Total
42276 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-37111 | 3 60cyclecms Project, Davidvg, Opensourcecms | 3 60cyclecms, 60cyclecms, 60cyclecms | 2026-03-05 | 6.1 Medium |
| 60CycleCMS 2.5.2 contains a cross-site scripting (XSS) vulnerability in news.php that allows attackers to inject malicious scripts through GET parameters. Attackers can craft malicious URLs with XSS payloads targeting the 'etsu' and 'ltsu' parameters to execute arbitrary scripts in victim's browsers. This issue does not involve SQL injection. | ||||
| CVE-2020-37103 | 1 Dnnsoftware | 1 Dotnetnuke | 2026-03-05 | 6.4 Medium |
| DotNetNuke 9.5 contains a persistent cross-site scripting vulnerability that allows normal users to upload malicious XML files with executable scripts through journal tools. Attackers can upload XML files with XHTML namespace scripts to execute arbitrary JavaScript in users' browsers, potentially bypassing CSRF protections and performing more damaging attacks. | ||||
| CVE-2020-37044 | 2 Citeum, Opencti-platform | 2 Opencti, Opencti | 2026-03-05 | 5.4 Medium |
| OpenCTI 3.3.1 is vulnerable to a reflected cross-site scripting (XSS) attack via the /graphql endpoint. An attacker can inject arbitrary JavaScript code by sending a crafted GET request with a malicious payload in the query string, leading to execution of JavaScript in the victim's browser. For example, a request to /graphql?'"--></style></scRipt><scRipt>alert('Raif_Berkay')</scRipt> will trigger an alert. This vulnerability was discovered by Raif Berkay Dincel and confirmed on Linux Mint and Windows 10. | ||||
| CVE-2020-37022 | 2 Openz, Sap | 2 Erp, Erp | 2026-03-05 | 6.4 Medium |
| OpenZ ERP 3.6.60 contains a persistent cross-site scripting vulnerability in the Employee module's name and description parameters. Attackers can inject malicious scripts through POST requests to , enabling session hijacking and manipulation of application modules. | ||||
| CVE-2020-37019 | 1 Orchardcore | 2 Orchard Core, Orchardcore | 2026-03-05 | 6.4 Medium |
| Orchard Core RC1 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious scripts through blog post creation. Attackers can create blog posts with embedded JavaScript in the MarkdownBodyPart.Source parameter to execute arbitrary scripts in victim browsers. | ||||
| CVE-2020-37018 | 1 Goautodial | 2 Goautodial, Goautodial Api | 2026-03-05 | 6.4 Medium |
| GOautodial 4.0 contains a persistent cross-site scripting vulnerability that allows authenticated agents to inject malicious scripts through message subjects. Attackers can craft messages with embedded JavaScript that will execute when an administrator reads the message, potentially stealing session cookies or executing client-side attacks. | ||||
| CVE-2020-37014 | 1 Tryton | 2 Tryton, Trytond | 2026-03-05 | 6.4 Medium |
| Tryton 5.4 contains a persistent cross-site scripting vulnerability in the user profile name input that allows remote attackers to inject malicious scripts. Attackers can exploit the vulnerability by inserting script payloads in the name field, which execute in the frontend and backend user interfaces. | ||||
| CVE-2020-37003 | 2 Sellacious, Totalshopuk | 2 Ecommerce, Ecommerce | 2026-03-05 | 6.4 Medium |
| Sellacious eCommerce 4.6 contains a persistent cross-site scripting vulnerability in the Manage Your Addresses module that allows attackers to inject malicious scripts. Attackers can exploit multiple address input fields like full name, company, and address to execute persistent script code that can hijack user sessions and manipulate application modules. | ||||
| CVE-2020-36996 | 1 Php-fusion | 1 Phpfusion | 2026-03-05 | 6.4 Medium |
| PHPFusion 9.03.50 contains a persistent cross-site scripting vulnerability in the print.php page that fails to properly sanitize user-submitted message content. Attackers can inject malicious JavaScript through forum messages that will execute when the print page is generated, allowing script execution in victim browsers. | ||||
| CVE-2020-36993 | 1 Limesurvey | 1 Limesurvey | 2026-03-05 | 5.4 Medium |
