonical Ltd.

View Details

Matching Score-4

Assigner-Canonical Ltd.

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 52.45%

7 Day CHG~0.00%

Published-27 Jan, 2015 | 17:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the management plugin in RabbitMQ 2.1.0 through 3.4.x before 3.4.1 allows remote attackers to inject arbitrary web script or HTML via the path info to api/, which is not properly handled in an error message.

Vendor-n/a VMware (Broadcom Inc.)Broadcom Inc.

Product-rabbitmq_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-5003

Matching Score-4

Assigner-IBM Corporation

View Details

Matching Score-4

Assigner-IBM Corporation

CVSS Score-5||MEDIUM

EPSS-0.29% / 52.40%

7 Day CHG~0.00%

Published-28 Mar, 2022 | 20:45

Updated-08 Aug, 2024 | 03:15

ISS BlackICE PC Protection Update cross site scriting

A vulnerability was found in ISS BlackICE PC Protection. It has been rated as problematic. Affected by this issue is the Update Handler. The manipulation with an unknown input leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Vendor-ISS IBM Corporation

Product-iss_blackice_pc_protection BlackICE PC Protection

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-20751

Matching Score-4

Assigner-JPCERT/CC

View Details

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-6.1||MEDIUM

EPSS-0.59% / 68.80%

7 Day CHG+0.27%

Published-28 Jun, 2021 | 00:50

Updated-03 Aug, 2024 | 17:53

Cross-site scripting vulnerability in EC-CUBE EC-CUBE 4.0.0 to 4.0.5-p1 (EC-CUBE 4 series) allows a remote attacker to inject an arbitrary script by leading an administrator or a user to a specially crafted page and to perform a specific operation.

Vendor-ec-cube EC-CUBE CO.,LTD.

Product-ec-cube EC-CUBE

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1511

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.57% / 68.02%

7 Day CHG~0.00%

Published-25 Oct, 2007 | 19:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in Bajie Java HTTP Server 0.95 through 0.95zxv4 allows remote attackers to inject arbitrary web script or HTML via (1) the query string to test.txt, (2) the guestName parameter to the custMsg servlet, or (3) the cookiename parameter to the CookieExample servlet.

Vendor-bajie n/a

Product-java_http_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-6834

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.33% / 55.49%

7 Day CHG~0.00%

Published-08 Feb, 2018 | 07:00

Updated-05 Aug, 2024 | 06:17

static/js/pad_utils.js in Etherpad Lite before v1.6.3 has XSS via window.location.href.

Vendor-etherpad n/a

Product-etherpad_lite n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1384

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.55% / 67.53%

7 Day CHG~0.00%

Published-19 Oct, 2007 | 10:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in index.php in PY-Livredor 1.0 allows remote attackers to insert arbitrary web script or HTML via the (1) titre, (2) Votre pseudo, (3) Votre e-mail, or (4) Votre message fields.

Vendor-py_software n/a

Product-py-livredor n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-8839

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.85% / 74.57%

7 Day CHG~0.00%

Published-12 Feb, 2020 | 14:42

Updated-04 Aug, 2024 | 10:12

Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Converter devices before 1.16.00, as demonstrated by the /if.cgi TF_submask field.

Vendor-chiyu-t n/a

Product-bf-430_firmware bf-430 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2021-20741

Matching Score-4

Assigner-JPCERT/CC

View Details

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-6.1||MEDIUM

EPSS-0.59% / 68.80%

7 Day CHG~0.00%

Published-22 Jun, 2021 | 01:35

Updated-03 Aug, 2024 | 17:53

Cross-site scripting vulnerability in Hitachi Application Server Help (Hitachi Application Server V10 Manual (Windows) version 10-11-01 and earlier and Hitachi Application Server V10 Manual (UNIX) version 10-11-01 and earlier) allows a remote attacker to inject an arbitrary script via unspecified vectors.

Vendor-Hitachi, Ltd.

Product-application_server_v10_manual Hitachi Application Server Help

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1400

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.25% / 47.70%

7 Day CHG+0.13%

Published-19 Oct, 2007 | 10:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in the Your_Account module for PHP-Nuke 5.0 through 6.0 allows remote attackers to inject arbitrary web script or HTML via the user_avatar parameter.

Vendor-francisco_burzi n/a

Product-php-nuke n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2014-9271

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.4||MEDIUM

EPSS-0.83% / 74.27%

7 Day CHG~0.00%

Published-09 Jan, 2015 | 18:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in file_download.php in MantisBT before 1.2.18 allows remote authenticated users to inject arbitrary web script or HTML via a Flash file with an image extension, related to inline attachments, as demonstrated by a .swf.jpeg filename.

Vendor-n/a Mantis Bug Tracker (MantisBT)Debian GNU/Linux

Product-debian_linux mantisbt n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2003-1372

Matching Score-4

Assigner-MITRE Corporation

View Details

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.59% / 68.86%

7 Day CHG~0.00%

Published-17 Oct, 2007 | 01:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in links.php script in myPHPNuke 1.8.8, and possibly earlier versions, allows remote attackers to inject arbitrary HTML and web script via the (1) ratenum or (2) query parameters.