Export limit exceeded: 51987 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,987

Export CSV
CVE-2018-10135

iScripts eSwap v2.4 has Reflected XSS via the "catwiseproducts.php" catid parameter in the User Panel.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Iscripts
Products
Eswap
CVE-2018-10128

An issue was discovered in XYHCMS 3.5. It has XSS via the test parameter to index.php.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Xyhcms Project
Products
Xyhcms
CVE-2018-10121

plugins/box/pages/pages.admin.php in Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the title section of an admin/index.php?id=pages&action=edit_page&name=error404 (aka Edit 404 page) action.

CVSS 3.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Monstra
Products
Monstra
CVE-2018-10118

Monstra CMS 3.0.4 has Stored XSS via the Name field on the Create New Page screen under the admin/index.php?id=pages URI, related to plugins/box/pages/pages.admin.php.

CVSS 3.0 · 4.8 Medium EPSS 2.7% KEV · Not listed
Vendors
Monstra
Products
Monstra
CVE-2018-10109

Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload in the content section of a new page in the blog catalog.

CVSS 3.0 · 4.8 Medium EPSS 2.1% KEV · Not listed
Vendors
Monstra
Products
Monstra
CVE-2018-10108

D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the Treturn parameter to /htdocs/webinc/js/bsc_sms_inbox.php.

CVSS 3.0 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Dlink
Products
Dir-815 Dir-815 Firmware
CVE-2018-10107

D-Link DIR-815 REV. B (with firmware through DIR-815_REVB_FIRMWARE_PATCH_2.07.B01) devices have XSS in the RESULT parameter to /htdocs/webinc/js/info.php.

CVSS 3.0 · 6.1 Medium EPSS 1.1% KEV · Not listed
Vendors
Dlink
Products
Dir-815 Dir-815 Firmware
CVE-2018-10095

Cross-site scripting (XSS) vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php.

CVSS 3.0 · 6.1 Medium EPSS 86.5% KEV · Not listed
Vendors
Dolibarr
Products
Dolibarr
CVE-2018-10078

Cross-site scripting (XSS) vulnerability in Geist WatchDog Console 3.2.2 allows remote authenticated administrators to inject arbitrary web script or HTML via a server description.

CVSS 3.1 · 4.8 Medium EPSS 2.0% KEV · Not listed
Vendors
Vertiv
Products
Watchdog Console
CVE-2018-10076

An issue was discovered in Zoho ManageEngine EventLog Analyzer 11.12. A Cross-Site Scripting vulnerability allows a remote attacker to inject arbitrary web script or HTML via the search functionality (the search box of the Dashboard).

CVSS 3.0 · 6.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Eventlog Analyzer
CVE-2018-10075

Cross-site scripting (XSS) vulnerability in Zoho ManageEngine EventLog Analyzer 11.12 allows remote attackers to inject arbitrary web script or HTML via the import logs feature.

CVSS 3.0 · 6.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Eventlog Analyzer
CVE-2018-10061

Cacti before 1.1.37 has XSS because it makes certain htmlspecialchars calls without the ENT_QUOTES flag (these calls occur when the html_escape function in lib/html.php is not used).

CVSS 3.1 · 5.4 Medium EPSS 1.1% KEV · Not listed
Vendors
Cacti Debian
Products
Cacti Debian Linux