Total
47475 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-38319 | 1 Windyroad | 1 More From Google | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The More From Google WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $_SERVER["PHP_SELF"] value in the ~/morefromgoogle.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.0.2. | |||||
| CVE-2021-38318 | 1 3d Cover Carousel Project | 1 3d Cover Carousel | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The 3D Cover Carousel WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the id parameter in the ~/cover-carousel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0. | |||||
| CVE-2021-38317 | 1 Kibokolabs | 1 Konnichiwa | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Konnichiwa! Membership WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the plan_id parameter in the ~/views/subscriptions.html.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.8.3. | |||||
| CVE-2021-38316 | 1 Wp Academic People List Project | 1 Wp Academic People List | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WP Academic People List WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the category_name parameter in the ~/admin-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.4.1. | |||||
| CVE-2021-38315 | 1 Smartypantsplugins | 1 Sp Project \& Document Manager | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the ~/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25. | |||||
| CVE-2021-38295 | 1 Apache | 1 Couchdb | 2026-06-17 | 6.0 MEDIUM | 7.3 HIGH |
| In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML attachment to a document. If a CouchDB admin opens that attachment in a browser, e.g. via the CouchDB admin interface Fauxton, any JavaScript code embedded in that HTML attachment will be executed within the security context of that admin. A similar route is available with the already deprecated _show and _list functionality. This privilege escalation vulnerability allows an attacker to add or remove data in any database or make configuration changes. This issue affected Apache CouchDB prior to 3.1.2 | |||||
| CVE-2021-38221 | 1 Bbs-go Project | 1 Bbs-go | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| bbs-go <= 3.3.0 including Custom Edition is vulnerable to stored XSS. | |||||
| CVE-2021-38193 | 1 Ammonia Project | 1 Ammonia | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in the ammonia crate before 3.1.0 for Rust. XSS can occur because the parsing differences for HTML, SVG, and MathML are mishandled, a similar issue to CVE-2020-26870. | |||||
| CVE-2021-38186 | 1 Comrak Project | 1 Comrak | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in the comrak crate before 0.10.1 for Rust. It mishandles & characters, leading to XSS via &# HTML entities. | |||||
| CVE-2021-38183 | 1 Sap | 1 Netweaver | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| SAP NetWeaver - versions 700, 701, 702, 730, does not sufficiently encode user-controlled inputs, allowing an attacker to cause a potential victim to supply a malicious content to a vulnerable web application, which is then reflected to the victim and executed by the web browser, resulting in Cross-Site Scripting vulnerability. | |||||
| CVE-2021-38157 | 1 Leostream | 1 Connection Broker | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| LeoStream Connection Broker 9.x before 9.0.34.3 allows Unauthenticated Reflected XSS via the /index.pl user parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer | |||||
| CVE-2021-38156 | 1 Nagios | 1 Nagios Xi | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard. | |||||
| CVE-2021-38152 | 1 Chikitsa | 1 Patient Management System | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| index.php/appointment/insert_patient_add_appointment in Chikitsa Patient Management System 2.0.0 allows XSS. | |||||
| CVE-2021-38151 | 1 Chikitsa | 1 Patient Management System | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| index.php/appointment/todos in Chikitsa Patient Management System 2.0.0 allows XSS. | |||||
| CVE-2021-38149 | 1 Chikitsa | 1 Patient Management System | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| index.php/admin/add_user in Chikitsa Patient Management System 2.0.0 allows XSS. | |||||
| CVE-2021-38144 | 1 Formtools | 1 Core | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in Form Tools through 3.0.20. A low-privileged user can trigger Reflected XSS when a viewing a form via the submission_id parameter, e.g., clients/forms/edit_submission.php?form_id=1&view_id=1&submission_id=[XSS]. | |||||
| CVE-2021-38143 | 1 Formtools | 1 Core | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Form Tools through 3.0.20. When an administrator creates a customer account, it is possible for the customer to log in and proceed with a change of name and last name. However, these fields are vulnerable to XSS payload insertion, being triggered in the admin panel when the admin tries to see the client list. This type of XSS (stored) can lead to the extraction of the PHPSESSID cookie belonging to the admin. | |||||
| CVE-2021-38138 | 1 Onenav | 1 Onenav | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| OneNav beta 0.9.12 allows XSS via the Add Link feature. NOTE: the vendor's position is that there intentionally is not any XSS protection at present, because the attack risk is largely limited to a compromised account; however, XSS protection is planned for a future release. | |||||
| CVE-2021-38134 | 1 Microfocus | 1 Imanager | 2026-06-17 | N/A | 6.1 MEDIUM |
| Possible XSS in iManager URL for access Component has been discovered in OpenText™ iManager 3.2.5.0000. | |||||
| CVE-2021-38131 | 1 Microfocus | 1 Edirectory | 2026-06-17 | N/A | 5.4 MEDIUM |
| Possible Cross-Site Scripting (XSS) Vulnerability in eDirectory has been discovered in OpenText™ eDirectory 9.2.5.0000. | |||||