Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,467 results · page 47 of 70
Jun 21, 2022NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.CVE-2022-33119 · Other software · Nuuo · reported by MITREMedium 6.1
NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php.
- Product
- Nvrsolo Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.CVE-2022-2130 · Other software · microweber · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2022Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form.CVE-2022-31299 · Other software · Angtech · reported by MITREMedium 6.1
Haraj v3.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the User Upgrade Form.
- Product
- Haraj
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordangtech.organgtech.org
Jun 15, 2022There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side.CVE-2021-40910 · Websites & servers · Phpcms · reported by MITREMedium 6.1
There is a reflective cross-site scripting (XSS) vulnerability in the PHPCMS V9.6.3 management side.
- Product
- Phpcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.CVE-2022-29455 · WordPress plugins & themes · reported by PatchstackMedium 4.7
DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions.
- Affected
- up to 3.5.5
- What to do
- Affects up to 3.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comrotem-bar.com
Jun 13, 2022Keep Backup Daily: Reflected Cross-Site ScriptingCVE-2022-1820 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Keep Backup Daily
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Keep Backup Daily to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 13, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.CVE-2022-2066 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 13, 2022Download Manager: Reflected Cross-Site ScriptingCVE-2022-1985 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the ~/src/Package/views/shortcode-iframe.php file.
- Product
- Download Manager
- Affected
- up to 3.2.42
- What to do
- Affects up to 3.2.42. Update Download Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 13, 2022Zephyr Project Manager: Reflected Cross-Site ScriptingCVE-2022-1822 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- Zephyr Project Manager
- Affected
- up to 3.2.40
- What to do
- Affects up to 3.2.40. Update Zephyr Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordpress.org
Jun 13, 2022Google Tag Manager for: Reflected Cross-Site ScriptingCVE-2022-1707 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating into the data layer of sites with insufficient sanitization in versions up to an including 1.15. The affected file is ~/public/frontend.php and this could be exploited by unauthenticated attackers.
- Product
- Google Tag Manager for
- Fixed in
- 1.15.1
- What to do
- Update Google Tag Manager for to 1.15.1 or newer.
Jun 9, 2022The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input usiCVE-2022-28614 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.3
The ap_rwrite() function in Apache HTTP Server 2.4.53 and earlier may read unintended memory if an attacker can cause the server to reflect very large input using ap_rwrite() or ap_rputs(), such as with mod_luas r:puts() function. Modules compiled and distributed separately from Apache HTTP Server that use the 'ap_rputs' function and may pass it a very large (INT_MAX or larger) string must be compiled against current headers to resolve the issue.
- Product
- Apache HTTP Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comhttpd.apache.org
Jun 9, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.CVE-2022-2016 · Other software · neorazorx · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.1.
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2022A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions <CVE-2022-2035 · Other software · Ltgplc · reported by vulnreport@tenable.comMedium 6.1
A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions < 20.1.45.914, 21.1.x < 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser.
- Product
- Rustici Software Scorm Engine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Jun 6, 2022A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or CVE-2022-29296 · Other software · Avantune · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the login portal of Avantune Genialcloud ProJ - 10 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
- Product
- Genialcloud Proj
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdl.packetstormsecurity.net
Jun 2, 2022School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:126.CVE-2022-30514 · Other software · School Dormitory Management System Project · reported by MITREMedium 6.1
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:126.
- Product
- School Dormitory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Jun 2, 2022School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:125CVE-2022-30513 · Other software · School Dormitory Management System Project · reported by MITREMedium 6.1
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:125
- Product
- School Dormitory Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsourcecodester.com
Jun 2, 2022Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to an reflected Cross-Site Scripting (XSS) vulnerability via RRSWeb/maint/ShowDocument/SCVE-2022-29598 · Other software · Solutions-atlantic · reported by MITREMedium 6.1
Solutions Atlantic Regulatory Reporting System (RRS) v500 is vulnerable to an reflected Cross-Site Scripting (XSS) vulnerability via RRSWeb/maint/ShowDocument/ShowDocument.aspx .
