CWE-79

{
  "affected": [],
  "aliases": [
    "CVE-2008-1566"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-03-31T22:44:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site scripting (XSS) vulnerability in Search.do in ManageEngine Applications Manager 8.x allows remote attackers to inject arbitrary web script or HTML via the query parameter.  NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.",
  "id": "GHSA-r9w7-3xm2-f9rp",
  "modified": "2022-05-01T23:41:16Z",
  "published": "2022-05-01T23:41:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1566"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41505"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/29564"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/28488"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-0667"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-07T08:15:15Z",
    "severity": "HIGH"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in BOINC Server allows Stored XSS.This issue affects BOINC Server: through 1.4.7.",
  "id": "GHSA-r9w7-5f7h-f659",
  "modified": "2025-07-08T18:30:44Z",
  "published": "2025-05-07T09:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0667"
    },
    {
      "type": "WEB",
      "url": "https://www.compass-security.com/fileadmin/Research/Advisories/2025_02_CSNC-2025-003_BOINC_stored_XSS.txt"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2020-23644"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-01-11T14:15:00Z",
    "severity": "MODERATE"
  },
  "details": "XSS exists in JIZHICMS 1.7.1 via index.php/Error/index?msg={XSS] to Home/c/ErrorController.php.",
  "id": "GHSA-r9wc-j38m-fr2f",
  "modified": "2022-05-24T17:38:30Z",
  "published": "2022-05-24T17:38:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-23644"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cherry-toto/jizhicms/issues/28"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-21726"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-02-29T01:44:03Z",
    "severity": "MODERATE"
  },
  "details": "Inadequate content filtering leads to XSS vulnerabilities in various components.",
  "id": "GHSA-r9wf-7v4g-f656",
  "modified": "2024-12-13T12:31:46Z",
  "published": "2024-02-29T03:33:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21726"
    },
    {
      "type": "WEB",
      "url": "https://developer.joomla.org/security-centre/929-20240205-core-inadequate-content-filtering-within-the-filter-code.html"
    },
    {
      "type": "WEB",
      "url": "https://www.sonarsource.com/blog/joomla-multiple-xss-vulnerabilities"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-38559"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-26T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "DigitalDruid HotelDruid 3.0.2 has an XSS vulnerability in prenota.php affecting the fineperiodo1 parameter.",
  "id": "GHSA-r9wg-mj78-x3hm",
  "modified": "2022-05-24T19:12:18Z",
  "published": "2022-05-24T19:12:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38559"
    },
    {
      "type": "WEB",
      "url": "https://vitthals.github.io/writeups/CVEs/Hoteldruid%203.0.2%20XSS"
    },
    {
      "type": "WEB",
      "url": "https://www.hoteldruid.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-5289"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-06-21T11:15:35Z",
    "severity": "MODERATE"
  },
  "details": "The 3D FlipBook \u2013 PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u2018style\u2019 and \u0027mode\u0027 parameters in all versions up to, and including, 1.16.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Note: This issue affects only block-based themes.",
  "id": "GHSA-r9wm-6jrg-58c5",
  "modified": "2025-07-09T21:31:05Z",
  "published": "2025-06-21T12:30:30Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5289"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/interactive-3d-flipbook-powered-physics-engine/trunk/inc/shortcode.php#L130"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/interactive-3d-flipbook-powered-physics-engine/trunk/inc/shortcode.php#L134"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3315198"
    },
    {
      "type": "WEB",
      "url": "https://wordpress.org/plugins/interactive-3d-flipbook-powered-physics-engine/#developers"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/72b76475-5215-47fd-badf-e2c542b25d4b?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-54252"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-09T17:15:59Z",
    "severity": "MODERATE"
  },
