Total
47482 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-37139 | 1 Razormist | 1 Loan Management System | 2026-06-17 | N/A | 5.4 MEDIUM |
| Loan Management System version 1.0 suffers from a persistent cross site scripting vulnerability. | |||||
| CVE-2022-37137 | 1 Techvill | 1 Paymoney | 2026-06-17 | N/A | 5.4 MEDIUM |
| PayMoney 3.3 is vulnerable to Stored Cross-Site Scripting (XSS) during replying the ticket. The XSS can be obtain from injecting under "Message" field with "description" parameter with the specially crafted payload to gain Stored XSS. The XSS then will prompt after that or can be access from the view ticket function. | |||||
| CVE-2022-37063 | 1 Flir | 2 Flir Ax8, Flir Ax8 Firmware | 2026-06-17 | N/A | 5.4 MEDIUM |
| All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Cross Site Scripting (XSS) due to improper input sanitization. An authenticated remote attacker can execute arbitrary JavaScript code in the web management interface. A successful exploit could allow the attacker to insert malicious JavaScript code. NOTE: The vendor has stated that with the introduction of firmware version 1.49.16 (Jan 2023) the FLIR AX8 should no longer be affected by the vulnerability reported. Latest firmware version (as of Oct 2025, was released Jun 2024) is 1.55.16. | |||||
| CVE-2022-37059 | 1 Intelliants | 1 Subrion Cms | 2026-06-17 | N/A | 4.8 MEDIUM |
| Cross Site Scripting (XSS) in Admin Panel of Subrion CMS 4.2.1 allows attacker to inject arbitrary code via Login Field | |||||
| CVE-2022-37044 | 1 Zimbra | 1 Collaboration | 2026-06-17 | N/A | 6.1 MEDIUM |
| In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lead to reflected XSS that allows executing arbitrary JavaScript on the victim's machine. | |||||
| CVE-2022-37028 | 1 Iris | 1 Isams | 2026-06-17 | N/A | 5.4 MEDIUM |
| ISAMS 22.2.3.2 is prone to stored Cross-site Scripting (XSS) attack on the title field for groups, allowing an attacker to store a JavaScript payload that will be executed when another user uses the application. | |||||
| CVE-2022-36967 | 1 Progress | 1 Ipswitch Ws Ftp Server | 2026-06-17 | N/A | 6.1 MEDIUM |
| In Progress WS_FTP Server prior to version 8.7.3, multiple reflected cross-site scripting (XSS) vulnerabilities exist in the administrative web interface. It is possible for a remote attacker to inject arbitrary JavaScript into a WS_FTP administrator's web session. This would allow the attacker to execute code within the context of the victim's browser. | |||||
| CVE-2022-36965 | 1 Solarwinds | 1 Solarwinds Platform | 2026-06-17 | N/A | 6.1 MEDIUM |
| Insufficient sanitization of inputs in QoE application input field could lead to stored and Dom based XSS attack. This issue is fixed and released in SolarWinds Platform (2022.3.0). | |||||
| CVE-2022-36948 | 1 Veritas | 1 Netbackup | 2026-06-17 | N/A | 5.4 MEDIUM |
| In Veritas NetBackup OpsCenter, a DOM XSS attack can occur. This affects 8.x through 8.3.0.2, 9.x through 9.0.0.1, 9.1.x through 9.1.0.1, and 10. | |||||
| CVE-2022-36922 | 1 Jenkins | 1 Lucene-search | 2026-06-17 | N/A | 6.1 MEDIUM |
| Jenkins Lucene-Search Plugin 370.v62a5f618cd3a and earlier does not escape the search query parameter displayed on the 'search' result page, resulting in a reflected cross-site scripting (XSS) vulnerability. | |||||
| CVE-2022-36905 | 1 Jenkins | 1 Maven Metadata | 2026-06-17 | N/A | 5.4 MEDIUM |
| Jenkins Maven Metadata Plugin for Jenkins CI server Plugin 2.2 and earlier does not perform URL validation for the Repository Base URL of List maven artifact versions parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||||
| CVE-2022-36902 | 1 Jenkins | 1 Dynamic Extended Choice Parameter | 2026-06-17 | N/A | 5.4 MEDIUM |
| Jenkins Dynamic Extended Choice Parameter Plugin 1.0.1 and earlier does not escape several fields of Moded Extended Choice parameters, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||||
| CVE-2022-36880 | 1 Webmin | 2 Usermin, Webmin | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Read Mail module in Webmin 1.995 and Usermin through 1.850 allows XSS via a crafted HTML e-mail message. | |||||
| CVE-2022-36859 | 1 Samsung | 1 Smarttagplugin | 2026-06-17 | N/A | 5.7 MEDIUM |
| Improper input validation vulnerability in SmartTagPlugin prior to version 1.2.21-6 allows privileged attackers to trigger a XSS on a victim's devices. | |||||
| CVE-2022-36801 | 1 Atlassian | 2 Jira Data Center, Jira Server | 2026-06-17 | N/A | 6.1 MEDIUM |
| Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint. The affected versions are before version 8.20.8. | |||||
| CVE-2022-36796 | 1 Callrail | 1 Callrail Phone Call Tracking | 2026-06-17 | N/A | 6.1 MEDIUM |
| Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in CallRail, Inc. CallRail Phone Call Tracking plugin <= 0.4.9 at WordPress. | |||||
| CVE-2022-36791 | 1 Awesome | 1 Torro Forms | 2026-06-17 | N/A | 5.4 MEDIUM |
| Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress. | |||||
| CVE-2022-36783 | 1 Algosec | 1 Fireflow | 2026-06-17 | N/A | 6.5 MEDIUM |
| AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result.html page. The malicious user changes the request from POST to GET and sends the URL to another user (victim). JavaScript code is executed on the browser of the other user. | |||||
| CVE-2022-36778 | 1 Synel | 1 Eharmony | 2026-06-17 | N/A | 6.5 MEDIUM |
| insert HTML / js code inside input how to get to the vulnerable input : Workers > worker nickname > inject in this input the code. | |||||
| CVE-2022-36776 | 2 Ibm, Linux | 2 Cloud Pak For Security, Linux Kernel | 2026-06-17 | N/A | 5.4 MEDIUM |
| IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 233663. | |||||