CVE-2019-10087 | ByteOS Network

Vulnerability Details :

CVE-2019-10087

Assigner-apache

Assigner Org ID-f0158376-9dc2-43b6-827c-5f631a4d8d09

Published At-23 Sep, 2019 | 14:47

Updated At-04 Aug, 2024 | 22:10

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:apache

Assigner Org ID:f0158376-9dc2-43b6-827c-5f631a4d8d09

Published At:23 Sep, 2019 | 14:47

Updated At:04 Aug, 2024 | 22:10

▼CVE Numbering Authority (CNA)

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Affected Products

Vendor

Product

Versions

Affected

Apache JSPWiki up to 2.11.0.M4

Problem Types

Type	CWE ID	Description
text	N/A	Information Disclosure

Type: text

CWE ID: N/A

Description: Information Disclosure

References

Hyperlink	Resource
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10087	x_refsource_MISC

Hyperlink: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10087

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10087	x_refsource_MISC x_transferred

Hyperlink: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10087

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:security@apache.org

Published At:23 Sep, 2019 | 15:15

Updated At:23 Sep, 2019 | 19:08

On Apache JSPWiki, up to version 2.11.0.M4, a carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki, related to the Page Revision History, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N

Type: Primary

Version: 3.1

Base score: 6.1

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Type: Primary

Version: 2.0

Base score: 4.3

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:N/I:P/A:N

CPE Matches

The Apache Software Foundation

>>jspwiki>>Versions up to 2.10.5(inclusive)

cpe:2.3:a:apache:jspwiki:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m1:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc1:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc2:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m1-rc3:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m2:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m2-rc1:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m3:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m3-rc1:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m3-rc2:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m4:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m4-rc1:*:*:*:*:*:*

The Apache Software Foundation

>>jspwiki>>2.11.0

cpe:2.3:a:apache:jspwiki:2.11.0:m4-rc2:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10087	security@apache.org	Vendor Advisory

Hyperlink: https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10087

Source: security@apache.org

Resource:

Vendor Advisory

Similar CVEs

18601Records found

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.42% / 61.56%

||

7 Day CHG~0.00%

Published-30 Sep, 2014 | 16:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the DHCP clients page in the TP-LINK N750 Wireless Dual Band Gigabit Router (TL-WDR4300) with firmware before 140916 allows remote attackers to inject arbitrary web script or HTML via the hostname in a DHCP request.

Vendor-n/a TP-Link Systems Inc.

Product-tl-wdr4300 tl-wdr4300_firmware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.51% / 65.86%

||

7 Day CHG~0.00%

Published-09 Oct, 2007 | 10:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in P4DB 2.01 and earlier allows remote attackers to inject arbitrary web script or HTML via (1) SET_PREFERENCES parameter in SetPreferences.cgi; (2) BRANCH parameter in branchView.cgi; (3) FSPC and (4) COMPLETE parameters in changeByUsers.cgi; (5) FSPC, (6) LABEL, (7) EXLABEL, (8) STATUS, (9) MAXCH, (10) FIRSTCH, (11) CHOFFSETDISP, (12) SEARCHDESC, (13) SEARCH_INVERT, (14) USER, (15) GROUP, and (16) CLIENT parameters in changeList.cgi; (17) CH parameter in changeView.cgi; (18) USER parameter in clientList.cgi; (19) CLIENT parameter in clientView.cgi; (20) FSPC parameter in depotTreeBrowser.cgi; (21) FSPC parameter in depotStats.cgi; (22) FSPC, (23) REV, (24) ACT, (25) FSPC2, (26) REV2, (27) CH, and (28) CONTEXT parameters in fileDiffView.cgi; (29) FSPC and (30) REV parameters in fileDownLoad.cgi; (31) FSPC, (32) LISTLAB, and (33) SHOWBRANCH parameters in fileLogView.cgi; (34) FSPC and (35) LABEL parameters in fileSearch.cgi; (36) FSPC, (37) REV, and (38) FORCE parameters in fileViewer.cgi; (39) FSPC parameter in filesChangedSince.cgi; (40) GROUP parameter in groupView.cgi; (41) TYPE, (42) FSPC, and (43) REV parameters in htmlFileView.cgi; (44) CMD parameter in javaDataView.cgi; (45) JOBVIEW and (46) FLD parameters in jobList.cgi; (47) JOB parameter in jobView.cgi; (48) LABEL1 and (49) LABEL2 parameters in labelDiffView.cgi; (50) LABEL parameter in labelView.cgi; (51) FSPC parameter in searchPattern.cgi; (52) TYPE, (53) FSPC, and (54) REV parameters in specialFileView.cgi; (55) GROUPSONLY parameter in userList.cgi; or (56) USER parameter in userView.cgi.

