Deskpro cloud and on-premise Deskpro 2021.1.6 and fixed in Deskpro 2021.1.7 contains a cross-site scripting (XSS) vulnerability in social media links on a user profile due to lack of input validation.
CWE-79
CVE-2021-36698
Pandora FMS through 755 allows XSS via a new Event Filter with a crafted name.
CVE-2021-36702
The “content” field in the “regular post” page of the “add content” menu under “dashboard” in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through special content.
CVE-2021-36703
The “blog title” field in the “Settings” menu “config” page of “dashboard” in htmly 2.8.1 has a storage cross site scripting (XSS) vulnerability. It allows remote attackers to send an authenticated post HTTP request to admin/config and inject arbitrary web script or HTML through a special website name.
CVE-2021-36450
Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.
CVE-2021-36454
Cross Site Scripting (XSS) vulnerability in Naviwebs Navigate Cms 2.9 via the navigate-quickse parameter to 1) backupsbackups.php, 2) blocksblocks.php, 3) brandsbrands.php, 4) commentscomments.php, 5) couponscoupons.php, 6) feedsfeeds.php, 7) functionsfunctions.php, 8) itemsitems.php, 9) menusmenus.php, 10) ordersorders.php, 11) payment_methodspayment_methods.php, 12) productsproducts.php, 13) profilesprofiles.php, 14) shipping_methodsshipping_methods.php, 15) templatestemplates.php, 16) usersusers.php, 17) webdictionarywebdictionary.php, 18) websiteswebsites.php, and 19) webuserswebusers.php because the initial_url function is built in these files.