  "details": "Adobe Experience Manager versions 6.5.23.0 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. This could result in bypassing security features within the application. Exploitation of this issue requires user interaction in that a victim must browse to the page containing the vulnerable field.",
  "id": "GHSA-r9x3-pfq4-mcfq",
  "modified": "2025-09-09T18:31:21Z",
  "published": "2025-09-09T18:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54252"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-90.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-31748"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-04-01T15:16:11Z",
    "severity": "MODERATE"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability in wpopal Opal Portfolio allows Stored XSS. This issue affects Opal Portfolio: from n/a through 1.0.4.",
  "id": "GHSA-r9x5-x5m3-2xrf",
  "modified": "2026-04-01T18:34:19Z",
  "published": "2025-04-01T15:31:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-31748"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/opal-portfolios/vulnerability/wordpress-opal-portfolio-plugin-1-0-4-stored-cross-site-scripting-xss-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "privatebin/privatebin"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.7.7"
            },
            {
              "fixed": "2.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-64711"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-14T20:33:52Z",
    "nvd_published_at": "2025-11-13T03:16:29Z",
    "severity": "LOW"
  },
  "details": "## Summary\n\nDragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any user who drops a crafted file on PrivateBin will execute arbitrary JavaScript within their own session (self-XSS). This allows an attacker who can entice a victim to drag or otherwise attach such a file to exfiltrate plaintext, encryption keys, or stored pastes before they are encrypted or sent.\n\n**Note 1:** as the malicious filename must contain the `\u003e` character, the victim must not be using Windows for this to work, since this OS simply forbids this character in filenames.\n\n**Note 2:** most PrivateBin instances use the Content-Security-Policy header to prevent most use-cases of this vulnerability. This report will describe the impact as if this header had been disabled by the PrivateBin instance owner.\n\n## Affected versions\n\nPrivateBin versions since 1.7.7 and before 2.0.3.\n\n## Conditions\n\n* Only macIOS or Linux users are affected, due to the way the `\u003e` character is treated in a file name on Windows.\n* The PrivateBIn instance needs to have file upload enabled.\n* An attacker needs to have access to the local file system or somehow convince the user to create (or download) a malicious file (name).\n* An attacker needs to convince the user to attach that malicious file to PrivateBin.\n\n## Impact\n\nAny Mac / Linux user who can be tricked into dragging a maliciously named file into the editor is impacted; code runs in the origin of the PrivateBin instance they are using. Attackers can steal plaintext, passphrases, or manipulate the UI before data is encrypted, defeating the zero-knowledge guarantees for that victim session, assuming counter-measures like Content-Security-Policy (CSP) have been disabled.\n\nIf CSP is not disabled, similar HTML injection attacks as described in CVE-2025-62796 may be possible - like redirecting to a foreign website, phishing etc.\n\n### Real-life impact\n\nAs the whole exploit needs to be included in the file name of the attached file and only affects the local session of the user (aka it is neither persistent nor remotely executable) _and_ that user needs to interact and actively attach that file to the paste, the impact is considered to be practically low.\n\n## Technical Description\n\nWhen a file is dropped, `readFileData` collects all filenames and calls `printDragAndDropFileNames`:\n\n```js\nconst fileNames = loadedFiles.map((loadedFile =\u003e loadedFile.name));\nprintDragAndDropFileNames(fileNames);\n```\n\n`printDragAndDropFileNames` then renders those names:\n\n```js\n        function printDragAndDropFileNames(fileNames) {\n            $dragAndDropFileNames.html(fileNames.join(\u0027\u003cbr\u003e\u0027));\n        }\n```\n\nThis will insecurely render the user-submitted filenames as HTML.\n\nThis vulnerability has been introduced in [this commit](https://github.com/PrivateBin/PrivateBin/commit/095a5be0b6390a6e47b97d3668a23f6edec95c15) (introduced in 1.7.7).