Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,467 results · page 40 of 70
Jun 26, 2023Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user inputCVE-2023-32604 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 5.4
Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32605.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Jun 26, 2023Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user inputCVE-2023-32537 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 5.4
Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32536.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Jun 26, 2023Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user inputCVE-2023-32536 · Other software · Trend Micro, Inc. · reported by security@trendmicro.comMedium 5.4
Affected versions Trend Micro Apex Central (on-premise) are vulnerable to potential authenticated reflected cross-site scripting (XSS) attacks due to user input validation and sanitization issues. Please note: an attacker must first obtain authentication to Apex Central on the target system in order to exploit this vulnerability. This is similar to, but not identical to CVE-2023-32537.
- Product
- Trend Micro Apex Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Jun 23, 2023POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.CVE-2023-36346 · Other software · Codekop · reported by MITREMedium 6.1
POS Codekop v2.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the nm_member parameter at print.php.
- Product
- Codekop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comyoutube.com
Jun 22, 2023WPForms WPForms Lite: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-30500 · WordPress plugins & themes · reported by PatchstackMedium 5.8
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPForms WPForms Lite (wpforms-lite), WPForms WPForms Pro (wpforms) plugins <= 1.8.1.2 versions.
- Product
- WPForms WPForms Lite
- What to do
- Update WPForms WPForms Lite to the newest version.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jun 22, 2023A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to stealCVE-2023-33387 · Other software · Datev · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link.
- Product
- EG Personal-management System Comfort/comfort Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.datev.desupport.veda.net
Jun 15, 2023Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-29322 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jun 15, 2023Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-29304 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jun 15, 2023Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2023-29302 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.16.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- Adobe Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
Jun 14, 2023A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be exCVE-2023-0010 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comMedium 5.4
A reflected cross-site scripting (XSS) vulnerability in the Captive Portal feature of Palo Alto Networks PAN-OS software can allow a JavaScript payload to be executed in the context of an authenticated Captive Portal user’s browser when they click on a specifically crafted link.
- Product
- PAN-OS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Jun 13, 2023A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browseCVE-2023-34537 · Other software · Digitaldruid · reported by MITREMedium 5.4
A Reflected XSS was discovered in HotelDruid version 3.0.5, an attacker can issue malicious code/command on affected webpage's parameter to trick user on browser and/or exfiltrate data.
- Product
- Hoteldruid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 12, 2023SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site ScriptinCVE-2023-33985 · Network & remote access · SAP_SE · reported by cna@sap.comMedium 6.1
SAP NetWeaver Enterprise Portal - version 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
- Product
- SAP NetWeaver Enterprise Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlaunchpad.support.sap.comsap.com
Jun 11, 2023The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.CVE-2023-22585 · Other software · Danfoss · reported by csirt@divd.nlCritical 9
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter.
- Product
- AK-EM100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Jun 11, 2023The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.CVE-2023-22582 · Other software · Danfoss · reported by csirt@divd.nlCritical 9
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting.
- Product
- AK-EM100
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Jun 9, 2023Team Circle Image Slider With Lightbox: Reflected Cross-Site ScriptingCVE-2023-2604 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Team Circle Image Slider With Lightbox
- Affected
- up to 1.0.17
- What to do
- Affects up to 1.0.17. Update Team Circle Image Slider With Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2023Photo Gallery Slideshow & Masonry Tiled Gallery: Reflected Cross-Site ScriptingCVE-2023-2402 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-41658 appears to be a duplicate of this issue.
