Overview 107 matches · 26 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 0 public PoC
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
26
24.3%
Outside Waratek scope
1
0.9%
Not applicable
80
74.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
107
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
0
0.0%
Proof of concept only
0
0.0%
Forecast only
107
100.0%
No public exploit
0
0.0%
split by
peak 30 / year
20051
Not applicable1
Medium1
not blocked1
Forecast only1
20060
20070
20081
Not applicable1
Medium1
not blocked1
Forecast only1
20090
20100
20110
20120
20131
Not applicable1
Medium1
not blocked1
Forecast only1
20141
Not applicable1
Medium1
not blocked1
Forecast only1
20151
Not applicable1
Medium1
not blocked1
Forecast only1
20160
20171
Not applicable1
Medium1
not blocked1
Forecast only1
20185
Not applicable5
Medium5
not blocked5
Forecast only5
20193
Not applicable3
Medium3
not blocked3
Forecast only3
20206
Not applicable6
High1
Medium5
not blocked6
Forecast only6
202126
No exploit published9
Not applicable17
High2
Medium24
not blocked26
Forecast only26
202230
No exploit published10
Outside Waratek scope1
Not applicable19
Critical2
High4
Medium24
not blocked30
Forecast only30
202321
No exploit published4
Not applicable17
Critical4
High2
Medium15
not blocked21
Forecast only21
20247
No exploit published3
Not applicable4
Critical1
High2
Medium4
not blocked7
Forecast only7
20253
Not applicable3
High1
Medium2
not blocked3
Forecast only3
20052007200920112013201520172019202120232025
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-6023 | High | 2025-07-18 | Not applicable | Forecast only | An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0. The open redirect can be chained with path traversal vulnerabilities to achieve XSS. Fixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01 |
| CVE-2025-46618 | Medium | 2025-04-25 | Not applicable | Forecast only | In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab |
| CVE-2025-30676 | Medium | 2025-04-01 | Not applicable | Forecast only | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19. Users are recommended to upgrade to version 18.12.19, which fixes the issue. |
| CVE-2024-54003 | High | 2024-11-27 | No exploit published | Forecast only | Jenkins Simple Queue Plugin 1.4.4 and earlier does not escape the view name, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Create permission. |
| CVE-2024-27136 | Medium | 2024-06-24 | No exploit published | Forecast only | XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later. |
| CVE-2023-50231 | Critical | 2024-05-03 | Not applicable | Forecast only | NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installations of NETGEAR ProSAFE Network Management System. Minimal user interaction is required to exploit this vulnerability. The specific flaw exists within the saveNodeLabel method. The issue results from the lack of proper validation of user-supplied data, which can lead to the injection of an arbitrary script. An attacker can leverage this vulnerability to escalate privileges to resources normally protected from the user. Was ZDI-CAN-21838. |
| CVE-2024-31138 | Medium | 2024-03-28 | Not applicable | Forecast only | In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings |
| CVE-2024-1883 | Medium | 2024-03-14 | Not applicable | Forecast only | This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. An attacker can exploit this weakness by crafting a malicious URL that contains a script. When an unsuspecting user clicks on this malicious link, it could potentially lead to limited loss of confidentiality, integrity or availability. |
| CVE-2024-28156 | Medium | 2024-03-06 | No exploit published | Forecast only | Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure Build Monitor Views. |
| CVE-2024-1451 | High | 2024-02-22 | Not applicable | Forecast only | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims." |
| CVE-2023-42327 | Medium | 2023-11-14 | Not applicable | Forecast only | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page. |
| CVE-2023-42325 | Medium | 2023-11-14 | Not applicable | Forecast only | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page. |
| CVE-2023-45138 | Critical | 2023-10-12 | No exploit published | Forecast only | Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. Starting in version 0.11 and prior to version 1.9.2, it's possible for a user without any specific right to perform script injection and remote code execution just by inserting an appropriate title when creating a new Change Request. This vulnerability is particularly critical as Change Request aims at being created by user without any particular rights. The vulnerability has been fixed in Change Request 1.9.2. It's possible to workaround the issue without upgrading by editing the document `ChangeRequest.Code.ChangeRequestSheet` and by performing the same change as in the fix commit. |
