Total
47436 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-29455 | 1 Smartystreets | 1 Liveaddressplugin.js | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-Site Scripting (XSS) vulnerability in this.showInvalid and this.showInvalidCountry in SmartyStreets liveAddressPlugin.js 3.2 allows remote attackers to inject arbitrary web script or HTML via any address parameter (e.g., street or country). | |||||
| CVE-2020-29444 | 1 Atlassian | 2 Confluence Data Center, Confluence Server | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Affected versions of Team Calendar in Confluence Server before 7.11.0 allow attackers to inject arbitrary HTML or Javascript via a Cross Site Scripting Vulnerability in admin global setting parameters. | |||||
| CVE-2020-29395 | 1 Myeventon | 1 Eventon | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The EventON plugin through 3.0.5 for WordPress allows addons/?q= XSS via the search field. | |||||
| CVE-2020-29364 | 1 Netartmedia | 1 News Lister | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| In NetArt News Lister 1.0.0, the news headlines vulnerable to stored xss attacks. Attackers can inject codes in news titles. | |||||
| CVE-2020-29315 | 1 Thinkadmin | 1 Thinkadmin | 2026-06-17 | 4.3 MEDIUM | 5.4 MEDIUM |
| ThinkAdmin version v1 v6 has a stored XSS vulnerability which allows remote attackers to inject an arbitrary web script or HTML. | |||||
| CVE-2020-29304 | 1 Directoriespro | 1 Directories Pro | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability exists in the SabaiApps WordPress Directories Pro plugin version 1.3.45 and previous, allows attackers who have convinced a site administrator to import a specially crafted CSV file to inject arbitrary web script or HTML as the victim is proceeding through the file import workflow. | |||||
| CVE-2020-29303 | 1 Directoriespro | 1 Directories Pro | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with _drts_form_build_id parameter containing the XSS payload and _t_ parameter set to an invalid or non-existent CSRF token. | |||||
| CVE-2020-29259 | 1 Online Examination System Project | 1 Online Examination System | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the subject or feedback parameter to feedback.php. | |||||
| CVE-2020-29258 | 1 Online Examination System Project | 1 Online Examination System | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the w parameter to index.php. | |||||
| CVE-2020-29257 | 1 Online Examination System Project | 1 Online Examination System | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Cross-site scripting (XSS) vulnerability in Online Examination System 1.0 via the q parameter to feedback.php. | |||||
| CVE-2020-29250 | 1 Cxuu | 1 Cxuucms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| CXUUCMS V3 allows XSS via the first and third input fields to /public/admin.php. | |||||
| CVE-2020-29249 | 1 Cxuu | 1 Cxuucms | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| CXUUCMS V3 allows class="layui-input" XSS. | |||||
| CVE-2020-29241 | 1 Online News Portal Project | 1 Online News Portal | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| Online News Portal using PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web script or HTML via the "Title" parameter. | |||||
| CVE-2020-29240 | 1 Lepton-cms | 1 Leptoncms | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| Lepton-CMS 4.7.0 is affected by cross-site scripting (XSS). An attacker can inject the XSS payload in the URL field of the admin page and each time an admin visits the Menu-Pages-Pages Overview section, the XSS will be triggered. | |||||
| CVE-2020-29239 | 1 Janobe | 1 Online Voting System | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Online Birth Certificate System Project V 1.0 is affected by cross-site scripting (XSS). This vulnerability can result in an attacker injecting the XSS payload in the User Registration section. When an admin visits the View Detail of Application section from the admin panel, the attacker can able to steal the cookie according to the crafted payload. | |||||
| CVE-2020-29233 | 1 Wondercms | 1 Wondercms | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| WonderCMS 3.1.3 is affected by cross-site scripting (XSS) in the Page description component. This vulnerability can allow an attacker to inject the XSS payload in the Page description and each time any user will visits the website, the XSS triggers and attacker can steal the cookie according to the crafted payload. | |||||
| CVE-2020-29215 | 1 Razormist | 1 Employee Management System | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| A Cross Site Scripting in SourceCodester Employee Management System 1.0 allows the user to execute alert messages via /Employee Management System/addemp.php on admin account. | |||||
| CVE-2020-29205 | 1 Projectworlds | 1 Travel Management System | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| XSS in signup form in Project Worlds Online Examination System 1.0 allows remote attacker to inject arbitrary code via the name field | |||||
| CVE-2020-29204 | 1 Xuxueli | 1 Xxl-job | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| XXL-JOB 2.2.0 allows Stored XSS (in Add User) to bypass the 20-character limit via xxl-job-admin/src/main/java/com/xxl/job/admin/controller/UserController.java. | |||||
| CVE-2020-29172 | 1 Litespeedtech | 1 Litespeed Cache | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A cross-site scripting (XSS) vulnerability in the LiteSpeed Cache plugin before 3.6.1 for WordPress can be exploited via the Server IP setting. | |||||