\n\nThe previous render method was using `.text()`:\n\n```js\n$dragAndDropFileName.text(loadedFile.name);\n```\n\n## Reproduction Steps\n\n1. On a Unix-like system, create a file with an HTML/JS payload in its name, e.g. by running `touch \u0027\"\u003e\u003cimg src=x onerror=alert(document.domain)\u003e.txt\u0027`.\n2. Deploy or use any PrivateBin instance with attachments enabled (including https://privatebin.net/).\n3. Open the UI in a browser and start a new paste.\n4. Drag the crafted file anywhere on the page\n5. As soon as it is dropped, the filename is inserted into `#dragAndDropFileName` as HTML and the onerror handler fires (assuming CSP is disabled), showing the alert.\n\n## Mitigation\n\nPrivateBin strongly recommends users to **upgrade to the latest release**. However, here are some workarounds that may help users to mitigate this vulnerability without upgrade:\n\n* Update the [CSP in your configuration file](https://github.com/PrivateBin/PrivateBin/wiki/Configuration#cspheader) to the latest recommended settings and check that it isn\u0027t getting reverted or overwritten by the web server, reverse proxy or CDN, i.e. using [PrivateBin\u0027s offered check service](https://privatebin.info/directory/check).\n   **Note:** Users should check the CSP independently, even if they\u0027ve upgrade to a fixed version.\n* Deploying PrivateBin on a separate domain may limit the scope of the vulnerability to PrivateBin itself and thus, as described in the \u201cImpact\u201d section, effectively prevent any damage by the vulnerability to other resources users are hosting.\n* As explained in the impact assessment, disabling attachments also prevents this issue.\n\n### Patches\n\nThe issue has been patched in version 2.0.3.\n\n## Credits\n\nPrivateBin would like to thank [Benoit Esnard](https://github.com/esnard), who reported this vulnerability.\n\nIn general, PrivateBin would like to thank everyone reporting issues and potential vulnerabilities.\n\nIf a user thinks they have found a vulnerability or potential security risk, [PrivateBin would kindly ask you to follow our security policy](https://github.com/PrivateBin/PrivateBin/blob/master/SECURITY.md) and report it. PrivateBin will then assess the report and will take the necessary actions to address it.\n\n## Timeline\n\n- 2025-11-09 Received report via GitHub Security Advisory\n- 2025-11-10 Discussed and reproduced issue, created a patch\n- 2025-11-11 Further work on patch\n- 2025-11-12 Released patch with PrivateBin 2.0.3",
  "id": "GHSA-r9x7-7ggj-fx9f",
  "modified": "2025-11-27T08:46:22Z",
  "published": "2025-11-14T20:33:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/PrivateBin/PrivateBin/security/advisories/GHSA-r9x7-7ggj-fx9f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64711"
    },
    {
      "type": "WEB",
      "url": "https://github.com/PrivateBin/PrivateBin/commit/f9550e513381208b36595ee2404e968144bba78b"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/PrivateBin/PrivateBin"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users"
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-40181"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79",
      "CWE-84"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-10-11T11:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in Desigo PXM30-1 (All versions \u003c V02.20.126.11-41), Desigo PXM30.E (All versions \u003c V02.20.126.11-41), Desigo PXM40-1 (All versions \u003c V02.20.126.11-41), Desigo PXM40.E (All versions \u003c V02.20.126.11-41), Desigo PXM50-1 (All versions \u003c V02.20.126.11-41), Desigo PXM50.E (All versions \u003c V02.20.126.11-41), PXG3.W100-1 (All versions \u003c V02.20.126.11-37), PXG3.W100-2 (All versions \u003c V02.20.126.11-41), PXG3.W200-1 (All versions \u003c V02.20.126.11-37), PXG3.W200-2 (All versions \u003c V02.20.126.11-41). The device embedded browser does not prevent interaction with alternative URI schemes when redirected to corresponding resources by web application code. By setting the homepage URI, the favorite URIs, or redirecting embedded browser users via JavaScript code to alternative scheme resources, a remote low privileged attacker can perform a range of attacks against the device, such as read arbitrary files on the filesystem, execute arbitrary JavaScript code in order to steal or manipulate the information on the screen, or trigger denial of service conditions.",
  "id": "GHSA-r9x8-x33r-r8q2",
  "modified": "2022-10-12T19:00:38Z",
  "published": "2022-10-11T12:00:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40181"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-360783.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}