Total
44255 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-1469 | 1 Fibosearch | 1 Fibosearch | 2024-11-21 | 4.8 Medium |
| The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed | ||||
| CVE-2022-1465 | 1 Wpclever | 1 Wpc Smart Wishlist For Woocommerce | 2024-11-21 | 6.1 Medium |
| The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue. | ||||
| CVE-2022-1464 | 1 Gogs | 1 Gogs | 2024-11-21 | 5.4 Medium |
| Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account . | ||||
| CVE-2022-1458 | 1 Open-emr | 1 Openemr | 2024-11-21 | 5.4 Medium |
| Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1. | ||||
| CVE-2022-1457 | 1 Facturascripts | 1 Facturascripts | 2024-11-21 | 5.4 Medium |
| Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account. | ||||
| CVE-2022-1456 | 1 Ays-pro | 1 Poll Maker | 2024-11-21 | 4.8 Medium |
| The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store Cross-Site Scripting attack even when unfiltered_html is disallowed | ||||
| CVE-2022-1455 | 1 Callnowbutton | 1 Call Now Button | 2024-11-21 | 6.1 Medium |
| The Call Now Button WordPress plugin before 1.1.2 does not escape a parameter before outputting it back in an attribute of a hidden input, leading to a Reflected Cross-Site Scripting when the premium is enabled | ||||
| CVE-2022-1445 | 1 Snipeitapp | 1 Snipe-it | 2024-11-21 | 5.4 Medium |
| Stored Cross Site Scripting vulnerability in the checked_out_to parameter in GitHub repository snipe/snipe-it prior to 5.4.3. The vulnerability is capable of stolen the user Cookie. | ||||
| CVE-2022-1439 | 1 Microweber | 1 Microweber | 2024-11-21 | 6.1 Medium |
| Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction. | ||||
| CVE-2022-1438 | 1 Redhat | 3 Keycloak, Red Hat Single Sign On, Rhosemc | 2024-11-21 | 6.4 Medium |
| A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability. | ||||
| CVE-2022-1436 | 1 Wptaskforce | 1 Track \& Trace | 2024-11-21 | 6.1 Medium |
| The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargo_tracking_number parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks. | ||||
| CVE-2022-1435 | 1 Wptaskforce | 1 Track \& Trace | 2024-11-21 | 4.8 Medium |
| The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. | ||||
| CVE-2022-1433 | 1 Gitlab | 1 Gitlab | 2024-11-21 | 2.6 Low |
| An issue has been discovered in GitLab affecting all versions starting from 14.4 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. Missing invalidation of Markdown caching causes potential payloads from a previously exploitable XSS vulnerability (CVE-2022-1175) to persist and execute. | ||||
| CVE-2022-1432 | 1 Octoprint | 1 Octoprint | 2024-11-21 | 6.4 Medium |
| Cross-site Scripting (XSS) - Generic in GitHub repository octoprint/octoprint prior to 1.8.0. | ||||
| CVE-2022-1431 | 1 Gitlab | 1 Gitlab | 2024-11-21 | 4.3 Medium |
| An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious requests to the PyPi API endpoint allowing the attacker to cause uncontrolled resource consumption. | ||||
| CVE-2022-1430 | 1 Octoprint | 1 Octoprint | 2024-11-21 | 7.5 High |
| Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. | ||||
| CVE-2022-1418 | 1 Pluginmirror | 1 Social Stickers | 2024-11-21 | 6.1 Medium |
| The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does not escape some of these fields, which could allow attackers to make a logged-in admin change them and lead to Stored Cross-Site Scripting issues. | ||||
| CVE-2022-1416 | 1 Gitlab | 1 Gitlab | 2024-11-21 | 4.3 Medium |
| Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling | ||||
| CVE-2022-1408 | 1 Vikwp | 1 Hotel Booking Engine \& Pms | 2024-11-21 | 4.8 Medium |
| The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | ||||
| CVE-2022-1396 | 1 Donorbox | 1 Donorbox | 2024-11-21 | 4.8 Medium |
| The Donorbox WordPress plugin before 7.1.7 does not sanitise and escape its Campaign URL settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed | ||||