Total
47475 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-35361 | 1 Dotcms | 1 Dotcms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/links of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload. | |||||
| CVE-2021-35360 | 1 Dotcms | 1 Dotcms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| A reflected cross site scripting (XSS) vulnerability in dotAdmin/#/c/containers of dotCMS 21.05.1 allows attackers to execute arbitrary commands or HTML via a crafted payload. | |||||
| CVE-2021-35358 | 1 Dotcms | 1 Dotcms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| A stored cross site scripting (XSS) vulnerability in dotAdmin/#/c/c_Images of dotCMS 21.05.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the 'Title' and 'Filename' parameters. | |||||
| CVE-2021-35323 | 1 Bludit | 1 Bludit | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) vulnerability exists in bludit 3-13-1 via the username in admin/login. | |||||
| CVE-2021-35303 | 1 Zammad | 1 Zammad | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via the User Avatar attribute. | |||||
| CVE-2021-35298 | 1 Zammad | 1 Zammad | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross Site Scripting (XSS) in Zammad 1.0.x up to 4.0.0 allows remote attackers to execute arbitrary web script or HTML via multiple models that contain a 'note' field to store additional information. | |||||
| CVE-2021-35265 | 1 Maxsite | 1 Maxsite Cms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability in MaxSite CMS before V106 via product/page/* allows remote attackers to inject arbitrary web script to a page. | |||||
| CVE-2021-35240 | 2 Microsoft, Solarwinds | 2 Internet Explorer, Orion Platform | 2026-06-17 | 3.5 LOW | 6.5 MEDIUM |
| A security researcher stored XSS via a Help Server setting. This affects customers using Internet Explorer, because they do not support 'rel=noopener'. | |||||
| CVE-2021-35239 | 1 Solarwinds | 1 Orion Platform | 2026-06-17 | 3.5 LOW | 7.5 HIGH |
| A security researcher found a user with Orion map manage rights could store XSS through via text box hyperlink. | |||||
| CVE-2021-35238 | 1 Solarwinds | 1 Orion Platform | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| User with Orion Platform Admin Rights could store XSS through URL POST parameter in CreateExternalWebsite website. | |||||
| CVE-2021-35229 | 1 Solarwinds | 2 Database Performance Analyzer, Database Performance Monitor | 2026-06-17 | 4.3 MEDIUM | 6.8 MEDIUM |
| Cross-site scripting vulnerability is present in Database Performance Monitor 2022.1.7779 and previous versions when using a complex SQL query | |||||
| CVE-2021-35228 | 1 Solarwinds | 1 Database Performance Analyzer | 2026-06-17 | 2.6 LOW | 5.5 MEDIUM |
| This vulnerability occurred due to missing input sanitization for one of the output fields that is extracted from headers on specific section of page causing a reflective cross site scripting attack. An attacker would need to perform a Man in the Middle attack in order to change header for a remote victim. | |||||
| CVE-2021-35227 | 1 Solarwinds | 1 Access Rights Manager | 2026-06-17 | 4.6 MEDIUM | 4.7 MEDIUM |
| The HTTP interface was enabled for RabbitMQ Plugin in ARM 2020.2.6 and the ability to configure HTTPS was not available. | |||||
| CVE-2021-35222 | 2 Microsoft, Solarwinds | 2 Windows, Orion Platform | 2026-06-17 | 4.3 MEDIUM | 8.0 HIGH |
| This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page. | |||||
| CVE-2021-35210 | 1 Contao | 1 Contao | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be executed in the browser when the system log is called in the back end. | |||||
| CVE-2021-35208 | 1 Zimbra | 1 Collaboration | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| An issue was discovered in ZmMailMsgView.js in the Calendar Invite component in Zimbra Collaboration Suite 8.8.x before 8.8.15 Patch 23. An attacker could place HTML containing executable JavaScript inside element attributes. This markup becomes unescaped, causing arbitrary markup to be injected into the document. | |||||
| CVE-2021-35207 | 1 Zimbra | 1 Collaboration | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered in Zimbra Collaboration Suite 8.8 before 8.8.15 Patch 23 and 9.0 before 9.0.0 Patch 16. An XSS vulnerability exists in the login component of Zimbra Web Client, in which an attacker can execute arbitrary JavaScript by adding executable JavaScript to the loginErrorCode parameter of the login url. | |||||
| CVE-2021-35204 | 1 Netscout | 1 Ngeniusone | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint. | |||||
| CVE-2021-35200 | 1 Netscout | 1 Ngeniusone | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService. | |||||
| CVE-2021-35199 | 1 Netscout | 1 Ngeniusone | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile. | |||||