CWE-79

CVE-2020-35761

February 26, 2023 by

bloofoxCMS 0.5.2.1 is infected with XSS that allows remote attackers to execute arbitrary JS/HTML Code.

February 26, 2023 by

Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Lead screen.

February 26, 2023 by

Daybyday 2.1.0 allows stored XSS via the Name parameter to the New User screen.

February 26, 2023 by

Daybyday 2.1.0 allows stored XSS via the Title parameter to the New Project screen.

February 26, 2023 by

Daybyday 2.1.0 allows stored XSS via the Company Name parameter to the New Client screen.

February 26, 2023 by

zonote through 0.4.0 allows XSS via a crafted note, with resultant Remote Code Execution (because nodeIntegration in webPreferences is true).