Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 51987 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (51987 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2017-17775 | 1 Piwigo | 1 Piwigo | 2025-04-20 | N/A |
| Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request. | ||||
| CVE-2015-3421 | 1 Eshop Project | 1 Eshop | 2025-04-20 | N/A |
| The eshop_checkout function in checkout.php in the Wordpress Eshop plugin 6.3.11 and earlier does not validate variables in the "eshopcart" HTTP cookie, which allows remote attackers to perform cross-site scripting (XSS) attacks, or a path disclosure attack via crafted variables named after target PHP variables. | ||||
| CVE-2017-17948 | 1 Cells | 1 Blog | 2025-04-20 | N/A |
| Cells Blog 3.5 has XSS via the jfdname parameter in an act=showpic request. | ||||
| CVE-2017-17940 | 1 Single Theater Booking Script Project | 1 Single Theater Booking Script | 2025-04-20 | N/A |
| PHP Scripts Mall Single Theater Booking has XSS via the title parameter to admin/sitesettings.php. | ||||
| CVE-2016-5880 | 1 Ibm | 2 Domino, Inotes | 2025-04-20 | N/A |
| IBM iNotes is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2016-5760 | 1 Novell | 1 Groupwise | 2025-04-20 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 allow remote attackers to inject arbitrary web script or HTML via the (1) token parameter to gwadmin-console/install/login.jsp or (2) PATH_INFO to gwadmin-console/index.jsp. | ||||
| CVE-2014-8426 | 1 Barracuda | 1 Load Balancer | 2025-04-20 | N/A |
| Hard coded weak credentials in Barracuda Load Balancer 5.0.0.015. | ||||
| CVE-2015-3432 | 1 Pydio | 1 Pydio | 2025-04-20 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in Pydio (formerly AjaXplorer) before 6.0.7 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Pydio XSS Vulnerabilities." | ||||
| CVE-2015-4667 | 1 Xceedium | 1 Xsuite | 2025-04-20 | N/A |
| Multiple hardcoded credentials in Xsuite 2.x. | ||||
| CVE-2015-4673 | 1 Clip-bucket | 1 Clipbucket | 2025-04-20 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in ClipBucket 2.7.0.5 allow remote authenticated users to inject arbitrary web script or HTML via (1) the collection_description parameter to upload/manage_collections.php in an add_new action or the (2) photo_description, (3) photo_tags, or (4) photo_title parameter to upload/actions/photo_uploader.php. | ||||
| CVE-2015-4687 | 1 Ellucian | 1 Banner Student | 2025-04-20 | N/A |
| Cross-site scripting (XSS) vulnerability in Ellucian (formerly SunGard) Banner Student 8.5.1.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | ||||
| CVE-2015-4699 | 1 Cloud4wi | 1 Splash Portal | 2025-04-20 | N/A |
| Cross-site scripting (XSS) vulnerability in the Splash Portal in Cloud4Wi before 5.9.7 allows remote attackers to inject arbitrary web script or HTML via the recoveryMessage parameter to the default URI. | ||||
| CVE-2015-4706 | 1 Ipython | 1 Ipython | 2025-04-20 | N/A |
| Cross-site scripting (XSS) vulnerability in IPython 3.x before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/contents path. | ||||
| CVE-2015-4707 | 1 Ipython | 1 Ipython | 2025-04-20 | 6.1 Medium |
| Cross-site scripting (XSS) vulnerability in IPython before 3.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving JSON error messages and the /api/notebooks path. | ||||
| CVE-2015-4721 | 1 Concretecms | 1 Concrete Cms | 2025-04-20 | N/A |
| Multiple cross-site scripting (XSS) vulnerabilities in Concrete5 5.7.3.1. | ||||
| CVE-2016-6096 | 1 Ibm | 2 Security Key Lifecycle Manager, Tivoli Key Lifecycle Manager | 2025-04-20 | N/A |
| IBM Tivoli Key Lifecycle Manager 2.0.1, 2.5, and 2.6 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2014-4925 | 2 Good, Google | 2 Good For Enterprise, Android | 2025-04-20 | N/A |
| Cross-site scripting (XSS) vulnerability in Good for Enterprise for Android 2.8.0.398 and 1.9.0.40. | ||||
| CVE-2012-6705 | 1 Jamroom | 1 Jamroom | 2025-04-20 | N/A |
| Cross Site Scripting (XSS) exists in Jamroom before 4.2.7 via the Status Update field. | ||||
| CVE-2016-5756 | 1 Netiq | 1 Access Manager | 2025-04-20 | N/A |
| Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 were vulnerable to Reflected Cross Site Scripting attacks which could be used to hijack user sessions: nps/servlet/frameservice, nps/servlet/webacc, roma/admin/cntl, roma/jsp/admin/appliance/devicedetail_edit.jsp, roma/jsp/admin/managementip/mgmt_ip_details_frameset.jsp, roma/jsp/admin/managementip/mgmt_ip_details_middleframe.jsp, roma/jsp/volsc/monitoring/appliance.jsp, and roma/jsp/volsc/monitoring/graph.jsp. | ||||
| CVE-2015-3615 | 1 Fortinet | 7 Fortimanager 2000e, Fortimanager 200d, Fortimanager 3000f and 4 more | 2025-04-20 | N/A |
| Cross-site scripting (XSS) vulnerability in Fortinet FortiManager 5.0.x before 5.0.11, 5.2.x before 5.2.2 allows remote authenticated users to inject arbitrary web script or HTML via vectors involving unspecified parameters and a privilege escalation attack. | ||||