Export limit exceeded: 88023 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (88023 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-1527 | 1 Wpwhitesecurity | 1 Wp 2fa | 2024-11-21 | 6.1 Medium |
| The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting | ||||
| CVE-2022-1514 | 1 Facturascripts | 1 Facturascripts | 2024-11-21 | 5.4 Medium |
| Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account. | ||||
| CVE-2022-1513 | 1 Lenovo | 1 Pcmanager | 2024-11-21 | 7.3 High |
| A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specially crafted website. | ||||
| CVE-2022-1512 | 1 Scrollrevealjs-effects Project | 1 Scrollrevealjs-effects | 2024-11-21 | 4.8 Medium |
| The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | ||||
| CVE-2022-1509 | 1 Hestiacp | 1 Control Panel | 2024-11-21 | 9.9 Critical |
| Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context. | ||||
| CVE-2022-1506 | 1 Wp Born Babies Project | 1 Wp Born Babies | 2024-11-21 | 5.4 Medium |
| The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks | ||||
| CVE-2022-1504 | 1 Microweber | 1 Microweber | 2024-11-21 | 6.1 Medium |
| XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks. | ||||
| CVE-2022-1494 | 1 Google | 1 Chrome | 2024-11-21 | 6.1 Medium |
| Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types policy via a crafted HTML page. | ||||
| CVE-2022-1492 | 1 Google | 1 Chrome | 2024-11-21 | 6.1 Medium |
| Insufficient data validation in Blink Editing in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to inject arbitrary scripts or HTML via a crafted HTML page. | ||||
| CVE-2022-1489 | 1 Google | 2 Chrome, Chrome Os | 2024-11-21 | 8.8 High |
| Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific user interactions. | ||||
| CVE-2022-1484 | 1 Google | 1 Chrome | 2024-11-21 | 8.8 High |
| Heap buffer overflow in Web UI Settings in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||||
| CVE-2022-1483 | 1 Google | 1 Chrome | 2024-11-21 | 8.8 High |
| Heap buffer overflow in WebGPU in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. | ||||
| CVE-2022-1482 | 1 Google | 1 Chrome | 2024-11-21 | 6.5 Medium |
| Inappropriate implementation in WebGL in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||||
| CVE-2022-1474 | 1 Wp-eventmanager | 1 Wp Event Manager | 2024-11-21 | 6.1 Medium |
| The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, leading to a Reflected Cross-Site Scripting | ||||
| CVE-2022-1470 | 1 Ultimate Woocommerce Csv Importer Project | 1 Ultimate Woocommerce Csv Importer | 2024-11-21 | 6.1 Medium |
| The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting | ||||
| CVE-2022-1469 | 1 Fibosearch | 1 Fibosearch | 2024-11-21 | 4.8 Medium |
| The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed | ||||
| CVE-2022-1465 | 1 Wpclever | 1 Wpc Smart Wishlist For Woocommerce | 2024-11-21 | 6.1 Medium |
| The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.9 does not sanitise and escape a parameter before outputting it back in an attribute via an AJAX action, leading to a Reflected Cross-Site Scripting issue. | ||||
| CVE-2022-1464 | 1 Gogs | 1 Gogs | 2024-11-21 | 5.4 Medium |
| Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account . | ||||
| CVE-2022-1458 | 1 Open-emr | 1 Openemr | 2024-11-21 | 5.4 Medium |
| Stored XSS Leads To Session Hijacking in GitHub repository openemr/openemr prior to 6.1.0.1. | ||||
| CVE-2022-1457 | 1 Facturascripts | 1 Facturascripts | 2024-11-21 | 5.4 Medium |
| Store XSS in title parameter executing at EditUser Page & EditProducto page in GitHub repository neorazorx/facturascripts prior to 2022.04. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account. | ||||