CVE-2015-2796

Multiple cross-site scripting (XSS) vulnerabilities in Project-Pier ProjectPier-Core allow remote attackers to inject arbitrary web script or HTML via the search_for parameter to (1) search_by_tag.php, (2) search_contacts.php, or (3) search.php.

• CWE-79

• https://github.com/Project-Pier/ProjectPier-Core/commit/74ecbd4e939a65ba643a4af05fbdb1bb66992435Patch, Third Party Advisory
• https://github.com/Project-Pier/ProjectPier-Core/issues/37Exploit, Third Party Advisory
• https://github.com/Project-Pier/ProjectPier-Core/commit/74ecbd4e939a65ba643a4af05fbdb1bb66992435Patch, Third Party Advisory
• https://github.com/Project-Pier/ProjectPier-Core/issues/37Exploit, Third Party Advisory

Published

Feb 2, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-2789Unquoted Windows search path vulnerability in the Foxit Clou…
• CVE-2015-2790Foxit Reader, Enterprise Reader, and PhantomPDF before 7.1 a…
• CVE-2015-2791The "menu sync" function in the WPML plugin before 3.1.9 for…
• CVE-2015-2792The WPML plugin before 3.1.9 for WordPress does not properly…
• CVE-2015-2793Cross-site scripting (XSS) vulnerability in templates/openid…6.1
• CVE-2015-2794The installation wizard in DotNetNuke (DNN) before 7.4.1 all…
• CVE-2015-2797Stack-based buffer overflow in AirTies Air 6372, 5760, 5750,…
• CVE-2015-2798SQL injection vulnerability in Joomla! Component Contact For…
• CVE-2015-2800The user authentication module in Huawei Campus switches S57…
• CVE-2015-2802An Information Disclosure vulnerability exists in HP SiteSco…7.5
• CVE-2015-2803SQL injection vulnerability in mod1/index.php in the Akronym…
• CVE-2015-2804The management web interface in Alcatel-Lucent OmniSwitch 64…