| CVE-2023-41249 | Medium | 2023-08-25 | Not applicable | Forecast only | In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step |
| CVE-2023-40176 | Critical | 2023-08-23 | No exploit published | Forecast only | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. Even though the time zone is selected from a drop down (no free text value) it can still be set from JavaScript (using the browser developer tools) or by calling the save URL on the user profile with the right query string. Once the time zone is set it is displayed without escaping which means the payload gets executed for any user that visits the malicious user profile, allowing the attacker to steal information and even gain more access rights (escalation to programming rights). This issue is present since version 4.1M2 when the time zone user preference was introduced. The issue has been fixed in XWiki 14.10.5 and 15.1RC1. |
| CVE-2023-29452 | Medium | 2023-07-13 | Not applicable | Forecast only | Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider. |
| CVE-2023-0992 | High | 2023-06-09 | Not applicable | Forecast only | The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2023-28651 | Medium | 2023-06-01 | Not applicable | Forecast only | Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. If a user who can access the affected product with an administrative privilege configures specially crafted settings, an arbitrary script may be executed on the web browser of the other user who is accessing the affected product with an administrative privilege. |
| CVE-2023-34225 | Medium | 2023-05-31 | Not applicable | Forecast only | In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible |
| CVE-2023-34220 | Medium | 2023-05-31 | Not applicable | Forecast only | In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible |
| CVE-2023-32071 | Critical | 2023-05-09 | No exploit published | Forecast only | XWiki Platform is a generic wiki platform. Starting in versions 2.2-milestone-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, it's possible to execute javascript with the right of any user by leading him to a special URL on the wiki targeting a page which contains an attachment. This has been patched in XWiki 15.0-rc-1, 14.10.4, and 14.4.8. The easiest possible workaround is to edit file `<xwiki app>/templates/importinline.vm` and apply the modification described in commit 28905f7f518cc6f21ea61fe37e9e1ed97ef36f01. |
| CVE-2023-28341 | Medium | 2023-04-11 | Not applicable | Forecast only | Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page. |
| CVE-2023-22249 | Medium | 2023-03-27 | Not applicable | Forecast only | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. |
| CVE-2022-48428 | Medium | 2023-03-27 | Not applicable | Forecast only | In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible |
| CVE-2023-0050 | High | 2023-03-09 | Not applicable | Forecast only | An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. |
| CVE-2022-48343 | Medium | 2023-02-23 | Not applicable | Forecast only | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process. |
| CVE-2022-29273 | Medium | 2023-02-22 | Not applicable | Forecast only | pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters. |
| CVE-2023-25762 | Medium | 2023-02-15 | No exploit published | Forecast only | Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job names. |
| CVE-2023-23074 | Medium | 2023-02-01 | Not applicable | Forecast only | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component. |
| CVE-2022-46889 | Medium | 2023-01-19 | Not applicable | Forecast only | A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php. |
| CVE-2022-47523 | Critical | 2023-01-05 | Not applicable | Forecast only | Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection. |
| CVE-2022-2753 | Medium | 2022-09-19 | Not applicable | Forecast only | The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made |
| CVE-2022-39810 | Medium | 2022-09-09 | Not applicable | Forecast only | An issue was discovered in WSO2 Enterprise Integrator 6.4.0. A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. Session hijacking or similar attacks would not be possible. |