- Product
- Regulatory Reporting System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsolutions-atlantic.com
May 26, 2022Talend Administration Center is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the SSO login endpoint.CVE-2022-31648 · Other software · Talend · reported by MITREMedium 6.1
Talend Administration Center is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in TPS-5233, for versions 7.3.x in TPS-5324, and for versions 7.2.x in TPS-5235. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.
- Product
- Administration Center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 26, 2022Dell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in Unisphere GUI.CVE-2022-29091 · Other software · Dell · reported by security_alert@emc.comMedium 5.3
Dell Unity, Dell UnityVSA, and Dell UnityXT versions prior to 5.2.0.0.5.173 contain a Reflected Cross-Site Scripting Vulnerability in Unisphere GUI. An Unauthenticated Remote Attacker could potentially exploit this vulnerability, leading to the execution of malicious HTML or JavaScript code in a victim user's web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
- Product
- Unity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 25, 2022When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected croCVE-2021-32989 · Other software · LCDS—Leão Consultoria e Desenvolvimento de Sistemas Ltda ME · reported by ics-cert@hq.dhs.govCritical 9.3
When a non-existent resource is requested, the LCDS LAquis SCADA application (version 4.3.1.1011 and prior) returns error messages which may allow reflected cross-site scripting.
- Product
- LAquis SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 23, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository collectiveaccess/providence prior to 1.8.CVE-2022-1825 · Other software · collectiveaccess · reported by security@huntr.devMedium 5.4
Cross-site Scripting (XSS) - Reflected in GitHub repository collectiveaccess/providence prior to 1.8.
- Product
- collectiveaccess/providence
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 20, 2022Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin <CVE-2022-29426 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin <= 1.3.54 at WordPress.
- Affected
- up to 1.3.54
- What to do
- Affects up to 1.3.54. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin <= 9.7.1 aCVE-2022-29424 · WordPress plugins & themes · reported by PatchstackMedium 4.8
Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin <= 9.7.1 at WordPress.
- Affected
- up to 9.7.1
- What to do
- Affects up to 9.7.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 20, 2022Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18.CVE-2022-1806 · Other software · rtxteam · reported by security@huntr.devMedium 6.1
Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18.
- Product
- rtxteam/rtx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 18, 2022Code Snippets plugin <= 2.14.3 at: Reflected Cross-Site Scripting (XSS)CVE-2022-25617 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter.
- Product
- Code Snippets plugin <= 2.14.3 at
- Affected
- up to 2.14.3
- What to do
- Affects up to 2.14.3. Update Code Snippets plugin <= 2.14.3 at to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 18, 2022The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable Reflected Cross Site Scripting CVE-2022-22777 · Other software · TIBCO Software Inc. · reported by security@tibco.comMedium 6.1
The Web Server component of TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow an unauthenticated attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO BusinessConnect Trading Community Management: versions 6.1.0 and below.
- Product
- TIBCO BusinessConnect Trading Community Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 16, 2022A remote reflected cross site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.CVE-2022-23659 · Other software · Arubanetworks · reported by security-alert@hpe.comMedium 6.1
A remote reflected cross site scripting (xss) vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2 and below, 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.
