Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
3,467 results · page 53 of 70
Aug 3, 2021A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a pCVE-2021-35265 · Other software · Maxsite · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page.
- Product
- Maxsite CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 2, 2021Poll Maker: Reflected Cross-Site ScriptingCVE-2021-34635 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the ~/admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8.
- Product
- Poll Maker
- Affected
- up to 3.2.8
- What to do
- Affects up to 3.2.8. Update Poll Maker to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jul 30, 2021ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string.CVE-2020-26563 · Other software · Objectplanet · reported by MITREMedium 6.1
ObjectPlanet Opinio before 7.14 allows reflected XSS via the survey/admin/surveyAdmin.do?action=viewSurveyAdmin query string. (There is also stored XSS if input to survey/admin/*.do is accepted from untrusted users.)
- Product
- Opinio
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comobjectplanet.com
Jul 30, 2021Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function.CVE-2021-35478 · Other software · Nagios · reported by MITREMedium 5.4
Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. All parameters used for filtering are affected. This affects users who open a crafted link or third-party web page.
- Product
- LOG Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.nccgroup.comresearch.nccgroup.com
Jul 25, 2021Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).CVE-2021-37449 · Other software · Nchsoftware · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmlist?folder= (reflected).
- Product
- IVM Attendant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files.CVE-2021-37468 · Other software · NCH · reported by MITRELow 3.3
NCH Reflect CRM 3.01 allows local users to discover cleartext user account information by reading the configuration files.
- Product
- Reflect Customer Relationship Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnchsoftware.com
Jul 25, 2021In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).CVE-2021-37467 · Other software · Nchsoftware · reported by MITREMedium 5.4
In NCH Quorum v2.03 and earlier, XSS exists via /conferencebrowseuploadfile?confid= (reflected).
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).CVE-2021-37466 · Other software · Nchsoftware · reported by MITREMedium 5.4
In NCH Quorum v2.03 and earlier, XSS exists via /conference?id= (reflected).
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).CVE-2021-37465 · Other software · Nchsoftware · reported by MITREMedium 5.4
In NCH Quorum v2.03 and earlier, XSS exists via /uploaddoc?id= (reflected).
- Product
- Quorum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).CVE-2021-37462 · Other software · Nchsoftware · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /ipblacklist?errorip= (reflected).
- Product
- Axon PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).CVE-2021-37461 · Other software · Nchsoftware · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /extensionsinstruction?id= (reflected).
- Product
- Axon PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).CVE-2021-37460 · Other software · Nchsoftware · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in NCH Axon PBX v2.22 and earlier via /planprop?id= (reflected).
- Product
- Axon PBX
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).CVE-2021-37451 · Other software · Nchsoftware · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /msglist?mbx= (reflected).
- Product
- IVM Attendant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 25, 2021Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).CVE-2021-37450 · Other software · Nchsoftware · reported by MITREMedium 5.4
Cross Site Scripting (XSS) exists in NCH IVM Attendant v5.12 and earlier via /ogmprop?id= (reflected).
- Product
- IVM Attendant
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2021Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier versions.CVE-2021-22522 · Other software · Microfocus · reported by security@opentext.comHigh 7.1
Reflected Cross-Site Scripting vulnerability in Micro Focus Verastream Host Integrator, affecting version version 7.8 Update 1 and earlier versions. The vulnerability could allow disclosure of confidential data.
- Product
- Verastream Host Integrator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.microfocus.comsupport.microfocus.com
Jul 19, 2021W3 Total Cache: Was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboardCVE-2021-24452 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.5 was affected by a reflected Cross-Site Scripting (XSS) issue within the "extension" parameter in the Extensions dashboard, when the 'Anonymously track usage to improve product quality' setting is enabled, as the parameter is output in a JavaScript context without proper escaping. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
- Product
- W3 Total Cache
- Fixed in
- 2.1.5
- What to do
- Update W3 Total Cache to 2.1.5 or newer.