| CVE-2022-36096 | Critical | 2022-09-08 | No exploit published | Forecast only | The XWiki Platform Index UI is an Index of all pages, attachments, orphans and deleted pages and attachments for XWiki Platform, a generic wiki platform. Prior to versions 13.10.6 and 14.3, it's possible to store JavaScript which will be executed by anyone viewing the deleted attachments index with an attachment containing javascript in its name. This issue has been patched in XWiki 13.10.6 and 14.3. As a workaround, modify fix the vulnerability by editing the wiki page `XWiki.DeletedAttachments` with the object editor, open the `JavaScriptExtension` object and apply on the content the changes that can be found on the fix commit. |
| CVE-2022-34258 | Medium | 2022-08-16 | Not applicable | Forecast only | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker with admin privileges to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. |
| CVE-2022-36801 | Medium | 2022-08-10 | Not applicable | Forecast only | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint. The affected versions are before version 8.20.8. |
| CVE-2022-28732 | Medium | 2022-08-04 | No exploit published | Forecast only | A carefully crafted request on WeblogPlugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.11.3 or later. |
| CVE-2022-28730 | Medium | 2022-08-04 | No exploit published | Forecast only | A carefully crafted request on AJAXPreview.jsp could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This vulnerability leverages CVE-2021-40369, where the Denounce plugin dangerously renders user-supplied URLs. Upon re-testing CVE-2021-40369, it appears that the patch was incomplete as it was still possible to insert malicious input via the Denounce plugin. Apache JSPWiki users should upgrade to 2.11.3 or later. |
| CVE-2022-27166 | Medium | 2022-08-04 | No exploit published | Forecast only | A carefully crafted request on XHRHtml2Markup.jsp could trigger an XSS vulnerability on Apache JSPWiki up to and including 2.11.2, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. |
| CVE-2022-31097 | High | 2022-07-15 | Outside Waratek scope | Forecast only | Grafana is an open-source platform for monitoring and observability. Versions on the 8.x and 9.x branch prior to 9.0.3, 8.5.9, 8.4.10, and 8.3.10 are vulnerable to stored cross-site scripting via the Unified Alerting feature of Grafana. An attacker can exploit this vulnerability to escalate privilege from editor to admin by tricking an authenticated admin to click on a link. Versions 9.0.3, 8.5.9, 8.4.10, and 8.3.10 contain a patch. As a workaround, it is possible to disable alerting or use legacy alerting. |
| CVE-2022-2230 | High | 2022-07-01 | Not applicable | Forecast only | A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf. |
| CVE-2022-34783 | Medium | 2022-06-30 | No exploit published | Forecast only | Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34777 | Medium | 2022-06-30 | No exploit published | Forecast only | Jenkins GitLab Plugin 1.5.34 and earlier does not escape multiple fields inserted into the description of webhook-triggered builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-34176 | Medium | 2022-06-23 | No exploit published | Forecast only | Jenkins JUnit Plugin 1119.va_a_5e9068da_d7 and earlier does not escape descriptions of test results, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Run/Update permission. |
| CVE-2022-25772 | Critical | 2022-06-20 | Not applicable | Forecast only | A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript |
| CVE-2022-1707 | Medium | 2022-06-13 | Not applicable | Forecast only | The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be exploited by unauthenticated attackers. |
| CVE-2022-30956 | Medium | 2022-05-17 | No exploit published | Forecast only | Jenkins Rundeck Plugin 3.6.10 and earlier does not restrict URL schemes in Rundeck webhook submissions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to submit crafted Rundeck webhook payloads. |
| CVE-2022-29036 | Medium | 2022-04-12 | No exploit published | Forecast only | Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2022-1190 | High | 2022-04-04 | Not applicable | Forecast only | Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc. |
| CVE-2022-28379 | Medium | 2022-04-03 | Not applicable | Forecast only | jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion. |
| CVE-2022-1181 | Medium | 2022-03-30 | Not applicable | Forecast only | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2. |
| CVE-2022-1179 | Medium | 2022-03-30 | Not applicable | Forecast only | Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. |
| CVE-2022-1178 | Medium | 2022-03-30 | Not applicable | Forecast only | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. |
