Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows...
CVE-2020-37237
Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to
#cwe-79
共收录 5879 条相关情报。
← 返回所有主题Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows...
CVE-2020-37240
Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrat
Quick.CMS 6.7 contains a cross-site scripting vulnerability in the sliders form that allows authenticated attackers to inject malicious scripts by submitting XSS payloads throug...
CVE-2021-47981
CVE-2021-47981 是 Quick.CMS 6.7 版本中 sliders 表单存在的一个跨站脚本（XSS）漏洞。攻击者可以通过向 sDescription 参数提交恶意 payload，在管理员提交表单时执行任意 JavaScr
WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the fieldtitle parameter. A...
CVE-2021-47975
WP Learn Manager 1.1.2 版本中存在一个存储型跨站脚本（XSS）漏洞。未经身份认证的攻击者可以通过向 jslm_fieldordering 页面发送 POST 请求，在 fieldtitle 参数中注入恶意脚本。当管理员
Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting unsanitized input to the ...
CVE-2021-47957
Cookie Law Bar 1.2.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject
CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript by uploading malicious SVG files through the fil...
CVE-2021-47955
CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary Ja
MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user profile fie...
CVE-2021-47934
MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts
Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attackers to access files outside the web root by injecting di...
CVE-2020-37245
Supsystic Digital Publications 1.6.9 contains a path traversal vulnerability in the Folder input field that allows attac
Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through user creation fie...
CVE-2020-37240
Queue Management System 4.0.0 contains a stored cross-site scripting vulnerability that allows authenticated administrat
CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content Manager access to inject malicious scripts through SVG f...
CVE-2020-37238
CMS Made Simple 2.2.15 contains a stored cross-site scripting vulnerability that allows authenticated users with Content
Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the banner management i...
CVE-2020-37237
Composr CMS 10.0.34 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to
NewsLister contains an authenticated persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts through the title paramet...
CVE-2020-37236
NewsLister contains an authenticated persistent cross-site scripting vulnerability that allows authenticated administrat
WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows authenticated users to inject malicious scripts by manipulati...
CVE-2020-37235
WordPress Theme Wibar 1.1.8 contains a stored cross-site scripting vulnerability in the Brand component that allows auth
WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated attackers with moderator privileges to inject malicious scri...
CVE-2020-37233
WordPress Plugin Buddypress 6.2.0 contains a persistent cross-site scripting vulnerability that allows authenticated att
Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS)...
CVE-2026-8656
Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated format
Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated formatter due to improper sanitization of JSON values and prope...
CVE-2026-8656
Versions of the package jsondiffpatch before 0.7.6 are vulnerable to Cross-site Scripting (XSS) via the annotated format
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, a Stored Cross-Site Scripting (XSS) vulnerability exists in th...
CVE-2026-45665
Open WebUI 是一个自托管的离线 AI 平台。在版本 0.8.0 之前，其横幅组件存在存储型跨站脚本（XSS）漏洞，根因是内容净化顺序不当：DOMPurify 在 marked 库之前执行，导致恶意管理员可在全局横幅中植入 Java
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, his advisory tracks a regression of the original Excel-preview...
CVE-2026-45318
CVE-2026-45318 是一个存在于 Open WebUI（一个自托管的离线 AI 平台）中的跨站脚本（XSS）漏洞的回归。该漏洞源于先前已修复的 Excel 预览 XSS 漏洞（CVE-2026-44549）在 v0.8.0 之后的
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.3, the audio transcription upload endpoint takes the file extensi...
CVE-2026-45315
Open WebUI 是一个自托管的离线人工智能平台。在 0.9.3 版本之前，音频转录上传端点存在严重的存储型跨站脚本（XSS）漏洞。该端点接受用户提供的文件名，并从中提取扩展名，将文件保存到 CACHE_DIR/audio/transc
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.5, through the HTML rendering view, scripts can be injected and e...
CVE-2026-45303
CVE-2026-45303 是 Open WebUI 中的一个跨站脚本（XSS）漏洞，影响版本 0.6.5 之前。Open WebUI 是一个自托管的离线人工智能平台，其前端提供“HTML 渲染视图”功能，用于可视化当前聊天的 HTML