Vendor-fredric_fredricson n/a

Product-p4db n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Wordfence

Matching Score-4

Assigner-Wordfence

CVSS Score-6.1||MEDIUM

EPSS-0.21% / 43.40%

||

7 Day CHG~0.00%

Published-09 Sep, 2021 | 18:10

Updated-05 May, 2025 | 16:39

Konnichiwa! Membership <= 0.8.3 Reflected Cross-Site Scripting

The Konnichiwa! Membership WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the plan_id parameter in the ~/views/subscriptions.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.8.3.

Vendor-kibokolabs Konnichiwa! Membership

Product-konnichiwa Konnichiwa! Membership

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.44%

||

7 Day CHG~0.00%

Published-11 Jul, 2014 | 20:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site scripting (XSS) vulnerabilities in FortiGuard FortiWeb 5.0.x, 5.1.x, and 5.2.x before 5.2.1 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) user/ldap_user/check_dlg or (2) user/radius_user/check_dlg.

Vendor-n/a Fortinet, Inc.

Product-fortiweb n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-4.3||MEDIUM

EPSS-0.33% / 55.32%

||

7 Day CHG~0.00%

Published-09 Jun, 2022 | 22:36

Updated-15 Apr, 2025 | 14:29

HumHub Reflected cross site scriting

A vulnerability has been found in HumHub up to 1.0.1 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting (Reflected). The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.1 is able to address this issue. It is recommended to upgrade the affected component.

Vendor-humhub unspecified

Product-humhub HumHub

CWE ID-CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-VulDB

Matching Score-4

Assigner-VulDB

CVSS Score-3.5||LOW

EPSS-0.06% / 17.52%

||

7 Day CHG~0.00%

Published-06 Jun, 2023 | 02:00

Updated-05 Aug, 2024 | 22:15

Fuzzy SWMP GET Parameter swmp.php cross site scripting

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Fuzzy SWMP. It has been rated as problematic. This issue affects some unknown processing of the file swmp.php of the component GET Parameter Handler. The manipulation of the argument theme leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The identifier of the patch is 792bcab637cb8c3bd251d8fc8771512c5329a93e. It is recommended to apply a patch to fix this issue. The identifier VDB-230669 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Vendor-server_web_monitor_page_project Fuzzy

Product-server_web_monitor_page SWMP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.17% / 38.87%

||

7 Day CHG~0.00%

Published-01 Jul, 2014 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in test-plugin.php in the Swipe Checkout for eShop plugin 3.7.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the api_url parameter.

Vendor-swipe_checkout_for_eshop_project n/a

Product-swipe_checkout_for_eshop n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-4.7||MEDIUM

EPSS-0.31% / 53.81%

||

7 Day CHG~0.00%

Published-26 Apr, 2022 | 18:13

Updated-20 Feb, 2025 | 20:25

WordPress Tripetto plugin <= 5.1.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability via SVG image upload

Unauthenticated Cross-Site Scripting (XSS) vulnerability in Tripetto's Tripetto plugin <= 5.1.4 on WordPress via SVG image upload.