| LimeSurvey 4.3.10 contains a stored cross-site scripting vulnerability in the Survey Menu functionality of the administration panel. Attackers can inject malicious SVG scripts through the Surveymenu[title] and Surveymenu[parent_id] parameters to execute arbitrary JavaScript in administrative contexts. | ||||
| CVE-2020-36978 | 1 Froxlor | 1 Froxlor | 2026-03-05 | 6.4 Medium |
| Froxlor Server Management Panel 0.10.16 contains a persistent cross-site scripting vulnerability in customer registration input fields. Attackers can inject malicious scripts through username, name, and firstname parameters to execute code when administrators view customer traffic modules. | ||||
| CVE-2020-36966 | 1 Dolibarr | 2 Dolibarr, Dolibarr Erp\/crm | 2026-03-05 | 6.4 Medium |
| Dolibarr 11.0.3 contains a persistent cross-site scripting vulnerability in LDAP synchronization settings that allows attackers to inject malicious scripts through multiple parameters. Attackers can exploit the host, slave, and port parameters in /dolibarr/admin/ldap.php to execute arbitrary JavaScript and potentially steal user cookie information. | ||||
| CVE-2020-36960 | 1 Formalms | 1 Formalms | 2026-03-05 | 6.4 Medium |
| Forma LMS 2.3 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into user profile first and last name fields. Attackers can craft scripts like '<script>alert(document.cookie)</script>' to execute arbitrary JavaScript when the profile is viewed by other users. | ||||
| CVE-2020-36956 | 1 Igniterealtime | 1 Openfire | 2026-03-05 | 6.4 Medium |
| Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter. Attackers can craft a payload with script tags to execute arbitrary JavaScript in the context of administrative users viewing the nodejs configuration page. | ||||
| CVE-2020-36955 | 1 Getgrav | 4 Grav, Grav-plugin-admin, Grav Admin and 1 more | 2026-03-05 | 6.4 Medium |
| Grav CMS 1.6.30 with Admin Plugin 1.9.18 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the page title field. Attackers can create a new page with a malicious script in the title, which will be executed when the page is viewed in the admin panel or on the site. | ||||
| CVE-2020-36932 | 1 Seacms | 1 Seacms | 2026-03-05 | 6.1 Medium |
| SeaCMS 11.1 contains a stored cross-site scripting vulnerability in the checkuser parameter of the admin settings page. Attackers can inject malicious JavaScript payloads that will execute in users' browsers when the page is loaded. | ||||
| CVE-2020-36919 | 1 Wpforms | 1 Wpforms | 2026-03-05 | 6.1 Medium |
| WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter. Attackers can inject malicious scripts through the ListTable.php endpoint to execute arbitrary JavaScript in victim's browser. | ||||
| CVE-2019-25449 | 1 Orientdb | 1 Orientdb | 2026-03-05 | 6.1 Medium |
| OrientDB 3.0.17 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted JSON payloads to the document endpoint. Attackers can send POST requests to /document/demodb/-1:-1 with script tags in the name parameter to execute arbitrary JavaScript in users' browsers. | ||||
| CVE-2019-25448 | 1 Orientdb | 1 Orientdb | 2026-03-05 | 6.4 Medium |
| OrientDB 3.0.17 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating users with script payloads in the name parameter. Attackers can send POST requests to the document endpoint with JavaScript code in the name field to execute arbitrary scripts when users view the application. | ||||
| CVE-2019-25400 | 1 Ipfire | 1 Ipfire | 2026-03-05 | 5.4 Medium |
| IPFire 2.21 Core Update 127 contains multiple reflected cross-site scripting vulnerabilities in the fwhosts.cgi script that allow attackers to inject malicious scripts through multiple parameters including HOSTNAME, IP, SUBNET, NETREMARK, HOSTREMARK, newhost, grp_name, remark, SRV_NAME, SRV_PORT, SRVGRP_NAME, SRVGRP_REMARK, and updatesrvgrp. Attackers can submit POST requests with script payloads in these parameters to execute arbitrary JavaScript in the context of authenticated users' browsers. | ||||