- Product
- Clearpass Policy Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarubanetworks.comarubanetworks.com
May 12, 2022Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected CroCVE-2022-23165 · Other software · SysAid · reported by cna@cyber.gov.ilMedium 5.5
Sysaid – Sysaid 14.2.0 Reflected Cross-Site Scripting (XSS) - The parameter "helpPageName" used by the page "/help/treecontent.jsp" suffers from a Reflected Cross-Site Scripting vulnerability. For an attacker to exploit this Cross-Site Scripting vulnerability, it's necessary for the affected product to expose the Offline Help Pages. An attacker may gain access to sensitive information or execute client-side code in the browser session of the victim user. Furthermore, an attacker would require the victim to open a malicious link. An attacker may exploit this vulnerability in order to perform phishing attacks. The attacker can receive sensitive data like server details, usernames, workstations, etc. He can also perform actions such as uploading files, deleting calls from the system
- Product
- Sysaid
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 12, 2022ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2022-28818 · Websites & servers · Adobe · reported by AdobeMedium 6.1
ColdFusion versions CF2021U3 (and earlier) and CF2018U13 are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
- Product
- ColdFusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhelpx.adobe.comhelpx.adobe.com
May 12, 2022In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possibleCVE-2022-29927 · Other software · JetBrains · reported by cve@jetbrains.comMedium 4.6
In JetBrains TeamCity before 2022.04 reflected XSS on the Build Chain Status page was possible
- Product
- TeamCity
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
May 12, 2022Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07.CVE-2022-1682 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022ZTE's ZXCDN product has a reflective XSS vulnerability.CVE-2022-23137 · Other software · ZTE · reported by psirt@zte.com.cnMedium 6.1
ZTE's ZXCDN product has a reflective XSS vulnerability. The attacker could modify the parameters in the content clearing request url, and when a user clicks the url, an XSS attack will be triggered.
- Product
- Zxcdn Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.zte.com.cnsupport.zte.com.cn
May 11, 2022Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['page'] parCVE-2022-28078 · Other software · Home Owners Collection Management System Project · reported by MITREMedium 6.1
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['page'] parameter.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['s'] parameCVE-2022-28077 · Other software · Home Owners Collection Management System Project · reported by MITREMedium 6.1
Home Owners Collection Management v1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the Admin panel via the $_GET['s'] parameter.
- Product
- Home Owners Collection Management System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 .CVE-2022-29976 · Other software · Altn · reported by MITREMedium 5.4
An Authenticated Reflected Cross-site scripting at BCC Parameter was discovered in MDaemon before 22.0.0 .
- Product
- Mdaemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 .CVE-2022-29975 · Other software · Altn · reported by MITREMedium 5.4
An Authenticated Reflected Cross-site scripting at CC Parameter was discovered in MDaemon before 22.0.0 .
- Product
- Mdaemon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2022Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting (XSS) vulnerability in the test parameter.CVE-2022-29728 · Other software · Surveysparrow · reported by MITREMedium 6.1
Survey Sparrow Enterprise Survey Software 2022 has a Reflected cross-site scripting (XSS) vulnerability in the test parameter.
- Product
- Enterprise Survey Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comsurveysparrow.com
May 6, 2022Adam Skaat's Countdown & Clock plugin on: Reflected Cross-Site Scripting (XSS)CVE-2022-29421 · WordPress plugins & themes · reported by PatchstackMedium 4.7
Reflected Cross-Site Scripting (XSS) vulnerability in Adam Skaat's Countdown & Clock plugin on WordPress via &ycd_type vulnerable parameter.
- Product
- Adam Skaat's Countdown & Clock plugin on
- Affected
- up to 2.3.2
- What to do
- Affects up to 2.3.2. Update Adam Skaat's Countdown & Clock plugin on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
May 6, 2022The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4.CVE-2022-27183 · Other software · Splunk · reported by prodsec@splunk.comHigh 8.8
The Monitoring Console app configured in Distributed mode allows for a Reflected XSS in a query parameter in Splunk Enterprise versions before 8.1.4. The Monitoring Console app is a bundled app included in Splunk Enterprise, not for download on SplunkBase, and not installed on Splunk Cloud Platform instances. Note that the Cloud Monitoring Console is not impacted.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.splunk.comsplunk.com
May 4, 2022Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16.CVE-2022-1584 · Other software · microweber · reported by security@huntr.devMedium 6.1
Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 4, 2022A reflected cross-site scripting (XSS) vulnerability in the component Query.php of arPHP v3.6.0 allows attackers to execute arbitrary web scripts.CVE-2022-28081 · Other software · Ar-php · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the component Query.php of arPHP v3.6.0 allows attackers to execute arbitrary web scripts.