Vendor-tripetto Tripetto

Product-tripetto Tripetto (WordPress plugin)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-6.1||MEDIUM

EPSS-0.03% / 10.02%

||

7 Day CHG~0.00%

Published-30 Dec, 2025 | 06:00

Updated-31 Dec, 2025 | 20:43

Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via taxo_ajax

The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Vendor-Unknown

Product-Advance WP Query Search Filter

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Protect AI (formerly huntr.dev)

Matching Score-4

Assigner-Protect AI (formerly huntr.dev)

CVSS Score-6.6||MEDIUM

EPSS-0.36% / 57.36%

||

7 Day CHG~0.00%

Published-15 Sep, 2021 | 12:00

Updated-03 Aug, 2024 | 17:09

Cross-site Scripting (XSS) - Reflected in yourls/yourls

yourls is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Vendor-yourls yourls

Product-yourls yourls/yourls

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-3.87% / 87.99%

||

7 Day CHG~0.00%

Published-17 Jul, 2021 | 18:13

Updated-04 Aug, 2024 | 01:01

Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.

Vendor-n/a Zoho Corporation Pvt. Ltd.

Product-manageengine_admanager_plus n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.17% / 37.77%

||

7 Day CHG~0.00%

Published-21 Apr, 2020 | 18:30

Updated-05 Aug, 2024 | 21:37

Certain NETGEAR devices are affected by reflected XSS. This affects R6700v2 before 1.1.0.42 and R6800 before 1.1.0.42.

Vendor-n/a NETGEAR, Inc.

Product-r6700_firmware r6800 r6800_firmware r6700 n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.22% / 45.06%

||

7 Day CHG~0.00%

Published-28 Jul, 2014 | 15:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site scripting (XSS) vulnerabilities in ol-commerce 2.1.1 allow remote attackers to inject arbitrary web script or HTML via the (1) a_country parameter in a process action to affiliate_signup.php or (2) entry_country_id parameter in an edit action to admin/create_account.php.

Vendor-ol-commerce_project n/a

Product-ol-commerce n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5||MEDIUM

EPSS-0.33% / 55.66%

||

7 Day CHG~0.00%

Published-22 Apr, 2020 | 14:29

Updated-05 Aug, 2024 | 21:37

Certain NETGEAR devices are affected by XSS. This affects D6200 before 1.1.00.24, D7000 before 1.0.1.52, JNR1010v2 before 1.1.0.44, JR6150 before 1.0.1.12, JWNR2010v5 before 1.1.0.44, PR2000 before 1.0.0.20, R6020 before 1.0.0.26, R6050 before 1.0.1.12, R6080 before 1.0.0.26, R6120 before 1.0.0.36, R6220 before 1.1.0.60, R6700v2 before 1.2.0.12, R6800 before 1.2.0.12, R6900v2 before 1.2.0.12, WNDR3700v5 before 1.1.0.50, WNR1000v4 before 1.1.0.44, WNR2020 before 1.1.0.44, and WNR2050 before 1.1.0.44.

Vendor-n/a NETGEAR, Inc.

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.42% / 61.63%

||

7 Day CHG~0.00%

Published-16 Jun, 2014 | 18:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in ntop allows remote attackers to inject arbitrary web script or HTML via the title parameter in a list action to plugins/rrdPlugin.

Vendor-ntop n/a openSUSE

Product-opensuse ntop n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.36% / 57.65%

||

7 Day CHG~0.00%

Published-19 Jun, 2020 | 19:21

Updated-05 Aug, 2024 | 21:45

An issue was discovered in Mattermost Server before 3.6.0 and 3.5.2. XSS can occur via a link on an error page.

Vendor-n/a Mattermost, Inc.

Product-mattermost_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.10% / 28.60%

||

7 Day CHG~0.00%

Published-13 Aug, 2019 | 16:39

Updated-05 Aug, 2024 | 21:28

The htaccess plugin before 1.7.6 for WordPress has multiple XSS issues.

