Total
47482 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-6275 | 1 Totvs | 1 Fluig | 2026-06-17 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argument redirectUrl/user with the input "><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.1-231128, 1.8.0-231127 and 1.8.1-231127 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-246104. | |||||
| CVE-2023-6268 | 1 Json-content-importer | 1 Json Content Importer | 2026-06-17 | N/A | 6.1 MEDIUM |
| The JSON Content Importer WordPress plugin before 1.5.4 does not sanitise and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |||||
| CVE-2023-6225 | 1 Getshortcodes | 1 Shortcodes Ultimate | 2026-06-17 | N/A | 6.4 MEDIUM |
| The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's su_meta shortcode combined with post meta data in all versions up to, and including, 5.13.3 due to insufficient input sanitization and output escaping on user supplied meta values. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-6217 | 1 Progress | 1 Moveit Transfer | 2026-06-17 | N/A | 7.1 HIGH |
| In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnerability has been identified when MOVEit Gateway is used in conjunction with MOVEit Transfer. An attacker could craft a malicious payload targeting the system which comprises a MOVEit Gateway and MOVEit Transfer deployment. If a MOVEit user interacts with the crafted payload, the attacker would be able to execute malicious JavaScript within the context of the victim’s browser. | |||||
| CVE-2023-6184 | 1 Citrix | 1 Virtual Apps And Desktops | 2026-06-17 | N/A | 5.0 MEDIUM |
| Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting | |||||
| CVE-2023-6166 | 1 Ays-pro | 1 Quiz Maker | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting | |||||
| CVE-2023-6165 | 1 Benaceur-php | 1 Restrict Usernames Emails Characters | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | |||||
| CVE-2023-6164 | 1 Mainwp | 1 Mainwp | 2026-06-17 | N/A | 2.2 LOW |
| The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in all versions up to, and including, 4.5.1.2 due to insufficient input sanitization. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary CSS values into the site tags. | |||||
| CVE-2023-6163 | 1 Themeum | 1 Wp Crowdfunding | 2026-06-17 | N/A | 4.8 MEDIUM |
| The WP Crowdfunding WordPress plugin before 2.1.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2023-6161 | 1 Themeum | 1 Wp Crowdfunding | 2026-06-17 | N/A | 6.1 MEDIUM |
| The WP Crowdfunding WordPress plugin before 2.1.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin | |||||
| CVE-2023-6148 | 1 Qualys | 1 Policy Compliance | 2026-06-17 | N/A | 5.7 MEDIUM |
| Qualys Jenkins Plugin for Policy Compliance prior to version and including 1.0.5 was identified to be affected by a security flaw, which was missing a permission check while performing a connectivity check to Qualys Cloud Services. This allowed any user with login access and access to configure or edit jobs to utilize the plugin to configure a potential rouge endpoint via which it was possible to control response for certain request which could be injected with XSS payloads leading to XSS while processing the response data | |||||
| CVE-2023-6146 | 1 Qualys | 1 Private Cloud Platform | 2026-06-17 | N/A | 5.7 MEDIUM |
| A Qualys web application was found to have a stored XSS vulnerability resulting from the absence of HTML encoding in the presentation of logging information to users. This vulnerability allowed a user with login access to the application to introduce XSS payload via browser details. | |||||
| CVE-2023-6142 | 1 Armanidrisi | 1 Dev Blog | 2026-06-17 | N/A | 5.4 MEDIUM |
| Dev blog v1.0 allows to exploit an XSS through an unrestricted file upload, together with a bad entropy of filenames. With this an attacker can upload a malicious HTML file, then guess the filename of the uploaded file and send it to a potential victim. | |||||
| CVE-2023-6141 | 1 G5plus | 1 Essential Real Estate | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Essential Real Estate WordPress plugin before 4.4.0 does not apply proper capability checks on its AJAX actions, which among other things, allow attackers with a subscriber account to conduct Stored XSS attacks. | |||||
| CVE-2023-6128 | 1 Salesagility | 1 Suitecrm | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Reflected in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. | |||||
| CVE-2023-6122 | 1 Softomi | 1 Advanced C2c Marketplace Software | 2026-06-17 | N/A | 6.1 MEDIUM |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in İstanbul Soft Informatics and Consultancy Limited Company Softomi Gelişmiş C2C Pazaryeri Yazılımı allows Reflected XSS. This issue affects Softomi Gelişmiş C2C Pazaryeri Yazılımı: before 12122023. | |||||
| CVE-2023-6103 | 1 Intelbras | 2 Rx 1500, Rx 1500 Firmware | 2026-06-17 | 3.3 LOW | 2.4 LOW |
| A vulnerability has been found in Intelbras RX 1500 1.1.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /WiFi.html of the component SSID Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-245065 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2023-6098 | 1 Icssolution | 1 Ics Business Manager | 2026-06-17 | N/A | 6.3 MEDIUM |
| An XSS vulnerability has been discovered in ICS Business Manager affecting version 7.06.0028.7066. A remote attacker could send a specially crafted string exploiting the obdd_act parameter, allowing the attacker to steal an authenticated user's session, and perform actions within the application. | |||||
| CVE-2023-6082 | 1 Chartjs Project | 1 Chartjs | 2026-06-17 | N/A | 5.4 MEDIUM |
| The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2023-6081 | 1 Chartjs Project | 1 Chartjs | 2026-06-17 | N/A | 5.4 MEDIUM |
| The chartjs WordPress plugin through 2023.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||