Export limit exceeded: 51989 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,989

Export CSV
CVE-2018-16361

An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows XSS via the id parameter.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Btiteam
Products
Xbtit
CVE-2018-16358

A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.php in the media manager in Dotclear through 2.14.1 allows remote authenticated users to upload HTML content containing an XSS payload with the file extension .ahtml.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dotclear
Products
Dotclear
CVE-2018-16348

SeaCMS V6.61 has XSS via the admin_video.php v_content parameter, related to the site name.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Seacms
Products
Seacms
CVE-2018-16347

An issue was discovered in Gleez CMS v1.2.0. There is XSS via media/imagecache/resize.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gleezcms
Products
Gleez Cms
CVE-2018-16330

Pandao Editor.md 1.5.0 allows XSS via crafted attributes of an invalid IMG element.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ipandao
Products
Editor.md
CVE-2018-16327

There is Stored XSS in Subrion 4.2.1 via the admin panel URL configuration.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Intelliants
Products
Subrion
CVE-2018-16324

In IceWarp Server 12.0.3.1 and before, there is XSS in the /webmail/ username field.

CVSS 3.0 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Icewarp
Products
Mail Server
CVE-2018-16316

A stored Cross-site scripting (XSS) vulnerability in Portainer through 1.19.1 allows remote authenticated users to inject arbitrary JavaScript and/or HTML via the Team Name field.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Portainer
Products
Portainer
CVE-2018-16298

An issue was discovered in MiniCMS 1.10. There is an mc-admin/post.php?tag= XSS vulnerability for a state=delete, state=draft, or state=publish request.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
1234n
Products
Minicms
CVE-2018-16285

The UserPro plugin through 4.9.23 for WordPress allows XSS via the shortcode parameter in a userpro_shortcode_template action to wp-admin/admin-ajax.php.

CVSS 3.0 · 6.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Userproplugin
Products
Userpro
CVE-2018-16277

The Image Import function in XWiki through 10.7 has XSS.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Xwiki
Products
Xwiki
CVE-2018-16259

There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-settings large_feed_limit. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Soflyy
Products
Wp All Import
CVE-2018-16258

There is an XSS vulnerability in WP All Import plugin 3.4.9 for WordPress via pmxi-admin-import custom_type. NOTE: The vendor states that this is not a vulnerability. WP All Import is only able to be used by a logged in administrator, and the action described can only be taken advantage of by a logged in administrator

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Soflyy
Products
Wp All Import