- Product
- Arphp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordalbarbari.comalbarbari.com
May 4, 2022Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07.CVE-2022-1571 · Other software · neorazorx · reported by security@huntr.devMedium 6.1
Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...
- Product
- neorazorx/facturascripts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 2, 2022A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, via the path of the erCVE-2020-23618 · Other software · Xtendtech · reported by MITREMedium 6.1
A reflected cross site scripting (XSS) vulnerability in Xtend Voice Logger 1.0 allows attackers to execute arbitrary web scripts or HTML, via the path of the error page.
- Product
- Voice Logger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordxtendtech.comgist.github.com
May 2, 2022Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.2CVE-2022-26325 · Other software · Micro Focus · reported by security@opentext.comLow 2.9
Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.2
- Product
- NetIQ Access Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmicrofocus.commicrofocus.com
Apr 28, 2022Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin <= 2.16 at WordPress.CVE-2022-29415 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin <= 2.16 at WordPress.
- Affected
- up to 2.16
- What to do
- Affects up to 2.16. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Apr 28, 2022In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possibleCVE-2022-29817 · Other software · JetBrains · reported by cve@jetbrains.comLow 3.9
In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible
- Product
- IntelliJ IDEA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjetbrains.comjetbrains.com
Apr 25, 2022WordPress Country Selector Plugin Version 1.6.5: Reflective Cross-Site ScriptingCVE-2022-28290 · WordPress plugins & themes · reported by disclose@cybersecurityworks.comMedium 6.1
Reflective Cross-Site Scripting vulnerability in WordPress Country Selector Plugin Version 1.6.5. The XSS payload executes whenever the user tries to access the country selector page with the specified payload as a part of the HTTP request
- Product
- WordPress Country Selector Plugin Version 1.6.5
- Affected
- 1.6.5 to 1.6.5
- What to do
- Affects 1.6.5 to 1.6.5. Update WordPress Country Selector Plugin Version 1.6.5 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordcybersecurityworks.comcybersecurityworks.com
Apr 22, 2022Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15.CVE-2022-1439 · Other software · microweber · reported by security@huntr.devMedium 6.1
Reflected XSS on demo.microweber.org/demo/module/ in GitHub repository microweber/microweber prior to 1.2.15. Execute Arbitrary JavaScript as the attacked user. It's the only payload I found working, you might need to press "tab" but there is probably a paylaod that runs without user interaction.
- Product
- microweber/microweber
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2022ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoinCVE-2022-28820 · Other software · Adobe · reported by AdobeMedium 6.1
ACS Commons version 5.1.x (and earlier) suffers from a Reflected Cross-site Scripting (XSS) vulnerability in /apps/acs-commons/content/page-compare.html endpoint via the a and b GET parameters. User input submitted via these parameters is not validated or sanitised. An attacker must provide a link to someone with access to AEM Author, and could potentially exploit this vulnerability to inject malicious JavaScript content into vulnerable form fields and execute it within the context of the victim's browser. The exploitation of this issue requires user interaction in order to be successful.
- Product
- Experience Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 20, 2022A reflected XSS issue exists in the Management Console of several WSO2 products.CVE-2022-29548 · Other software · Wso2 · reported by MITREMedium 4.6
A reflected XSS issue exists in the Management Console of several WSO2 products. This affects API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0, 6.5.0, and 6.6.0; IS as Key Manager 5.5.0, 5.6.0, 5.7.0, 5.9.0, and 5.10.0; Identity Server 5.5.0, 5.6.0, 5.7.0, 5.9.0, 5.10.0, and 5.11.0; Identity Server Analytics 5.5.0 and 5.6.0; and WSO2 Micro Integrator 1.0.0.
- Product
- API Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comdocs.wso2.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.