deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-56062
Published: 2024-12-31
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.3.987.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/royal-elementor-addons/vulnerability/wordpress-royal-elementor-addons-and-templates-plugin-1-3-987-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-56063
Published: 2024-12-31
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Stored XSS.This issue affects Essential Addons for Elementor: from n/a through <= 6.0.7.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-0-7-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-56803
Published: 2024-12-31
Description: Ghostty is a cross-platform terminal emulator. Ghostty, as allowed by default in 1.0.0, allows attackers to modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands. This attack requires an attacker to send malicious escape sequences followed by convincing the user to physically press the "enter" key. Fixed in Ghostty v1.0.1.
CWE: CWE-94
References: https://github.com/ghostty-org/ghostty/pull/3908; https://github.com/ghostty-org/ghostty/security/advisories/GHSA-5hcq-3j4q-4v6p
CVE: CVE-2024-21675
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21679
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21688
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21691
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21692
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21693
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21694
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21695
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21696
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21701
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21702
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21704
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21705
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21708
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21709
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21710
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21711
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21712
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21713
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21714
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21715
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21716
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21717
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21718
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21719
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21720
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-21721
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23389
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23390
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23391
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23392
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23393
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23394
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23395
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23396
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23397
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23398
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23399
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23400
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23401
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23402
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23403
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23404
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23405
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23406
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23407
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23408
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23409
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23410
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23411
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23412
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23413
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23414
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23415
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23416
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23417
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23418
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23419
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23420
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23421
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23422
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23423
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23424
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23425
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23426
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23427
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23428
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23429
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23430
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23431
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23432
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23433
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23434
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23435
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23436
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23437
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-23438
Published: 2025-01-01
Description: Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.
CVE: CVE-2024-56020
Published: 2025-01-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in svegliadesign SvegliaT Buttons svegliat-buttons allows Stored XSS.This issue affects SvegliaT Buttons: from n/a through <= 1.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/svegliat-buttons/vulnerability/wordpress-svegliat-buttons-plugin-1-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-56021
Published: 2025-01-01
