CVE Vulnerability

CWE-79

CVE-2020-24145

by

Cross Site Scripting (XSS) vulnerability in the CM Download Manager (aka cm-download-manager) plugin 2.7.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via a crafted deletescreenshot action.

CVE-2020-23957

by

Pega Platform through 8.4.x is affected by Cross Site Scripting (XSS) via the ConnectionID parameter, as demonstrated by a pyActivity=Data-TRACERSettings.pzStartTracerSession request to a PRAuth URI.

CVE-2020-23962

by

A cross site scripting (XSS) vulnerability in Catfish CMS 4.9.90 allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the “announcement_gonggao” parameter.

CVE-2020-23974

by

Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Message(title-tag), Add new client (all-tags).

CVE-2020-23975

by

Webexcels Ecommerce CMS 2.x, 2017, 2018, 2019, 2020 has cross site scripting via the ‘search.php’ id parameter.

CVE-2020-23977

by

KandNconcepts Club CMS 1.1 and 1.2 has cross site scripting via the ‘team.php,player.php,club.php’ id parameter.