Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
Opis źródłowy NVD · ENCVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash…
Opis źródłowy NVD · ENCVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended…
Opis źródłowy NVD · ENCVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary (whichever names the admin bound via url.<name>)' parameter in all versions up to, and including,…
Opis źródłowy NVD · ENCVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting (XSS) vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response…
Opis źródłowy NVD · ENCVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The users endpoint in the groov View API returns a list of all users and
associated metadata including their API keys. This endpoint requires an
Editor role to access and will display API keys for all users,
including Administrators.
Opis źródłowy NVD · ENCVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context…
Opis źródłowy NVD · ENCVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a…
Opis źródłowy NVD · ENCVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The SMS for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · ENCVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.add_css, ui.add_scss, and ui.add_sass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary (whichever names the admin bound via url.<name>)' parameter in all versions up to, and including,…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting (XSS) vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The users endpoint in the groov View API returns a list of all users and
associated metadata including their API keys. This endpoint requires an
Editor role to access and will display API keys for all users,
including Administrators.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, windows opened from a sandboxed top-level document did not inherit that document's active HTML sandbox restrictions. Untrusted content in a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The SMS for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,1 · EPSS 0,27 % · rekomendacja wg zapisanej polityki