- Product
- Photo Gallery Slideshow & Masonry Tiled Gallery
- Affected
- up to 1.0.13
- What to do
- Affects up to 1.0.13. Update Photo Gallery Slideshow & Masonry Tiled Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2023wordpress vertical image slider: Reflected Cross-Site ScriptingCVE-2023-2289 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The wordpress vertical image slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.2.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- wordpress vertical image slider
- Affected
- up to 1.2.16
- What to do
- Affects up to 1.2.16. Update wordpress vertical image slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2023WP Responsive Tabs horizontal vertical and accordion Tabs: Reflected Cross-Site ScriptingCVE-2023-2184 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Responsive Tabs horizontal vertical and accordion Tabs plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.1.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Responsive Tabs horizontal vertical and accordion Tabs
- Affected
- up to 1.1.15
- What to do
- Affects up to 1.1.15. Update WP Responsive Tabs horizontal vertical and accordion Tabs to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 9, 2023ShiftController Employee Shift Scheduling: Reflected Cross-Site ScriptingCVE-2023-1978 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the query string in versions up to, and including, 4.9.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- ShiftController Employee Shift Scheduling
- Affected
- up to 4.9.25
- What to do
- Affects up to 4.9.25. Update ShiftController Employee Shift Scheduling to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 6, 2023WP Quick FrontEnd Editor: Reflected Cross-Site ScriptingCVE-2021-4363 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 5.5 due to insufficient input sanitization and output escaping on the 'save_content_front' function that uses print_r on the user-supplied $_REQUEST values . This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Quick FrontEnd Editor
- Affected
- up to 5.5
- What to do
- Affects up to 5.5. Update WP Quick FrontEnd Editor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordblog.nintechnet.comwordpress.org
Jun 2, 2023eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/indeCVE-2023-33763 · Other software · Simpleredak · reported by MITREMedium 6.1
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /scheduler/index.php.
- Product
- Simpleredak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /view/cb/formatCVE-2023-33761 · Other software · Simpleredak · reported by MITREMedium 6.1
eMedia Consulting simpleRedak up to v2.47.23.05 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /view/cb/format_642.php.
- Product
- Simpleredak
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacCVE-2023-33731 · Other software · Escanav · reported by MITREMedium 6.1
Reflected Cross Site Scripting (XSS) in the view dashboard detail feature in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the URL directly.
- Product
- Escan Management Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2023WP Directory Kit: Reflected Cross-Site ScriptingCVE-2023-2835 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Directory Kit
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update WP Directory Kit to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.complugins.trac.wordpress.org
Jun 1, 2023A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the RCVE-2023-22648 · Other software · SUSE · reported by meissner@suse.deHigh 8
A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.
- Product
- Rancher
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.suse.comgithub.com
May 31, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository mkucej/i-librarian-free prior to 5.10.4.CVE-2023-3020 · Other software · mkucej · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository mkucej/i-librarian-free prior to 5.10.4.
- Product
- mkucej/i-librarian-free
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 31, 2023In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possibleCVE-2023-34226 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2023.05 reflected XSS in the Subscriptions page was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
May 28, 2023WooCommerce WooCommerce Follow-Up Emails: Unauth. Reflected Cross-Site Scripting (XSS)CVE-2023-33319 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.
- Product
- WooCommerce WooCommerce Follow-Up Emails
- Affected
- up to 4.9.40
- What to do
- Affects up to 4.9.40. Update WooCommerce WooCommerce Follow-Up Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 28, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-2949 · Other software · openemr · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.1.
- Product
- openemr/openemr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2023NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation.CVE-2023-20868 · Other software · Broadcom · reported by security@vmware.comMedium 6.1
NSX-T contains a reflected cross-site scripting vulnerability due to a lack of input validation. A remote attacker can inject HTML or JavaScript to redirect to malicious pages.
- Product
- VMware Nsx-t Data Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023Cross-site Scripting vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component) allows Reflected XSS.This issue affects HiCVE-2023-30469 · Other software · Hitachi · reported by hirt@hitachi.co.jpHigh 7.6
Cross-site Scripting vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component) allows Reflected XSS.This issue affects Hitachi Ops Center Analyzer: from 10.9.1-00 before 10.9.2-00.
- Product
- Hitachi Ops Center Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhitachi.comhitachi.com
May 22, 2023A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary CVE-2023-31664 · Other software · Wso2 · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tenantDomain parameter.
- Product
- API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2023GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the User Input field.CVE-2023-31584 · Other software · Silicon Project · reported by MITREMedium 6.1
GitHub repository cu/silicon commit a9ef36 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the User Input field.
- Product
- Silicon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2023A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary CVE-2023-1996 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comMedium 6.1
A reflected Cross-site Scripting (XSS) vulnerability in Release 3DEXPERIENCE R2018x through Release 3DEXPERIENCE R2023x allows an attacker to execute arbitrary script code.
