PYSEC-2025-137

A cross-site scripting XSS vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post...

CVE-2025-4411 XSS in Dataprom Informatics' PACS-ACSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Dataprom Informatics PACS-ACSS allows Cross-Site Scripting XSS. This issue affects PACS-ACSS: before 16.05.2025...

CVE-2024-53288

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in NTP Region functionality in Synology Router Manager SRM before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified...

PT-2025-30573

Name of the Vulnerable Software and Affected Versions Dataprom Informatics PACS-ACSS versions prior to 16.05.2025 Description The software contains an Improper Neutralization of Input During Web Page Generation, leading to a Cross-Site Scripting XSS issue. This allows for the injection of malicio...

CVE-2025-46383

CWE-79 Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting'...

CVE-2025-4284 Reflected XSS in Rolantis Information Technologies' Agentis

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Rolantis Information Technologies Agentis allows Reflected XSS, DOM-Based XSS. This issue affects Agentis: before 4.32...

CVE-2025-7716

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripting XSS.This issue affects Real-time SEO for Drupal: from 2.0.0 before 2.2.0...

How Search Engines, LLMs, and Third-Party Scrapers Affect Bot Management

...

CVE-2025-46383

CWE-79 Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting'...

Exploit for Cross-site Scripting in Livehelperchat Live_Helper_Chat

Exploit Title: LiveHelperChat 4...

CVE-2025-50583

StudentManage v1.0 was discovered to contain a cross-site scripting XSS vulnerability via the Add A New Student module...

Emby Windows 跨站脚本漏洞

Emby Windows is a media playback application for the Windows platform developed by Emby LLC that supports Windows 10, 11 and later systems. Emby Windows suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied...

Code-Projects Church Donation System 注入漏洞

The Church Donation System is a system of church giving. The Church Donation System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter Amount in the file /members/giving.php. An attacker can exploit this...

CVE-2025-24759

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-BusinessDirectory wp-businessdirectory allows Blind SQL Injection.This issue affects WP-BusinessDirectory: from n/a through = 3.1.4...

CVE-2025-54006

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through = 5.4.1...

CVE-2025-6053 Zuppler Online Ordering <= 2.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missing or incorrect nonce validation on the 'zuppler-online-ordering-options' page. This makes it possible for unauthenticated attackers to...

CVE-2025-53834

Caido is a web security auditing toolkit. A reflected cross-site scripting XSS vulnerability was discovered in Caido’s toast UI component in versions prior to 0.49.0. Toast messages may reflect unsanitized user input in certain tools such as Match and Scope. This could allow an attacker to craft...

CVE-2025-53996

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetSearch jet-search allows Stored XSS.This issue affects JetSearch: from n/a through = 3.5.10.1...

CVE-2025-40985

Summary of CVE-2025-40985 (SCATI Vision Web) : A SQL injection vulnerability affects SCATI Vision Web versions 4.8 through 7.2. The flaw enables an attacker to exfiltrate data from the database via the loginForm endpoint (/scatevision_web/index.php/loginForm). The provided documents consistently ...

HTTP Request Smuggling

aiohttp is vulnerable to HTTP request smuggling. The vulnerability is due to improper parsing of trailer sections in HTTP requests when the pure Python version of aiohttp is used or the AIOHTTPNOEXTENSIONS flag is enabled, which allows an attacker to smuggle HTTP requests and potentially bypass...