| CVE-2022-0364 | Medium | 2022-03-21 | Not applicable | Forecast only | The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks |
| CVE-2022-0832 | Medium | 2022-03-04 | Not applicable | Forecast only | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. |
| CVE-2022-25305 | High | 2022-02-24 | Not applicable | Forecast only | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that execute when site administrators view a sites statistics, in versions up to and including 13.1.5. |
| CVE-2021-23174 | Medium | 2022-01-28 | Not applicable | Forecast only | Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0]. |
| CVE-2021-46065 | Medium | 2022-01-27 | Not applicable | Forecast only | A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code. |
| CVE-2021-25080 | Medium | 2022-01-24 | Not applicable | Forecast only | The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry |
| CVE-2022-20615 | Medium | 2022-01-12 | No exploit published | Forecast only | Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission. |
| CVE-2021-43942 | Medium | 2022-01-04 | Not applicable | Forecast only | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. To exploit this issue, the attacker must trick a user into visiting a malicious website. The affected versions are before version 8.13.15, and from version 8.14.0 before 8.20.3. |
| CVE-2021-21699 | Medium | 2021-11-12 | No exploit published | Forecast only | Jenkins Active Choices Plugin 2.5.6 and earlier does not escape the parameter name of reactive parameters and dynamic reference parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2021-33618 | Medium | 2021-11-10 | Not applicable | Forecast only | Dolibarr ERP and CRM 13.0.2 allows XSS via object details, as demonstrated by > and < characters in the onpointermove attribute of a BODY element to the user-management feature. |
| CVE-2021-39906 | High | 2021-11-05 | Not applicable | Forecast only | Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf. |
| CVE-2021-22242 | High | 2021-08-25 | Not applicable | Forecast only | Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown |
| CVE-2021-22238 | Medium | 2021-08-20 | Not applicable | Forecast only | An issue has been discovered in GitLab affecting all versions starting with 13.3. GitLab was vulnerable to a stored XSS by using the design feature in issues. |
| CVE-2021-35478 | Medium | 2021-07-30 | Not applicable | Forecast only | Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page. |
| CVE-2021-28114 | Medium | 2021-07-16 | Not applicable | Forecast only | Froala WYSIWYG Editor 3.2.6-1 is affected by XSS due to a namespace confusion during parsing. |
| CVE-2021-31813 | Medium | 2021-07-01 | Not applicable | Forecast only | Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD. |
| CVE-2021-21668 | Medium | 2021-06-16 | No exploit published | Forecast only | Jenkins Scriptler Plugin 3.1 and earlier does not escape script content, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission. |
| CVE-2021-21667 | Medium | 2021-06-16 | No exploit published | Forecast only | Jenkins Scriptler Plugin 3.2 and earlier does not escape parameter names shown in job configuration forms, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Scriptler/Configure permission. |
| CVE-2021-31643 | Medium | 2021-06-01 | Not applicable | Forecast only | An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter. |
| CVE-2021-21649 | Medium | 2021-05-11 | No exploit published | Forecast only | Jenkins Dashboard View Plugin 2.15 and earlier does not escape URLs referenced in Image Dashboard Portlets, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with View/Configure permission. |
| CVE-2021-26030 | Medium | 2021-04-14 | Not applicable | Forecast only | An issue was discovered in Joomla! 3.0.0 through 3.9.25. Inadequate escaping allowed XSS attacks using the logo parameter of the default templates on error page |
| CVE-2021-20080 | Medium | 2021-04-09 | Not applicable | Forecast only | Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file. |
| CVE-2021-21630 | Medium | 2021-03-30 | No exploit published | Forecast only | Jenkins Extra Columns Plugin 1.22 and earlier does not escape parameter values in the build parameters column, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2021-21628 | Medium | 2021-03-30 | No exploit published | Forecast only | Jenkins Build With Parameters Plugin 1.5 and earlier does not escape parameter names and descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2021-27907 | Medium | 2021-03-05 | Not applicable | Forecast only | Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS) when a legitimate user surfs on the dashboard page. The vulnerability is exploitable creating a “div” section and embedding in it a “svg” element with javascript code. |
