Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (42403 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2015-3618 1 Nagios 1 Business Process Intelligence 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in Nagios Business Process Intelligence (BPI) before 2.3.4 allows remote attackers to inject arbitrary web script or HTML via vectors involving index.php.
CVE-2015-3612 1 Fortinet 1 Fortimanager 2024-11-21 5.4 Medium
A Cross-site Scripting (XSS) vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto update service page.
CVE-2015-3425 1 Accentis 1 Content Resource Management System 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in Accentis Content Resource Management System before October 2015 patch allows remote attackers to inject arbitrary web script or HTML via the ctl00$cph_content$_uig_formState parameter.
CVE-2015-3172 1 Eidogo 1 Eidogo 2024-11-21 5.4 Medium
EidoGo is susceptible to Cross-Site Scripting (XSS) attacks via maliciously crafted SGF input.
CVE-2015-2992 1 Apache 1 Struts 2024-11-21 6.1 Medium
Apache Struts before 2.3.20 has a cross-site scripting (XSS) vulnerability.
CVE-2015-2796 1 Projectpier 1 Projectpier 2024-11-21 N/A
Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script or HTML via the search_for parameter to (1) search_by_tag.php, (2) search_contacts.php, or (3) search.php.
CVE-2015-2793 2 Fedoraproject, Ikiwiki 2 Fedora, Ikiwiki 2024-11-21 6.1 Medium
Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi.
CVE-2015-2329 1 Woocommerce 1 Woocommerce 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.3.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted order.
CVE-2015-2324 1 10web 1 Photo Gallery 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in the filemanager in the Photo Gallery plugin before 1.2.13 for WordPress allows remote authenticated users with edit permission to inject arbitrary web script or HTML via unspecified vectors.
CVE-2015-2249 1 Synacor 1 Zimbra Collaboration Server 2024-11-21 5.4 Medium
Zimbra Collaboration before 8.6.0 patch5 has XSS.
CVE-2015-2230 1 Synacor 1 Zimbra Collaboration Server 2024-11-21 6.1 Medium
Synacor Zimbra Collaboration Server 8.x before 8.7.0 has Reflected XSS in admin console.
CVE-2015-2207 1 Netcracker 1 Resource Management System 2024-11-21 5.4 Medium
Multiple cross-site scripting (XSS) vulnerabilities in NetCracker Resource Management System before 8.2 allow remote authenticated users to inject arbitrary web script or HTML via the (1) ctrl, (2) t90001_0_theform_selection, (3) _scroll, (4) tableName, (5) parent, (6) circuit, (7) return, (8) xname, or (9) mpTransactionId parameter.
CVE-2015-20106 1 Cbads 1 Clickbank Affiliate Ads 2024-11-21 4.8 Medium
The ClickBank Affiliate Ads WordPress plugin through 1.20 does not escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
CVE-2015-20105 1 Cbads 1 Clickbank Affiliate Ads 2024-11-21 9.6 Critical
The ClickBank Affiliate Ads WordPress plugin through 1.20 does not have CSRF check when saving its settings, allowing attacker to make logged in admin change them via a CSRF attack. Furthermore, due to the lack of escaping when they are outputting, it could also lead to Stored Cross-Site Scripting issues
CVE-2015-20019 1 Content Text Slider On Post Project 1 Content Text Slider On Post 2024-11-21 5.4 Medium
The Content text slider on post WordPress plugin before 6.9 does not sanitise and escape the Title and Message/Content settings, which could lead to Cross-Site Scripting issues
CVE-2015-1952 1 Ibm 1 Security Appscan 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in IBM AppScan Enterprise Edition 9.0.x before 9.0.2 iFix 001 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. IBM X-Force ID: 103416.
CVE-2015-1394 1 10web 1 Photo Gallery 2024-11-21 5.4 Medium
Multiple cross-site scripting (XSS) vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the (1) sort_by, (2) sort_order, (3) items_view, (4) dir, (5) clipboard_task, (6) clipboard_files, (7) clipboard_src, or (8) clipboard_dest parameters in an addImages action to wp-admin/admin-ajax.php.
CVE-2015-1390 1 Hp 1 Airwave 2024-11-21 6.1 Medium
Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.
CVE-2015-10131 2024-11-21 3.5 Low
A vulnerability was found in chrisy TFO Graphviz Plugin up to 1.9 on WordPress and classified as problematic. Affected by this issue is the function admin_page_load/admin_page of the file tfo-graphviz-admin.php. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 1.10 is able to address this issue. The name of the patch is 594c953a345f79e26003772093b0caafc14b92c2. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258620.
CVE-2015-10120 1 Webdevstudios 1 Wds Multisite Aggregate 2024-11-21 3.5 Low
A vulnerability, which was classified as problematic, was found in WDS Multisite Aggregate Plugin up to 1.0.0 on WordPress. Affected is the function update_options of the file includes/WDS_Multisite_Aggregate_Options.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 1.0.1 is able to address this issue. The name of the patch is 49e0bbcb6ff70e561365d9e0d26426598f63ca12. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-233364.