EasyCMS 1.5 allows XSS via the index.php?s=/admin/fields/update/navTabId/listfields/callbackType/closeCurrent content field.

Hoosk v1.7.0 allows XSS via the Navigation Title of a new page entered at admin/pages/new.

The removeXSS function in App/Common/common.php (called from App/Modules/Index/Action/SearchAction.class.php) in EasyCMS v1.4 allows XSS via an onhashchange event.

In the rcfilters plugin 2.1.6 for Roundcube, XSS exists via the _whatfilter and _messages parameters (in the Filters section of the settings).

\upload\plugins\sys\Install.php in CScms 4.1 has XSS via the site name.

Pluck 4.7.7 allows XSS via an SVG file that contains Javascript in a SCRIPT element, and is uploaded via pages->manage under admin.php?action=files.

feindura 2.0.7 allows XSS via the tags field of a new page created at index.php?category=0&page=new.

razorCMS 3.4.7 allows Stored XSS via the keywords of the homepage within the settings component.

razorCMS 3.4.7 allows HTML injection via the description of the homepage within the settings component.

An issue is discovered in baijiacms V4. XSS exists via the assets/weengine/components/zclip/ZeroClipboard.swf id parameter, aka "Non-standard use of the flash component."

An XSS vulnerability exists in wwwblast.c in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox via a crafted -z1 argument.

Gxlcms 1.0 has XSS via the PATH_INFO to gx/lib/ThinkPHP/Tpl/ThinkException.tpl.php.

Zurmo 3.2.4 Stable allows XSS via app/index.php/accounts/default/details?id=2&kanbanBoard=1&openToTaskId=1.

rejucms 2.1 has XSS via the ucenter/cms_user_add.php u_name parameter.

Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.

Evolution CMS 1.4.x allows XSS via the manager/ search parameter.

Evolution CMS 1.4.x allows XSS via the page weblink title parameter to the manager/ URI.

Nucleus CMS 3.70 allows HTML Injection via the index.php body parameter.

Blackcat CMS 1.3.2 allows XSS via the willkommen.php?lang=DE page title at backend/pages/modify.php.

Pluck v4.7.7 allows XSS via the admin.php?action=editpage&page= page title.