CWE-79

CMS Made Simple 2.2.10 has a Self-XSS vulnerability via the Layout Design Manager “Name” field, which is reachable via a “Create a new Template” action to the Design Manager.

CMS Made Simple 2.2.10 has XSS via the ‘moduleinterface.php’ Name field, which is reachable via an “Add Category” action to the “Site Admin Settings – News module” section.

CMS Made Simple 2.2.10 has XSS via the myaccount.php “Email Address” field, which is reachable via the “My Preferences -> My Account” section.

An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request “resolve conflicts” page.

Snipe-IT before 4.6.14 has XSS, as demonstrated by log_meta values and the user’s last name in the API.

Frog CMS 1.1 is affected by: Cross Site Scripting (XSS). The impact is: Cookie stealing, Alert pop-up on page, Redirecting to another phishing site, Executing browser exploits. The component is: Snippets.