Vendor-n/a BestWebSoft

Product-htaccess n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.49% / 80.80%

||

7 Day CHG~0.00%

Published-10 May, 2005 | 04:00

Updated-03 Apr, 2025 | 01:03

Multiple cross-site scripting (XSS) vulnerabilities in index.jsp for Liferay before 2.2.0 release 10/1/2004 allow remote attackers to inject arbitrary web script or HTML, as demonstrated using the message subject.

Vendor-n/a Liferay Inc.

Product-liferay_enterprise_portal n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.21% / 43.40%

||

7 Day CHG~0.00%

Published-13 Aug, 2019 | 16:37

Updated-05 Aug, 2024 | 21:28

The liveforms plugin before 3.4.0 for WordPress has XSS.

Vendor-n/a W3 Eden, Inc.

Product-live_forms n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.17% / 38.87%

||

7 Day CHG~0.00%

Published-02 Jul, 2014 | 18:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in wp-plugins-net/index.php in the WP Plugin Manager (wppm) plugin 1.6.4.b and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filter parameter.

Vendor-wp_plugin_manager_project n/a

Product-wp_plugin_manager n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.50% / 65.73%

||

7 Day CHG~0.00%

Published-20 Jul, 2018 | 00:00

Updated-05 Aug, 2024 | 22:15

The debug handler in Symfony before v2.7.33, 2.8.x before v2.8.26, 3.x before v3.2.13, and 3.3.x before v3.3.6 has XSS via an array key during exception pretty printing in ExceptionHandler.php, as demonstrated by a /_debugbar/open?op=get URI. NOTE: the vendor's position is that this is not a vulnerability because the debug tools are not intended for production use. NOTE: the Symfony Debug component is used by Laravel Debugbar

Vendor-sensiolabs n/a

Product-symfony n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-JPCERT/CC

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-4.3||MEDIUM

EPSS-0.32% / 54.81%

||

7 Day CHG~0.00%

Published-19 Oct, 2014 | 01:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in BirdBlog allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-birdblog n/a

Product-birdblog n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-5.2||MEDIUM

EPSS-0.19% / 40.94%

||

7 Day CHG~0.00%

Published-23 Apr, 2020 | 15:34

Updated-05 Aug, 2024 | 21:37

Certain NETGEAR devices are affected by stored XSS. This affects R6400 before 1.0.1.14, R6700 before 1.0.1.22, R6900 before 1.0.1.22, R7000 before 1.0.9.4, R7100LG before 1.0.0.32, R7300DST before 1.0.0.56, R7900 before 1.0.1.12, R8000 before 1.0.3.24, and R8500 before 1.0.2.74.

Vendor-n/a NETGEAR, Inc.

Product-r8500 r6700 r8000 r6400_firmware r7000 r7100lg r7900 r6900 r6900_firmware r7100lg_firmware r7300dst_firmware r8500_firmware r7900_firmware r7000_firmware r7300dst r6400 r6700_firmware r8000_firmware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.08% / 23.51%

||

7 Day CHG~0.00%

Published-08 Dec, 2023 | 00:00

Updated-02 Aug, 2024 | 20:45

Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via a crafted request to the sortBy parameter.

Vendor-evershop n/a

Product-evershop n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.17% / 38.87%

||

7 Day CHG~0.00%

Published-01 Jul, 2014 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in process.php in the Malware Finder plugin 1.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the query parameter.

Vendor-malware_finder_plugin_project n/a

Product-malware_finder n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.28% / 50.84%

||

7 Day CHG~0.00%

Published-14 Nov, 2007 | 02:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in the Downloads module in PostNuke up to 0.726, and possibly later versions, allows remote attackers to inject arbitrary HTML and web script via the ttitle parameter in a viewdownloaddetails action.

