TYPE DE FAIBLESSE

CWE-87

37 CVE, des plus récentes aux plus anciennes. Définition MITRE de CWE-87 (en anglais) →

CVE-2026-85293La version 1.7.2-beta-1 d'InvoicePlane est affectée par une faille de cross-site scripting (XSS) stockée dans le champ d'e-mail du client. Un administrateur peut injecter du JavaSc… 4.8 MOYENNE

CVE-2026-55661Les utilisateurs de Tina CMS utilisant des versions affectées du package principal ou du plugin MDX sont vulnérables au cross-site scripting (XSS) stocké. Un attaquant disposant d'… 4.8 MOYENNE

CVE-2026-25688Les versions d'Apache Answer jusqu'à la 2.0.0 sont affectées par une faille de cross-site scripting (XSS) où le contenu généré par IA n'est pas correctement nettoyé avant d'être af… 6.1 MOYENNE

CVE-2026-42458Les versions Magento Long Term Support (LTS) antérieures à la version 20.18.0 sont affectées par une faille de cross-site scripting (XSS) réfléchie dans la section Dataflow Profile… 5.3 MOYENNE

CVE-2025-14732Les sites WordPress utilisant la version 3.35.5 ou antérieure de l'extension Elementor sont vulnérables aux failles de cross-site scripting (XSS) stockées. Un attaquant disposant d… 6.4 MOYENNE

CVE-2026-22711Les installations MediaWiki utilisant l'extension Wikilove sont affectées par une faille de cross-site scripting (XSS). Un attaquant distant non authentifié peut injecter des scrip… 6.9 MOYENNE

CVE-2025-52563Les systèmes de gestion de l'apprentissage Chamilo antérieurs à la version 1.11.30 sont vulnérables à une attaque de type cross-site scripting (XSS) réfléchi via un point de termin… 5.1 MOYENNE

CVE-2026-27120Les applications utilisant le moteur de templating Leafkit avant la version 1.4.1 sont vulnérables au cross-site scripting (XSS) car certains caractères spéciaux peuvent contourner… 6.1 MOYENNE

CVE-2025-48076Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue … 5.3 MOYENNE

CVE-2025-62418Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload… 6.9 MOYENNE

CVE-2025-62415Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload… 6.9 MOYENNE

CVE-2025-62414Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature (in the admin panel) is vulnerable to Cross-Site Scripting (XSS). An atta… 6.9 MOYENNE

CVE-2025-8561The Ova Advent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.1.7 due to insufficient input s… 6.4 MOYENNE

CVE-2025-48992Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a stored and blind cross-site scripting (XSS) vulnerabilit… 5.2 MOYENNE

CVE-2025-48495Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, an authenticated user could inject JS int… 4.8 MOYENNE

CVE-2025-48494Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting vulnerability can be e… 4.8 MOYENNE

CVE-2025-48366Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone N… 6.9 MOYENNE

CVE-2025-27793Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. In Vega prior to version 5.32.0, corresponding to vega-fu… 5.3 MOYENNE

CVE-2024-8505The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘button_label’ parameter in all versions up to, and includi… 6.4 MOYENNE

CVE-2024-43381reNgine is an automated reconnaissance framework for web applications. Versions 2.1.2 and prior are susceptible to Stored Cross-Site Scripting (XSS) attacks. This vulnerability occ… 5.0 MOYENNE

CVE-2024-4459The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget's titles in all versions up to, and including, 2.1.2 d… 6.4 MOYENNE

CVE-2024-2657The Font Farsi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.6 due to insufficient input sanitizati… 4.4 MOYENNE

CVE-2024-2618The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the size attribute in all versions up to, and including, 1.6.26 due to i… 6.4 MOYENNE

CVE-2024-3666The Opal Estate Pro – Property Management and Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the agent latitude and longitude parameters in all ve… 6.4 MOYENNE

CVE-2024-3519The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficie… 6.1 MOYENNE

CVE-2024-2750The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of the Button widget in all versions up to, and including… 6.4 MOYENNE

CVE-2024-3162The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Testimonial Widget Attributes in all versions up to, and including, 2.6.3 due to ins… 6.4 MOYENNE

CVE-2024-25640Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identi… 4.6 MOYENNE

CVE-2023-6446The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient inp… 4.4 MOYENNE

CVE-2023-50712Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been … 4.6 MOYENNE

CVE-2023-20208A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management… 4.8 MOYENNE

CVE-2023-20188A vulnerability in the web-based management interface of Cisco Small Business 200 Series Smart Switches, Cisco Small Business 300 Series Managed Switches, and Cisco Small Business … 4.8 MOYENNE

CVE-2022-20963A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) … 5.4 MOYENNE

CVE-2022-39295Knowage is an open source suite for modern business analytics alternative over big data systems. KnowageLabs / Knowage-Server starting with the 6.x branch and prior to versions 7.4… 6.1 MOYENNE

CVE-2022-36033jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL expr… 6.1 MOYENNE

CVE-2021-40131A vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC) could allow an authenticated, remote attacker to conduct a cross-site scrip… 5.5 MOYENNE

CVE-2020-5298In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, a user with the ability to use the import functionality of the `ImportExportController` b… 4.0 MOYENNE