CVE-2024-43735

Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)

Adobe Experience Manager versions 6.5.21 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Experience Manager

CVE-2024-42335

7Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

7Twenty - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

7-twenty

Products

Bot

CVE-2024-30198

WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeKraft BuddyForms allows Reflected XSS.This issue affects BuddyForms: from n/a through 2.8.5.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Themekraft Wordpress

Products

Buddyforms Wordpress

CVE-2024-30185

WordPress Element Pack Elementor Addons plugin <= 5.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 5.5.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bdthemes

Products

Element Pack

CVE-2024-29923

WordPress PropertyHive plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PropertyHive allows Reflected XSS.This issue affects PropertyHive: from n/a through 2.0.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Propertyhive Wp-property-hive

Products

Propertyhive Wordpress Propertyhive

CVE-2024-29817

WordPress affiliate-toolkit – WordPress Affiliate Plugin plugin <= 3.4.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SERVIT Software Solutions affiliate-toolkit allows Stored XSS.This issue affects affiliate-toolkit: from n/a through 3.4.5.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-23345

Nautobot has XSS potential in rendered Markdown fields

Nautobot is a Network Source of Truth and Network Automation Platform built as a web application. All users of Nautobot versions earlier than 1.6.10 or 2.1.2 are potentially impacted by a cross-site scripting vulnerability. Due to inadequate input sanitization, any user-editable fields that support Markdown rendering, including are potentially susceptible to cross-site scripting (XSS) attacks via maliciously crafted data. This issue is fixed in Nautobot versions 1.6.10 and 2.1.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Networktocode

Products

Nautobot

CVE-2024-22418

Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice

Group-Office is an enterprise CRM and groupware tool. Affected versions are subject to a vulnerability which is present in the file upload mechanism of Group Office. It allows an attacker to execute arbitrary JavaScript code by embedding it within a file's name. For instance, using a filename such as “><img src=x onerror=prompt('XSS')>.jpg” triggers the vulnerability. When this file is uploaded, the JavaScript code within the filename is executed. This issue has been addressed in version 6.8.29. All users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Group-office

Products

Group Office

CVE-2024-22414

User profile page vulnerable to Cross Site Scripting (XSS) in flaskBlog

flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the `/user/<user>` page allows a user's comments to execute arbitrary javascript code. The html template `user.html` contains the following code snippet to render comments made by a user: `<div class="content" tag="content">{{comment[2]|safe}}</div>`. Use of the "safe" tag causes flask to _not_ escape the rendered content. To remediate this, simply remove the `|safe` tag from the HTML above. No fix is is available and users are advised to manually edit their installation.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Dogukanurker

Products

Flaskblog

CVE-2024-22137

WordPress Constant Contact Forms by MailMunch Plugin <= 2.0.11 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch Constant Contact Forms by MailMunch allows Stored XSS.This issue affects Constant Contact Forms by MailMunch: from n/a through 2.0.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mailmunch

Products

Constant Contact Forms

CVE-2024-20525

Cisco Identity Services Engine Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an unauthenticated, remote attacker to conduct an XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Identity Services Engine

CVE-2024-1029

Cogites eReserv tenancyDetail.php cross site scripting

A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. Affected by this issue is some unknown functionality of the file /front/admin/tenancyDetail.php. The manipulation of the argument Nom with the input Dreux"><script>alert('XSS')</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-252302 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Cogites

Products

Ereserv

CVE-2024-1028

SourceCodester Facebook News Feed Like Post cross site scripting

A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Post Handler. The manipulation of the argument Description with the input <marquee>HACKED</marquee> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-252301 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Facebook News Feed Like

CVE-2024-13874

Feedify – Web Push Notifications < 2.4.6 - Reflected XSS

The Feedify WordPress plugin before 2.4.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Feedify

Products

Web Push Notifications

CVE-2024-13696

Flexible Wishlist for WooCommerce <= 1.2.25 - Unauthenticated Stored Cross-Site Scripting via wishlist_name Parameter

The Flexible Wishlist for WooCommerce – Ecommerce Wishlist & Save for later plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wishlist_name’ parameter in all versions up to, and including, 1.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-12725

Clasify Classified Listing <= 1.0.7 - Reflected XSS

The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Smartdatasoft

Products

Clasify Classified Listing

CVE-2024-12724

WP DeskLite <= 1.0.0 - Reflected XSS

The WP DeskLite WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Codeflock

Products

Wp Desklite

CVE-2024-11986

Stored XSS in CrushFTP

Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scripting'.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Crushftp

Products

Crushftp

CVE-2024-0652

PHPGurukul Company Visitor Management System search-visitor.php cross site scripting

A vulnerability was found in PHPGurukul Company Visitor Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file search-visitor.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251378 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Company Visitor Management System

CVE-2023-42479

Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct

An unauthenticated attacker can embed a hidden access to a Biller Direct URL in a frame which, when loaded by the user, will submit a cross-site scripting request to the Biller Direct system. This can result in the disclosure or modification of non-sensitive information.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Sap

Products

Biller Direct