CWE-79

Multiple stored cross-site scripting (XSS) vulnerabilities in Sage EasyPay 10.7.5.10 allow authenticated attackers to inject arbitrary web script or HTML via multiple parameters through Unicode Transformations (Best-fit Mapping), as demonstrated by the full-width variants of the less-than sign (%EF%BC%9C) and greater-than sign (%EF%BC%9E).

HESK before 3.1.10 allows reflected XSS.

Extreme Management Center 8.4.1.24 allows unauthenticated reflected XSS via a parameter in a GET request.

An issue was discovered in HiveMQ Broker Control Center 4.3.2. A crafted clientid parameter in an MQTT packet (sent to the Broker) is reflected in the client section of the management console. The attacker’s JavaScript is loaded in a browser, which can lead to theft of the session and cookie of the administrator’s account of the Broker.

A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 allows remote attackers to inject arbitrary web script or HTML via the viewMode, tvMode, tvType, objID, catgID, objTypeID, or editMode parameter.

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php.