Jul 19, 2021W3 Total Cache: Was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboardCVE-2021-24436 · WordPress plugins & themes · reported by WPScanMedium 6.1
The W3 Total Cache WordPress plugin before 2.1.4 was vulnerable to a reflected Cross-Site Scripting (XSS) security vulnerability within the "extension" parameter in the Extensions dashboard, which is output in an attribute without being escaped first. This could allow an attacker, who can convince an authenticated admin into clicking a link, to run malicious JavaScript within the user's web browser, which could lead to full site compromise.
- Product
- W3 Total Cache
- Fixed in
- 2.1.4
- What to do
- Update W3 Total Cache to 2.1.4 or newer.
Jul 17, 2021Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.CVE-2021-36771 · Email & office · Zohocorp · reported by MITREMedium 6.1
Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmanageengine.commanageengine.com
Jul 15, 2021A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScriCVE-2021-3043 · Network & remote access · Palo Alto Networks · reported by psirt@paloaltonetworks.comHigh 7.5
A reflected cross-site scripting (XSS) vulnerability exists in the Prisma Cloud Compute web console that enables a remote attacker to execute arbitrary JavaScript code in the browser-based web console while an authenticated administrator is using that web interface. Prisma Cloud Compute SaaS versions were automatically upgraded to the fixed release. No additional action is required for these instances. This issue impacts: Prisma Cloud Compute 20.12 versions earlier than Prisma Cloud Compute 20.12.552; Prisma Cloud Compute 21.04 versions earlier than Prisma Cloud Compute 21.04.439.
- Product
- Prisma Cloud Compute
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.paloaltonetworks.comsecurity.paloaltonetworks.com
Jul 10, 2021A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on aCVE-2021-29103 · Other software · Esri · reported by psirt@esri.comMedium 6.1
A reflected Cross Site Scripting (XXS) vulnerability in ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2021A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to clickCVE-2021-29106 · Other software · Esri · reported by psirt@esri.comMedium 6.1
A reflected Cross Site Scripting (XSS) vulnerability in Esri ArcGIS Server version 10.8.1 and below may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the user’s browser.
- Product
- ArcGIS Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2021A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafteCVE-2021-35361 · Other software · Dotcms · reported by MITREMedium 4.8
A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload.
- Product
- Dotcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2021A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a cCVE-2021-35360 · Other software · Dotcms · reported by MITREMedium 4.8
A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload.
- Product
- Dotcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 9, 2021Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page anCVE-2021-30119 · Other software · Kaseya · reported by MITREMedium 5.4
Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `https://x.x.x.x/done.asp?FileName=";</script><script>alert(1);a="&PathData=&originalName=shell.aspx&FileSize=4388&TimeElapsed=00:00:00.078`
- Product
- VSA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcsirt.divd.nlcsirt.divd.nl
Jul 7, 2021A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and tCVE-2021-22227 · Websites & servers · GitLab · reported by cve@gitlab.comMedium 6.1
A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and trigger actions on their behalf if they clicked it
- Product
- GitLab
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 2, 2021A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web CVE-2020-23181 · Websites & servers · Php-fusion · reported by MITREMedium 5.4
A reflected cross site scripting (XSS) vulnerability in /administration/theme.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Manage Theme" field.
- Product
- Php-fusion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2021phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.CVE-2021-35438 · Websites & servers · Phpipam · reported by MITREMedium 6.1
phpIPAM 1.4.3 allows Reflected XSS via app/dashboard/widgets/ipcalc-result.php and app/tools/ip-calculator/result.php of the IP calculator.
- Product
- Phpipam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2021Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS) vulnerability in the product's CaptiveCVE-2021-31521 · Other software · Trend Micro · reported by security@trendmicro.comMedium 5.4
Trend Micro InterScan Web Security Virtual Appliance version 6.5 was found to have a reflected cross-site scripting (XSS) vulnerability in the product's Captive Portal.
- Product
- Trend Micro InterScan Web Security Virtual Appliance
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsuccess.trendmicro.comsuccess.trendmicro.com
Jun 10, 2021Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-siteCVE-2021-21666 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Kiuwan Plugin 1.6.0 and earlier does not escape query parameters in an error message for a form validation endpoint, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Kiuwan Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comjenkins.io
Jun 10, 2021A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding wCVE-2021-20293 · Other software · Redhat · reported by Red HatMedium 6.1
A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly handle URL encoding when calling @javax.ws.rs.PathParam without any @Produces MediaType. This flaw allows an attacker to launch a reflected XSS attack. The highest threat from this vulnerability is to data confidentiality and integrity.