- Product
- 3DEXPERIENCE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2023ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.CVE-2023-31699 · Other software · Churchcrm · reported by MITREMedium 4.8
ChurchCRM v4.5.4 is vulnerable to Reflected Cross-Site Scripting (XSS) via image file.
- Product
- Churchcrm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 15, 2023video carousel slider with lightbox: Reflected Cross-Site ScriptingCVE-2023-2710 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The video carousel slider with lightbox plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the search_term parameter in versions up to, and including, 1.0.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32797 may be a duplicate of this.
- Product
- video carousel slider with lightbox
- Affected
- up to 1.0.22
- What to do
- Affects up to 1.0.22. Update video carousel slider with lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.complugins.trac.wordpress.org
May 15, 2023Video Gallery: Reflected Cross-Site ScriptingCVE-2023-2708 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Video Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘search_term’ parameter in versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. CVE-2023-32597 may be a duplicate of this.
- Product
- Video Gallery
- Affected
- up to 1.0.10
- What to do
- Affects up to 1.0.10. Update Video Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.complugins.trac.wordpress.org
May 12, 2023Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter.CVE-2022-48020 · Other software · Vinteo · reported by MITREMedium 6.1
Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter. This vulnerability allows attackers to inject arbitrary code which will be executed by the victim user's browser.
- Product
- Video Core
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 10, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2615 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 9, 2023There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a craftedCVE-2023-25831 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
- Product
- Portal for ArcGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.esri.comesri.com
May 9, 2023There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a crafteCVE-2023-25830 · Other software · Esri · reported by psirt@esri.comMedium 6.1
There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1and before which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser.
- Product
- Portal for ArcGIS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.esri.comesri.com
May 8, 2023 Cybonet PineApp Mail Secure A reflected cross-site scripting (XSS) vulnerability was identified in the product, using an unspecified endpoint.CVE-2023-31183 · Other software · Cybonet · reported by cna@cyber.gov.ilMedium 6.1
Cybonet PineApp Mail Secure A reflected cross-site scripting (XSS) vulnerability was identified in the product, using an unspecified endpoint.
- Product
- PineApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023 WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - Reflected cross-site scripting (RXSS) through an unspecified request.CVE-2023-31180 · Other software · WJJ Software · reported by cna@cyber.gov.ilMedium 6.1
WJJ Software - InnoKB Server, InnoKB/Console 2.2.1 - Reflected cross-site scripting (RXSS) through an unspecified request.
- Product
- InnoKB Server, InnoKB/Console
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 8, 2023A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applications and sites built wCVE-2023-2582 · Other software · Strikingly · reported by vulnreport@tenable.comMedium 6.1
A prototype pollution vulnerability exists in Strikingly CMS which can result in reflected cross-site scripting (XSS) in affected applications and sites built with Strikingly. The vulnerability exists because of Strikingly JavaScript library parsing the URL fragment allows access to the __proto__ or constructor properties and the Object prototype. By leveraging an embedded gadget like jQuery, an attacker who convinces a victim to visit a specially crafted link could achieve arbitrary javascript execution in the context of the user's browser.
- Product
- Strikingly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
May 8, 2023Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <= 2.4.4 versions.CVE-2023-28493 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes NewsMag theme <= 2.4.4 versions.
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 5, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.CVE-2023-2427 · Other software · thorsten · reported by security@huntr.devMedium 4.8
Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.13.
- Product
- thorsten/phpmyfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 3, 2023 Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and exCVE-2023-25827 · Other software · OpenTSDB · reported by disclosure@synopsys.comHigh 8.2
Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the same root cause as CVE-2018-13003, a reflected XSS vulnerability with the suggestion endpoint.
- Product
- OpenTSDB
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsynopsys.com
May 3, 2023 Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavCVE-2023-27378 · Network & remote access · F5 · reported by f5sirt@f5.comHigh 7.5
Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- Product
- BIG-IP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 28, 2023Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID wasCVE-2023-28475 · Other software · Concretecms · reported by MITREMedium 6.1
Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordconcretecms.comconcretecms.org
Apr 27, 2023Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.CVE-2023-2342 · Other software · pimcore · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.
- Product
- pimcore/pimcore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.