Vendor-postnuke_software_foundation n/a

Product-postnuke n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.50% / 65.41%

||

7 Day CHG~0.00%

Published-11 Sep, 2014 | 15:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in Avolve Software ProjectDox 8.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-avolvesoftware n/a

Product-projectdox n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-JPCERT/CC

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-6.1||MEDIUM

EPSS-0.31% / 54.06%

||

7 Day CHG~0.00%

Published-25 Mar, 2020 | 01:25

Updated-04 Aug, 2024 | 08:30

Cross-site scripting vulnerability in WL-Enq 1.11 and 1.12 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-wl-enq_project WonderLink

Product-wl-enq WL-Enq

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.85% / 85.98%

||

7 Day CHG~0.00%

Published-11 Jun, 2014 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in booking_details.php in Best Soft Inc. (BSI) Advance Hotel Booking System 2.0 allows remote attackers to inject arbitrary web script or HTML via the title parameter.

Vendor-bestsoftinc n/a

Product-advance_hotel_booking_system n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.09% / 25.28%

||

7 Day CHG~0.00%

Published-16 Mar, 2023 | 14:45

Updated-18 Aug, 2024 | 22:15

WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WPMU DEV Forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.14.11.

Vendor-Incsub, LLC

Product-forminator Forminator forminator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.58% / 68.59%

||

7 Day CHG~0.00%

Published-06 Jan, 2020 | 19:41

Updated-06 Aug, 2024 | 10:50

Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) gfm codeblocks (language) or (2) javascript url's.

Vendor-marked_project n/a

Product-marked n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-7.5||HIGH

EPSS-0.54% / 67.32%

||

7 Day CHG~0.00%

Published-06 Nov, 2023 | 17:41

Updated-04 Sep, 2024 | 19:32

Visual editor persistent Cross-site Scripting (XSS) in MyBB

MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, resulting in a DOM-based XSS vulnerability. This weakness can be exploited by pointing a victim to a page where the visual editor is active (e.g. as a post or Private Message) and operates on a maliciously crafted MyCode message. This may occur on pages where message content is pre-filled using a GET/POST parameter, or on reply pages where a previously saved malicious message is quoted. The impact is be mitigated when: 1. the visual editor is disabled globally (_Admin CP → Configuration → Settings → Clickable Smilies and BB Code: [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_ is set to _Off_), or 2. the visual editor is disabled for individual user accounts (_User CP → Your Profile → Edit Options_: _Show the MyCode formatting options on the posting pages_ checkbox is not checked). MyBB 1.8.37 resolves this issue with the commit `6dcaf0b4d`. Users are advised to upgrade. Users unable to upgrade may mitigate the impact without upgrading MyBB by changing the following setting (_Admin CP → Configuration → Settings_): - _Clickable Smilies and BB Code → [Clickable MyCode Editor](https://github.com/mybb/mybb/blob/mybb_1836/install/resources/settings.xml#L2087-L2094)_: _Off_. Similarly, individual MyBB forum users are able to disable the visual editor by diabling the account option (_User CP → Your Profile → Edit Options_) _Show the MyCode formatting options on the posting pages_.

Vendor-MyBB

Product-mybb mybb mybb

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.26% / 49.40%

||

7 Day CHG~0.00%

Published-04 Jun, 2014 | 14:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the Documents component in ownCloud Server 6.0.x before 6.0.3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the print_unescaped function.