- Product
- Resteasy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comsecurity.netapp.com
Jun 9, 2021An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface.CVE-2021-23854 · Other software · Bosch · reported by psirt@bosch.comHigh 8.3
An error in the handling of a page parameter in Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. This issue only affects versions 7.7x and 7.6x. All other versions are not affected.
- Product
- CPP Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jun 9, 2021An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface.CVE-2021-23848 · Other software · Bosch · reported by psirt@bosch.comHigh 8.3
An error in the URL handler Bosch IP cameras may lead to a reflected cross site scripting (XSS) in the web-based interface. An attacker with knowledge of the camera address can send a crafted link to a user, which will execute javascript code in the context of the user.
- Product
- CPP Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpsirt.bosch.compsirt.bosch.com
Jun 8, 2021In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] varCVE-2021-32106 · Other software · Icecoder · reported by MITREMedium 5.4
In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the _GET['replace'] variable. As a result, arbitrary Javascript code can get executed.
- Product
- Icecoder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comgroups.google.com
Jun 7, 2021PageLayer before 1.3.5 allows reflected XSS via color settings.CVE-2020-36384 · Other software · Pagelayer · reported by MITREMedium 6.1
PageLayer before 1.3.5 allows reflected XSS via color settings.
- Product
- Pagelayer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 7, 2021PageLayer before 1.3.5 allows reflected XSS via the font-size parameter.CVE-2020-36383 · Other software · Pagelayer · reported by MITREMedium 6.1
PageLayer before 1.3.5 allows reflected XSS via the font-size parameter.
- Product
- Pagelayer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordwordfence.comwordfence.com
Jun 4, 2021BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting (XSS) vulnerability by inserting a XSS payload within the 'fileurl' parameter.CVE-2020-36139 · Other software · Bloofox · reported by MITREMedium 5.4
BloofoxCMS 0.5.2.1 allows Reflected Cross-Site Scripting (XSS) vulnerability by inserting a XSS payload within the 'fileurl' parameter.
- Product
- Bloofoxcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 2, 2021A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center.CVE-2021-28807 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twHigh 7.7
A post-authentication reflected XSS vulnerability has been reported to affect QNAP NAS running Q’center. If exploited, this vulnerability allows remote attackers to inject malicious code. QNAP have already fixed this vulnerability in the following versions of Q’center: QTS 4.5.3: Q’center v1.12.1012 and later QTS 4.3.6: Q’center v1.10.1004 and later QTS 4.3.3: Q’center v1.10.1004 and later QuTS hero h4.5.2: Q’center v1.12.1012 and later QuTScloud c4.5.4: Q’center v1.12.1012 and later
- Product
- Q’center
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2021A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameCVE-2021-33562 · Other software · Shopizer · reported by MITREMedium 4.8
A reflected cross-site scripting (XSS) vulnerability in Shopizer before 2.17.0 allows remote attackers to inject arbitrary web script or HTML via the ref parameter to a page about an arbitrary product, e.g., a product/insert-product-name-here.html/ref= URL.
- Product
- Shopizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2021Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner, tCVE-2020-26560 · Other software · Bluetooth · reported by MITREHigh 8.1
Bluetooth Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may permit a nearby device, reflecting the authentication evidence from a Provisioner, to complete authentication without possessing the AuthValue, and potentially acquire a NetKey and AppKey.