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibnuyahya Category Post Shortcode category-post-shortcode allows Stored XSS.This issue affects Category Post Shortcode: from n/a through <= 2.4.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/category-post-shortcode/vulnerability/wordpress-category-post-shortcode-plugin-2-4-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE: CVE-2024-11846
Published: 2025-01-01
Description: The  does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/eedaf2d8-171c-4785-99cc-ab33113308d1/
CVE: CVE-2025-0168
Published: 2025-01-01
Description: A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /_parse/_feedback_system.php. The manipulation of the argument person leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/UnrealdDei/cve/blob/main/sql11.md; https://vuldb.com/?ctiid.289917
CVE: CVE-2024-56829
Published: 2025-01-02
Description: Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element in a SOAP request to /XSDService.asmx.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-434
References: https://github.com/Zerone0x00/CVE/blob/main/%E9%BB%84%E8%8D%AF%E5%B8%88%E8%8D%AF%E4%B8%9A%E7%AE%A1%E7%90%86%E8%BD%AF%E4%BB%B6/UploadFile%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md; https://github.com/Zerone0x00/CVE/blob/main/%E9%BB%84%E8%8D%AF%E5%B8%88%E8%8D%AF%E4%B8%9A%E7%AE%A1%E7%90%86%E8%BD%AF%E4%BB%B6/UploadFile%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md
CVE: CVE-2025-22214
Published: 2025-01-02
Description: Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-89
References: https://github.com/Zerone0x00/CVE/blob/main/%E8%93%9D%E5%87%8CEISsql%E6%B3%A8%E5%85%A5/1.md
CVE: CVE-2002-20002
Published: 2025-01-02
Description: The Net::EasyTCP package before 0.15 for Perl always uses Perl's builtin rand(), which is not a strong random number generator, for cryptographic keys.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-338
References: https://github.com/briandfoy/cpan-security-advisory/issues/184; https://metacpan.org/release/MNAGUIB/EasyTCP-0.15/view/EasyTCP.pm; https://metacpan.org/release/MNAGUIB/EasyTCP-0.26/changes
CVE: CVE-2024-56830
Published: 2025-01-02
Description: The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand() if no strong randomization module is present.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-338
References: https://github.com/briandfoy/cpan-security-advisory/issues/184; https://metacpan.org/release/MNAGUIB/EasyTCP-0.26/changes; https://lists.debian.org/debian-lts-announce/2025/04/msg00015.html
CVE: CVE-2024-11184
Published: 2025-01-02
Description: The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts
CVSS Score: 4.8 (MEDIUM)
References: https://wpscan.com/vulnerability/fc982bcb-9974-481f-aef4-580ae9edc3c8/; https://wpscan.com/vulnerability/fc982bcb-9974-481f-aef4-580ae9edc3c8/
CVE: CVE-2024-11357
Published: 2025-01-02
Description: The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7e8c6816-9b7a-43e8-9508-789c8051dd9b/; https://wpscan.com/vulnerability/7e8c6816-9b7a-43e8-9508-789c8051dd9b/
CVE: CVE-2024-12595
Published: 2025-01-02
Description: The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-79
References: https://wpscan.com/vulnerability/7a[PII_REDACTED]-477f-816d-b9b116ec8555/; https://wpscan.com/vulnerability/7a[PII_REDACTED]-477f-816d-b9b116ec8555/
CVE: CVE-2024-12912
Published: 2025-01-02
Description: An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution.
Refer to the '01/02/2025 ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-20, CWE-77
References: https://www.asus.com/content/asus-product-security-advisory/
CVE: CVE-2024-13092
Published: 2025-01-02
Description: A vulnerability classified as critical was found in code-projects Job Recruitment 1.0. This vulnerability affects unknown code of the file /_parse/_call_job/search_ajax.php of the component Job Post Handler. The manipulation of the argument n leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/UnrealdDei/cve/blob/main/sql9.md; https://vuldb.com/?ctiid.289900
CVE: CVE-2024-13093
Published: 2025-01-02
Description: A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /_parse/_call_main_search_ajax.php of the component Seeker Profile Handler. The manipulation of the argument s1 leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-74, CWE-89, CWE-89
References: https://code-projects.org/; https://github.com/UnrealdDei/cve/blob/main/sql10.md; https://vuldb.com/?ctiid.289901
CVE: CVE-2024-13062
Published: 2025-01-02
Description: An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary command execution.
Refer to the ' 01/02/2025 ASUS Router AiCloud vulnerability' section on the ASUS Security Advisory for more information.
CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-912
References: https://www.asus.com/content/asus-product-security-advisory/
CVE: CVE-2024-13102
Published: 2025-01-02
Description: A vulnerability classified as critical was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This vulnerability affects unknown code of the file /goform/DDNS of the component DDNS Service. The manipulation leads to improper access controls. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/DDNS.md; https://vuldb.com/?ctiid.289918; https://vuldb.com/?id.289918
CVE: CVE-2024-13103
Published: 2025-01-02
Description: A vulnerability, which was classified as critical, has been found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210. This issue affects some unknown processing of the file /goform/form2AddVrtsrv.cgi of the component Virtual Service Handler. The manipulation leads to improper access controls. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-266, CWE-284
References: https://github.com/abcdefg-png/IoT-vulnerable/blob/main/Unauthorized_Vulnerability/D-Link/DIR-816/form2AddVrtsrv.md; https://vuldb.com/?ctiid.289919; https://vuldb.com/?id.289919
CVE: CVE-2024-56019
Published: 2025-01-02
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavinr Inline Footnotes inline-footnotes allows Stored XSS.This issue affects Inline Footnotes: from n/a through <= 2.3.0.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-79
References: https://patchstack.com/database/Wordpress/Plugin/inline-footnotes/vulnerability/wordpress-inline-footnotes-plugin-2-3-0-cross-site-scripting-xss-vulnerability?_s_id=cve