Vendor-n/a ownCloud GmbH

Product-owncloud_server n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-2.91% / 86.10%

||

7 Day CHG~0.00%

Published-22 Jul, 2010 | 10:00

Updated-11 Apr, 2025 | 00:51

Multiple cross-site scripting (XSS) vulnerabilities in index.php in AdPeeps 8.5d1 allow remote attackers to inject arbitrary web script or HTML via the (1) uid parameter, (2) uid parameter in a login_lookup action, (3) uid parameter in an adminlogin action, (4) campaignid parameter in a createcampaign action, (5) type parameter in a view_account_stats action, (6) period parameter in a view_account_stats action, (7) uid parameter in a view_adrates action, (8) accname parameter in an account_confirmation action, (9) loginpass parameter in an account_confirmation action, (10) e9 parameter in a setup_account action, (11) from parameter in an email_advertisers action, (12) message parameter in an email_advertisers action, (13) idno parameter in an edit_ad_package action, (14) Advertiser Name field, (15) First Name field, (16) Last Name field, (17) Address field, (18) Phone Number field, (19) Password Hint field, or (20) URL field; and (21) allow remote authenticated users to inject arbitrary web script or HTML via an unspecified form associated with a view_adrates action.

Vendor-impactsoftcompany n/a

Product-adpeeps n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.28% / 51.15%

||

7 Day CHG~0.00%

Published-20 Dec, 2017 | 03:00

Updated-20 Apr, 2025 | 01:37

The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication - Clockwork SMS 1.0.2, Booking Calendar - Clockwork SMS 1.0.5, Contact Form 7 - Clockwork SMS 2.3.0, Fast Secure Contact Form - Clockwork SMS 2.1.2, Formidable - Clockwork SMS 1.0.2, Gravity Forms - Clockwork SMS 2.2, and WP e-Commerce - Clockwork SMS 2.0.5.

Vendor-mediaburst n/a

Product-two-factor_authentication gravity_forms fast_secure_contact_form_sms formidable clockwork_sms_notfications wp_e-commerce contact_form_7_sms booking_calendar_sms n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 51.60%

||

7 Day CHG~0.00%

Published-29 Jul, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Cross-site scripting (XSS) vulnerability in the get_description function in lib/classes/event/user_login_failed.php in Moodle 2.7.x before 2.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted username that is improperly handled during the logging of an invalid login attempt.

Vendor-n/a Moodle Pty Ltd

Product-moodle n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.50% / 65.73%

||

7 Day CHG~0.00%

Published-12 Feb, 2005 | 05:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in view.php in Moodle 1.4.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the search parameter.

Vendor-n/a Moodle Pty Ltd

Product-moodle n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Mattermost, Inc.

Matching Score-4

Assigner-Mattermost, Inc.

CVSS Score-3.7||LOW

EPSS-0.21% / 43.77%

||

7 Day CHG~0.00%

Published-22 Sep, 2021 | 16:40

Updated-04 Aug, 2024 | 01:30

Mattermost 5.38 and earlier fails to sufficiently sanitize clipboard contents, which allows a user-assisted attacker to inject arbitrary web script in product deployments that explicitly disable the default CSP.

Vendor-Mattermost, Inc.

Product-mattermost Mattermost

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.20% / 41.52%

||

7 Day CHG~0.00%

Published-03 Aug, 2021 | 18:03

Updated-04 Aug, 2024 | 01:01

The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through special content.

Vendor-htmly n/a

Product-htmly n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.49% / 64.99%

||

7 Day CHG~0.00%

Published-22 Jul, 2021 | 16:19

Updated-04 Aug, 2024 | 01:16

OX App Suite before 7.10.3-rev32 and 7.10.4 before 7.10.4-rev18 allows XSS via a code snippet (user-generated content) when a sharing link is created and an App Loader relative URL is used.

Vendor-n/a Open-Xchange AG

Product-open-xchange_appsuite n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-SAP SE

Matching Score-4

Assigner-SAP SE

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.35%

||

7 Day CHG~0.00%

Published-14 Apr, 2020 | 18:07

Updated-04 Aug, 2024 | 08:55

SAP Business Objects Business Intelligence Platform (BI Launchpad), version 4.2, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.

