Total
47364 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2019-17229 | 1 Stylemixthemes | 1 Motors - Car Dealer\, Classifieds \& Listing | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car Dealer & Classified Ads) plugin through 1.4.0 for WordPress has multiple stored XSS issues. | |||||
| CVE-2019-17226 | 1 Cmsmadesimple | 1 Cms Made Simple | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| CMS Made Simple (CMSMS) 2.2.11 allows XSS via the Site Admin > Module Manager > Search Term field. | |||||
| CVE-2019-17225 | 1 Intelliants | 1 Subrion | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Subrion 4.2.1 allows XSS via the panel/members/ Username, Full Name, or Email field, aka an "Admin Member JSON Update" issue. | |||||
| CVE-2019-17223 | 1 Dolibarr | 1 Dolibarr Erp\/crm | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| There is HTML Injection in the Note field in Dolibarr ERP/CRM 10.0.2 via user/note.php. | |||||
| CVE-2019-17222 | 1 Intelbras | 2 Wrn 150, Wrn 150 Firmware | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is stored XSS in the Service Name tab of the WAN configuration screen, leading to a denial of service (inability to change the configuration). | |||||
| CVE-2019-17220 | 1 Rocket.chat | 1 Rocket.chat | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line. | |||||
| CVE-2019-17214 | 1 Webarxsecurity | 1 Webarx | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| The WebARX plugin 1.3.0 for WordPress allows firewall bypass by appending &cc=1 to a URI. | |||||
| CVE-2019-17213 | 1 Webarxsecurity | 1 Webarx | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The WebARX plugin 1.3.0 for WordPress has unauthenticated stored XSS via the URI or the X-Forwarded-For HTTP header. | |||||
| CVE-2019-17207 | 1 Managewp | 1 Broken Link Checker | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker (aka Broken Link Checker) plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the wp-admin/tools.php?page=view-broken-links s_filter parameter in a search action. | |||||
| CVE-2019-17205 | 1 Teampass | 1 Teampass | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| TeamPass 2.1.27.36 allows Stored XSS by placing a payload in the username field during a login attempt. When an administrator looks at the log of failed logins, the XSS payload will be executed. | |||||
| CVE-2019-17204 | 1 Teampass | 1 Teampass | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| TeamPass 2.1.27.36 allows Stored XSS by setting a crafted Knowledge Base label and adding any available item. | |||||
| CVE-2019-17203 | 1 Teampass | 1 Teampass | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| TeamPass 2.1.27.36 allows Stored XSS at the Search page by setting a crafted password for an item in any folder. | |||||
| CVE-2019-17189 | 1 Totemo | 1 Totemodata | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| totemodata 3.0.0_b936 has XSS via a folder name. | |||||
| CVE-2019-17179 | 1 Open-emr | 1 Openemr | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| 4.1.0, 4.1.1, 4.1.2, 4.1.2.3, 4.1.2.6, 4.1.2.7, 4.2.0, 4.2.1, 4.2.2, 5.0.0, 5.0.0.5, 5.0.0.6, 5.0.1, 5.0.1.1, 5.0.1.2, 5.0.1.3, 5.0.1.4, 5.0.1.5, 5.0.1.6, 5.0.1.7, 5.0.2, fixed in version 5.0.2.1 | |||||
| CVE-2019-17176 | 1 Genesys | 1 Eservices Chat | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| Genesys PureEngage Digital (eServices) 8.1.x allows XSS via HtmlChatPanel.jsp or HtmlChatFrameSet.jsp (ActionColor, ClientNickNameColor, Email, email, or email_address parameter). | |||||
| CVE-2019-17127 | 1 Solarwinds | 1 Orion Platform | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Stored Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many application forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. This can lead to privilege escalation. | |||||
| CVE-2019-17125 | 1 Solarwinds | 1 Orion Platform | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A Reflected Client Side Template Injection (CSTI) with Angular was discovered in the SolarWinds Orion Platform 2019.2 HF1 in many forms. An attacker can inject an Angular expression and escape the Angular sandbox to achieve stored XSS. | |||||
| CVE-2019-17121 | 1 Vanderbilt | 1 Redcap | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| REDCap before 9.3.4 has XSS on the Customize & Manage Locking/E-signatures page via Lock Record Custom Text values. | |||||
| CVE-2019-17120 | 1 Wikidsystems | 1 2fa Enterprise Server | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/adm_usrs.jsp. The usr parameter is vulnerable: the reflected cross-site scripting occurs immediately after the user is created. The malicious script is stored and will be executed whenever /WiKIDAdmin/adm_usrs.jsp is visited. | |||||
| CVE-2019-17116 | 1 Wikidsystems | 1 Two Factor Authentication Enterprise Server | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| A stored and reflected cross-site scripting (XSS) vulnerability in WiKID 2FA Enterprise Server through 4.2.0-b2047 allow remote attackers to inject arbitrary web script or HTML via /WiKIDAdmin/groups.jsp. The groupName parameter is vulnerable: the reflected cross-site scripting occurs immediately after the group is created. The malicious script is stored and will be executed again whenever /WiKIDAdmin/groups.jsp is visited. | |||||