- Product
- Mesh Profile
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkb.cert.orgbluetooth.com
May 24, 2021Reflected cross-site scripting vulnerability in the admin page of [Calendar01] free edition ver1.0.1 and earlier allows a remote attacker to inject an arbitraryCVE-2021-20725 · Websites & servers · PHP Factory · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in the admin page of [Calendar01] free edition ver1.0.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
- Product
- [Calendar01] free edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2021Reflected cross-site scripting vulnerability in the admin page of [Telop01] free edition ver1.0.1 and earlier allows a remote attacker to inject an arbitrary scCVE-2021-20724 · Websites & servers · PHP Factory · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in the admin page of [Telop01] free edition ver1.0.1 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
- Product
- [Telop01] free edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2021Reflected cross-site scripting vulnerability in [MailForm01] free edition (versions which the last updated date listed at the top of descriptions in the programCVE-2021-20723 · Websites & servers · PHP Factory · reported by vultures@jpcert.or.jpMedium 6.1
Reflected cross-site scripting vulnerability in [MailForm01] free edition (versions which the last updated date listed at the top of descriptions in the program file is from 2014 December 12 to 2018 July 27) allows a remote attacker to inject an arbitrary script via unspecified vectors.
- Product
- [MailForm01] free edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2021Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.CVE-2021-33507 · Other software · Plone · reported by MITREMedium 6.1
Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.
- Product
- Plone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 17, 2021tab parameter of the settings page of the All 404 Redirect to Homepage: Was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issueCVE-2021-24326 · WordPress plugins & themes · reported by WPScanMedium 5.4
The tab parameter of the settings page of the All 404 Redirect to Homepage WordPress plugin before 1.21 was vulnerable to an authenticated reflected Cross-Site Scripting (XSS) issue as user input was not properly sanitised before being output in an attribute.
- Product
- tab parameter of the settings page of the All 404 Redirect to Homepage
- Fixed in
- 1.21
- What to do
- Update tab parameter of the settings page of the All 404 Redirect to Homepage to 1.21 or newer.
May 17, 2021tab parameter of the settings page of the 404 SEO Redirection: Is vulnerable to a reflected Cross-Site Scripting (XSS) issueCVE-2021-24325 · WordPress plugins & themes · reported by WPScanMedium 6.1
The tab parameter of the settings page of the 404 SEO Redirection WordPress plugin through 1.3 is vulnerable to a reflected Cross-Site Scripting (XSS) issue as user input is not properly sanitised or escaped before being output in an attribute.
- Product
- tab parameter of the settings page of the 404 SEO Redirection
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update tab parameter of the settings page of the 404 SEO Redirection to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
May 14, 2021Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_idCVE-2021-24291 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.69 was vulnerable to Reflected Cross-Site Scripting (XSS) issues via the gallery_id, tag, album_id and _id GET parameters passed to the bwg_frontend_data AJAX action (available to both unauthenticated and authenticated users)
- Product
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Fixed in
- 1.5.69
- What to do
- Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to 1.5.69 or newer.
Full record and what to do →NVD recordpacketstormsecurity.comwpscan.com
May 14, 2021The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.CVE-2021-24283 · WordPress plugins & themes · reported by WPScanMedium 5.4
The tab GET parameter of the settings page is not sanitised or escaped when being output back in an HTML attribute, leading to a reflected XSS issue.
- Fixed in
- 2.2.30
- What to do
- Update the plugin to 2.2.30 or newer.
May 12, 2021Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS).CVE-2021-30213 · Other software · ENG · reported by MITREMedium 6.1
Knowage Suite 7.3 is vulnerable to unauthenticated reflected cross-site scripting (XSS). An attacker can inject arbitrary web script in '/servlet/AdapterHTTP' via the 'targetService' parameter.
- Product
- Knowage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 11, 2021The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options.CVE-2021-32573 · Other software · Express-cart Project · reported by MITREMedium 4.8
The express-cart package through 1.1.10 for Node.js allows Reflected XSS (for an admin) via a user input field for product options. NOTE: the vendor states that this "would rely on an admin hacking his/her own website.
- Product
- Express-cart
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhackerone.comhackerone.com
May 11, 2021Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (CVE-2021-21648 · Websites & servers · Jenkins project · reported by jenkinsci-cert@googlegroups.comMedium 6.1
Jenkins Credentials Plugin 2.3.18 and earlier does not escape user-controlled information on a view it provides, resulting in a reflected cross-site scripting (XSS) vulnerability.
- Product
- Jenkins Credentials Plugin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.