Vendor-SAP SE

Product-businessobjects_business_intelligence_platform SAP Business Objects Business Intelligence Platform (BI Launchpad)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Patchstack

Matching Score-4

Assigner-Patchstack

CVSS Score-7.1||HIGH

EPSS-0.08% / 24.23%

||

7 Day CHG~0.00%

Published-27 Jul, 2023 | 14:21

Updated-25 Sep, 2024 | 16:57

WordPress Radio Forge Muses Player with Skins Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Radio Forge Muses Player with Skins plugin <= 2.5 versions.

Vendor-radioforge Radio Forge

Product-radio_forge_muses_player_with_skins Radio Forge Muses Player with Skins

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.89% / 75.11%

||

7 Day CHG~0.00%

Published-12 Feb, 2005 | 05:00

Updated-03 Apr, 2025 | 01:03

Cross-site scripting (XSS) vulnerability in login.php in PsychoStats 2.2.4 Beta and earlier allows remote attackers to inject arbitrary web script or HTML via the login parameter.

Vendor-psychostats n/a

Product-psychostats n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.72% / 72.05%

||

7 Day CHG~0.00%

Published-25 Feb, 2022 | 18:15

Updated-04 Aug, 2024 | 01:22

A cross-site scripting (XSS) vulnerability in the fileNameStr parameter of jQuery-Upload-File v4.0.11 allows attackers to execute arbitrary web scripts or HTML via a crafted file with a Javascript payload in the file name.

Vendor-hayageek n/a

Product-jquery_upload_file n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.34% / 56.24%

||

7 Day CHG~0.00%

Published-18 Dec, 2017 | 06:00

Updated-20 Apr, 2025 | 01:37

The BrightSign Digital Signage (4k242) device (Firmware 6.2.63 and below) has XSS via the REF parameter to /network_diagnostics.html or /storage_info.html.

Vendor-brightsign n/a

Product-4k242 4k242_firmware n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.04%

||

7 Day CHG~0.00%

Published-15 Sep, 2021 | 16:26

Updated-04 Aug, 2024 | 01:16

The TechRadar app 1.1 for Confluence Server allows XSS via the Title field of a Radar.

Vendor-it-economics n/a

Product-techradar n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-0.24% / 47.04%

||

7 Day CHG~0.00%

Published-25 Dec, 2017 | 16:00

Updated-20 Apr, 2025 | 01:37

PHP Scripts Mall Car Rental Script has XSS via the admin/areaedit.php carid parameter or the admin/sitesettings.php websitename parameter.

Vendor-car_rental_script_project n/a

Product-car_rental_script n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-0.36% / 57.50%

||

7 Day CHG~0.00%

Published-07 Jan, 2010 | 18:13

Updated-07 Aug, 2024 | 07:08

Cross-site scripting (XSS) vulnerability in base_local_rules.php in Basic Analysis and Security Engine (BASE) before 1.4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Vendor-secureideas n/a

Product-base n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-Red Hat, Inc.

Matching Score-4

Assigner-Red Hat, Inc.

CVSS Score-4.3||MEDIUM

EPSS-0.29% / 51.60%

||

7 Day CHG~0.00%

Published-29 Jul, 2014 | 10:00

Updated-12 Apr, 2025 | 10:46

Multiple cross-site scripting (XSS) vulnerabilities in admin/tool/task/scheduledtasks.php in Moodle 2.7.x before 2.7.1 allow remote attackers to inject arbitrary web script or HTML via vectors that trigger a crafted (1) error or (2) success message for a scheduled task.

Vendor-n/a Moodle Pty Ltd

Product-moodle n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-6.1||MEDIUM

EPSS-7.00% / 91.29%

||

7 Day CHG~0.00%

Published-30 Aug, 2021 | 18:18

Updated-04 Aug, 2024 | 01:16

Zoho ManageEngine ADSelfService Plus version 6103 and prior is vulnerable to reflected XSS on the loadframe page.

Vendor-n/a Zoho Corporation Pvt. Ltd.

Product-manageengine_adselfservice_plus n/a

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')