| CVE-2021-21618 | Medium | 2021-02-24 | No exploit published | Forecast only | Jenkins Repository Connector Plugin 2.0.2 and earlier does not escape parameter names and descriptions for past builds, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. |
| CVE-2021-21616 | Medium | 2021-02-24 | No exploit published | Forecast only | Jenkins Active Choices Plugin 2.5.2 and earlier does not escape reference parameter values, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Job/Configure permission. |
| CVE-2021-21029 | Medium | 2021-02-11 | Not applicable | Forecast only | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation. |
| CVE-2020-13947 | Medium | 2021-02-08 | No exploit published | Forecast only | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0. |
| CVE-2020-13564 | Medium | 2021-02-01 | Not applicable | Forecast only | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template acl_id parameter. |
| CVE-2020-13563 | Medium | 2021-02-01 | Not applicable | Forecast only | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnerability in the phpGACL template group_id parameter. |
| CVE-2020-13562 | Medium | 2021-02-01 | Not applicable | Forecast only | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. A specially crafted HTTP request can lead to arbitrary JavaScript execution. An attacker can provide a crafted URL to trigger this vulnaerability in the phpGACL template action parameter. |
| CVE-2021-23124 | Medium | 2021-01-12 | Not applicable | Forecast only | An issue was discovered in Joomla! 3.9.0 through 3.9.23. The lack of escaping in mod_breadcrumbs aria-label attribute allows XSS attacks. |
| CVE-2020-8264 | Medium | 2021-01-06 | Not applicable | Forecast only | In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware. |
| CVE-2020-5810 | Medium | 2020-12-30 | Not applicable | Forecast only | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. An authenticated user authorized to upload media can upload a malicious .svg file which act as a stored XSS payload. |
| CVE-2020-27988 | Medium | 2020-11-16 | Not applicable | Forecast only | Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field). |
| CVE-2020-8821 | Medium | 2020-10-12 | Not applicable | Forecast only | An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. A user may enter HTML code into the Command field and submit it. Then, after visiting the Action Logs Menu and displaying logs, the HTML code will be rendered (however, JavaScript is not executed). Changes are kept across users. |
| CVE-2020-13340 | High | 2020-10-08 | Not applicable | Forecast only | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log |
| CVE-2020-10821 | Medium | 2020-03-22 | Not applicable | Forecast only | Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter. |
| CVE-2020-10819 | Medium | 2020-03-22 | Not applicable | Forecast only | Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter. |
| CVE-2019-3964 | Medium | 2019-08-20 | Not applicable | Forecast only | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. |
| CVE-2019-3963 | Medium | 2019-08-20 | Not applicable | Forecast only | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. This could allow an attacker to execute arbitrary code in the context of a user's session. |
| CVE-2019-13345 | Medium | 2019-07-05 | Not applicable | Forecast only | The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter. |
| CVE-2018-19206 | Medium | 2018-11-12 | Not applicable | Forecast only | steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment. |
| CVE-2018-16833 | Medium | 2018-09-21 | Not applicable | Forecast only | Zoho ManageEngine Desktop Central 10.0.271 has XSS via the "Features & Articles" search field to the /advsearch.do?SUBREQUEST=XMLHTTP URI. |
| CVE-2018-8046 | Medium | 2018-07-05 | Not applicable | Forecast only | The getTip() method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data. This framework brings no built-in XSS protection, so the developer has to ensure that data is correctly sanitized. However, the getTip() method of Action Columns takes HTML-escaped data and un-escapes it. If the tooltip contains user-controlled data, an attacker could exploit this to create a cross-site scripting attack, even when developers took precautions and escaped data. |
| CVE-2018-6377 | Medium | 2018-01-30 | Not applicable | Forecast only | In Joomla! before 3.8.4, inadequate input filtering in com_fields leads to an XSS vulnerability in multiple field types, i.e., list, radio, and checkbox |