Total
47482 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-42960 | 1 Equalweb | 1 Equalweb Accessibility Widget | 2026-06-17 | N/A | 5.4 MEDIUM |
| EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of message events to accessibility.js. | |||||
| CVE-2022-42954 | 1 Keyfactor | 1 Kefactor Ejbca | 2026-06-17 | N/A | 5.4 MEDIUM |
| Keyfactor EJBCA before 7.10.0 allows XSS. | |||||
| CVE-2022-42909 | 1 Wepanow | 1 Print Away | 2026-06-17 | N/A | 6.5 MEDIUM |
| WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to exploit this vulnerability, the user must have an account with wepanow.com or any of the institutions they serve, and be logged in. | |||||
| CVE-2022-42908 | 1 Wepanow | 1 Print Away | 2026-06-17 | N/A | 6.3 MEDIUM |
| WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a document with a malicious filename, which will be included in subsequent HTTP responses, allowing a stored XSS to occur. This attack is persistent across victim sessions. | |||||
| CVE-2022-42786 | 1 Wut | 34 At-modem-emulator, At-modem-emulator Firmware, Com-server 20ma and 31 more | 2026-06-17 | N/A | 5.4 MEDIUM |
| Multiple W&T Products of the ComServer Series are prone to an XSS attack. An authenticated remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into the title of the configuration webpage | |||||
| CVE-2022-42753 | 1 Salonerp Project | 1 Salonerp | 2026-06-17 | N/A | 6.1 MEDIUM |
| SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks. | |||||
| CVE-2022-42750 | 1 Auieo | 1 Candidats | 2026-06-17 | N/A | 8.8 HIGH |
| CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user. | |||||
| CVE-2022-42749 | 1 Auieo | 1 Candidats | 2026-06-17 | N/A | 6.1 MEDIUM |
| CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks. | |||||
| CVE-2022-42748 | 1 Auieo | 1 Candidats | 2026-06-17 | N/A | 6.1 MEDIUM |
| CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks. | |||||
| CVE-2022-42747 | 1 Auieo | 1 Candidats | 2026-06-17 | N/A | 6.1 MEDIUM |
| CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks. | |||||
| CVE-2022-42746 | 1 Auieo | 1 Candidats | 2026-06-17 | N/A | 6.1 MEDIUM |
| CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks. | |||||
| CVE-2022-42715 | 1 Vanderbilt | 1 Redcap | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger arbitrary JavaScript code execution. | |||||
| CVE-2022-42711 | 1 Progress | 1 Whatsup Gold | 2026-06-17 | N/A | 9.6 CRITICAL |
| In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser. | |||||
| CVE-2022-42710 | 1 Niceforyou | 2 Linear Emerge E3 Access Control, Linear Emerge E3 Access Control Firmware | 2026-06-17 | N/A | 5.4 MEDIUM |
| Nice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e devices are vulnerable to Stored Cross-Site Scripting (XSS). | |||||
| CVE-2022-42704 | 1 Servicenow | 1 Servicenow | 2026-06-17 | N/A | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget. | |||||
| CVE-2022-42486 | 1 Basercms | 1 Basercms | 2026-06-17 | N/A | 4.8 MEDIUM |
| Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrative privilege to inject an arbitrary script. | |||||
| CVE-2022-42485 | 1 Galaxyweblinks | 1 Gallery With Thumbnail Slider | 2026-06-17 | N/A | 5.4 MEDIUM |
| Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <= 6.0 versions. | |||||
| CVE-2022-42466 | 1 Apache | 1 Isis | 2026-06-17 | N/A | 6.1 MEDIUM |
| Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release, the inputted strings are properly escaped when rendered. | |||||
| CVE-2022-42462 | 1 Ad33lx | 1 Ip Blacklist Cloud | 2026-06-17 | N/A | 4.8 MEDIUM |
| Auth. Stored Cross-Site Scripting (XSS) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions. | |||||
| CVE-2022-42460 | 1 Sedlex | 1 Traffic Manager | 2026-06-17 | N/A | 6.5 MEDIUM |
| Broken Access Control vulnerability leading to Stored Cross-Site Scripting (XSS) in Traffic Manager plugin <= 1.4.5 on WordPress. | |||||