Export limit exceeded: 351283 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (45987 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-49293 | 1 Vitejs | 1 Vite | 2025-05-29 | 6.1 Medium |
| Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via `server.transformIndexHtml`, the original request URL is passed in unmodified, and the `html` being transformed contains inline module scripts (`<script type="module">...</script>`), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to `server.transformIndexHtml`. Only apps using `appType: 'custom'` and using the default Vite HTML middleware are affected. The HTML entry must also contain an inline script. The attack requires a user to click on a malicious URL while running the dev server. Restricted files aren't exposed to the attacker. This issue has been addressed in vite@5.0.5, vite@4.5.1, and vite@4.4.12. There are no known workarounds for this vulnerability. | ||||
| CVE-2022-2924 | 1 Yetiforce | 1 Yetiforce Customer Relationship Management | 2025-05-29 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3. | ||||
| CVE-2022-3000 | 1 Yetiforce | 1 Yetiforce Customer Relationship Management | 2025-05-29 | 5.4 Medium |
| Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. | ||||
| CVE-2025-47851 | 1 Jetbrains | 1 Teamcity | 2025-05-28 | 4.8 Medium |
| In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible | ||||
| CVE-2025-47852 | 1 Jetbrains | 1 Teamcity | 2025-05-28 | 4.8 Medium |
| In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible | ||||
| CVE-2025-47853 | 1 Jetbrains | 1 Teamcity | 2025-05-28 | 4.8 Medium |
| In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible | ||||
| CVE-2024-56923 | 1 Silverpeas | 1 Silverpeas | 2025-05-28 | 5.4 Medium |
| Stored Cross-Site Scripting (XSS) Vulnerability in the Categorization Option of My Subscriptions Functionality in Silverpeas Core 6.3.1 <= 6.4.1 allows a remote attacker to execute arbitrary JavaScript code. This is achieved by injecting a malicious payload into the Name field of a subscription. The attack can lead to session hijacking, data theft, or unauthorized actions when an admin user views the affected subscription. | ||||
| CVE-2024-10720 | 1 Phpipam | 1 Phpipam | 2025-05-28 | 6.1 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability occurs in the 'Device Management' section under 'Administration' where an attacker can inject malicious scripts into the 'Name' and 'Description' fields when adding a new device type. This can lead to data theft, account compromise, distribution of malware, website defacement, and phishing attacks. The issue is fixed in version 1.7.0. | ||||
| CVE-2024-10722 | 1 Phpipam | 1 Phpipam | 2025-05-28 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. The vulnerability allows attackers to inject malicious scripts into the 'Description' field of custom fields in the 'IP RELATED MANAGEMENT' section. This can lead to data theft, account compromise, distribution of malware, website defacement, content manipulation, and phishing attacks. The issue is fixed in version 1.7.0. | ||||
| CVE-2024-10723 | 1 Phpipam | 1 Phpipam | 2025-05-28 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability was discovered in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the destination address field of the NAT tool, which can be executed when a user interacts with the field. The impact of this vulnerability includes the potential theft of user cookies, unauthorized access to user accounts, and redirection to malicious websites. The issue has been fixed in version 1.7.0. | ||||
| CVE-2024-10724 | 1 Phpipam | 1 Phpipam | 2025-05-28 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2, specifically in the Subnet NAT translations section when editing the Destination address. This vulnerability allows an attacker to execute malicious code. The issue is fixed in version 1.7.0. | ||||
| CVE-2024-10725 | 1 Phpipam | 1 Phpipam | 2025-05-28 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in phpipam/phpipam version 1.5.2. This vulnerability allows an attacker to inject malicious scripts into the application, which are then executed in the context of other users who view the affected pages. The issue occurs when editing the NAT destination address, where user input is not properly sanitized. This can lead to data theft, account compromise, and other malicious activities. The vulnerability is fixed in version 1.7.0. | ||||
| CVE-2024-10719 | 1 Phpipam | 1 Phpipam | 2025-05-28 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in phpipam version 1.5.2, specifically in the circuits options functionality. This vulnerability allows an attacker to inject malicious scripts via the 'option' parameter in the POST request to /phpipam/app/admin/circuits/edit-options-submit.php. The injected script can be executed in the context of the user's browser, leading to potential cookie theft and end-user file disclosure. The issue is fixed in version 1.7.0. | ||||
| CVE-2025-46335 | 1 Opensecurity | 1 Mobile Security Framework | 2025-05-28 | 5.4 Medium |
| Mobile Security Framework (MobSF) is a security research platform for mobile applications in Android, iOS and Windows Mobile. A Stored Cross-Site Scripting (XSS) vulnerability has been identified in MobSF versions up to and including 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG files during the Android APK analysis workflow. Version 4.3.3 fixes the issue. | ||||
| CVE-2024-0427 | 1 Reputeinfosystems | 1 Arforms | 2025-05-28 | 6.3 Medium |
| The ARForms - Premium WordPress Form Builder Plugin WordPress plugin before 6.4.1 does not properly escape user-controlled input when it is reflected in some of its AJAX actions. | ||||
| CVE-2023-50378 | 1 Apache | 1 Ambari | 2025-05-28 | 6.1 Medium |
| Lack of proper input validation and constraint enforcement in Apache Ambari prior to 2.7.8 Impact : As it will be stored XSS, Could be exploited to perform unauthorized actions, varying from data access to session hijacking and delivering malicious payloads. Users are recommended to upgrade to version 2.7.8 which fixes this issue. | ||||
| CVE-2024-27140 | 1 Apache | 1 Archiva | 2025-05-28 | 5.4 Medium |
| ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Archiva. This issue affects Apache Archiva: from 2.0.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. Alternatively, you could configure a HTTP proxy in front of your Archiva instance to only forward requests that do not have malicious characters in the URL. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2024-7082 | 1 Magazine3 | 1 Easy Table Of Contents | 2025-05-28 | 6.1 Medium |
| The Easy Table of Contents WordPress plugin before 2.0.68 does not sanitise and escape some parameters, which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks. | ||||
| CVE-2024-7084 | 2 Ajax Search Project, Wp-dreams | 2 Ajax Search, Ajax Search | 2025-05-28 | 4.8 Medium |
| The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripting attacks. | ||||
| CVE-2024-3973 | 1 Shawon786 | 1 House Manager | 2025-05-28 | 4.8 Medium |
| The House Manager WordPress plugin through 1.0.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | ||||