Total
47492 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-2082 | 1 Buymeacoffee | 1 Buy Me A Coffee | 2026-06-17 | N/A | 6.4 MEDIUM |
| The "Buy Me a Coffee – Button and Widget Plugin" plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including, 3.6 due to insufficient sanitization and escaping on the 'text value set via the bmc_post_reception action. This makes it possible for authenticated attackers, with subscriber-level permissions, and above to inject arbitrary web scripts into pages that execute whenever a victim accesses a page with the injected scripts. | |||||
| CVE-2023-2077 | 1 Campcodes | 1 Online Traffic Offense Management System | 2026-06-17 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability, which was classified as problematic, has been found in Campcodes Online Traffic Offense Management System 1.0. This issue affects some unknown processing of the file /admin/offenses/view_details.php. The manipulation of the argument id leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226055. | |||||
| CVE-2023-2076 | 1 Campcodes | 1 Online Traffic Offense Management System | 2026-06-17 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability classified as problematic was found in Campcodes Online Traffic Offense Management System 1.0. This vulnerability affects unknown code of the file /classes/Users.phpp. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-226054 is the identifier assigned to this vulnerability. | |||||
| CVE-2023-2072 | 1 Rockwellautomation | 2 Powermonitor 1000, Powermonitor 1000 Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| The Rockwell Automation PowerMonitor 1000 contains stored cross-site scripting vulnerabilities within the web page of the product. The vulnerable pages do not require privileges to access and can be injected with code by an attacker which could be used to leverage an attack on an authenticated user resulting in remote code execution and potentially the complete loss of confidentiality, integrity, and availability of the product. | |||||
| CVE-2023-2058 | 1 Eyoucms | 1 Eyoucms | 2026-06-17 | 3.3 LOW | 2.4 LOW |
| A vulnerability was found in EyouCms up to 1.6.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /yxcms/index.php?r=admin/extendfield/mesedit&tabid=12&id=4 of the component HTTP POST Request Handler. The manipulation of the argument web_ico leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-225943. | |||||
| CVE-2023-2057 | 1 Eyoucms | 1 Eyoucms | 2026-06-17 | 3.3 LOW | 2.4 LOW |
| A vulnerability was found in EyouCms 1.5.4. It has been classified as problematic. Affected is an unknown function of the file login.php?m=admin&c=Arctype&a=edit of the component New Picture Handler. The manipulation of the argument litpic_loca leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-225942 is the identifier assigned to this vulnerability. | |||||
| CVE-2023-2055 | 1 Campcodes | 1 Advanced Online Voting System | 2026-06-17 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability has been found in Campcodes Advanced Online Voting System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/config_save.php. The manipulation of the argument title leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-225940. | |||||
| CVE-2023-2044 | 1 Assaabloy | 1 Control Id Idsecure | 2026-06-17 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability has been found in Control iD iDSecure 4.7.29.1 and classified as problematic. This vulnerability affects unknown code of the component Dispositivos Page. The manipulation of the argument IP-DNS leads to cross site scripting. The attack can be initiated remotely. VDB-225922 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2023-2031 | 1 Plainware | 1 Locatoraid | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2023-2023 | 1 Kunalnagar | 1 Custom 404 Pro | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting. | |||||
| CVE-2023-2021 | 1 Teampass | 1 Teampass | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in GitHub repository nilsteampassnet/teampass prior to 3.0.3. | |||||
| CVE-2023-2015 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 4.4 MEDIUM |
| An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A reflected XSS was possible when creating new abuse reports which allows attackers to perform arbitrary actions on behalf of victims. | |||||
| CVE-2023-2014 | 1 Microweber | 1 Microweber | 2026-06-17 | N/A | 4.8 MEDIUM |
| Cross-site Scripting (XSS) - Generic in GitHub repository microweber/microweber prior to 1.3.3. | |||||
| CVE-2023-2009 | 1 Pretty Url Project | 1 Pretty Url | 2026-06-17 | N/A | 4.8 MEDIUM |
| Plugin does not sanitize and escape the URL field in the Pretty Url WordPress plugin through 1.5.4 settings, which could allow high-privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | |||||
| CVE-2023-29998 | 1 Gis3w | 1 G3w-suite | 2026-06-17 | N/A | 5.4 MEDIUM |
| A Cross-site scripting (XSS) vulnerability in the content editor in Gis3W g3w-suite 3.5 allows remote authenticated users to inject arbitrary web script or HTML and gain privileges via the description parameter. | |||||
| CVE-2023-29983 | 1 Companymaps Project | 1 Companymaps | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross Site Scripting vulnerability found in Maximilian Vogt cmaps v.8.0 allows a remote attacker to execute arbitrary code via the auditlog tab in the admin panel. | |||||
| CVE-2023-29854 | 1 Dircms Project | 1 Dircms | 2026-06-17 | N/A | 6.1 MEDIUM |
| DirCMS 6.0.0 has a Cross Site Scripting (XSS) vulnerability in the foreground. | |||||
| CVE-2023-29848 | 1 Hockeycomputindo | 1 Bang Resto | 2026-06-17 | N/A | 4.8 MEDIUM |
| Bang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php Add New Menu function. | |||||
| CVE-2023-29847 | 1 Aerocms Project | 1 Aerocms | 2026-06-17 | N/A | 5.4 MEDIUM |
| AeroCMS v0.0.1 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the comment_author and comment_content parameters at /post.php. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via a crafted payload. | |||||
| CVE-2023-29839 | 1 Digitaldruid | 1 Hoteldruid | 2026-06-17 | N/A | 5.4 MEDIUM |
| A Stored Cross Site Scripting (XSS) vulnerability exists in multiple pages of Hotel Druid version 3.0.4, which allows arbitrary execution of commands. The vulnerable fields are Surname, Name, and Nickname in the Document function. | |||||