CWE-79

An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site and create hundreds of thousands of posts with custom content.

Cross-site scripting (XSS) vulnerability on Brother HL series printers allows remote attackers to inject arbitrary web script or HTML via the url parameter to etc/loginerror.html.

Stored cross-site scripting (XSS) vulnerability in the “Website’s name” field found in the “Settings” page under the “General” menu in Creatiwity wityCMS 0.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted website name by doing an authenticated POST HTTP request to admin/settings/general.

Yosoro 1.0.4 has stored XSS.

An issue was discovered in the ChangUonDyU Advanced Statistics plugin 1.0.2 for MyBB. changstats.php has XSS, as demonstrated by a subject field.

An issue was discovered in WUZHI CMS 4.1.0 There is a Stored XSS Vulnerability in “Account Settings -> Member Centre -> Chinese information -> Ordinary member” via a QQ number, as demonstrated by a form[qq_10]= substring.