CVE-2025-39487 WordPress Rankie plugin <= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ValvePress Rankie valvepress-rankie allows Reflected XSS.This issue affects Rankie: from n/a through = 1.8.2...

CVE-2025-49245

CVE-2025-49245 : Reflected XSS in WordPress plugin “Testimonials Showcase” (versions

CVE-2025-30983 WordPress Card flip image slideshow plugin <= 1.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gopiplus Card flip image slideshow card-flip-image-slideshow allows DOM-Based XSS.This issue affects Card flip image slideshow: from n/a through = 1.5...

CVE-2025-27454

CVE-2025-27454 is a CSRF vulnerability affecting Endress+Hauser MEAC300-FNADE4. The issue arises from a WEB application that does not adequately validate requests from trusted users, allowing an attacker to trick a logged-in user into submitting unintended requests using the user’s saved browser ...

CVE-2025-52842

The CVE-2025-52842 issue concerns Laundry (Linux/macOS) v2.3.0, caused by improper neutralization of input during web page generation, enabling a reflected XSS that could lead to account takeover. Public references in NVD/Red Hat and other feeds confirm affected software and vulnerability descrip...

firefox: thunderbird: Incorrect parsing of URLs could have allowed embedding of youtube.com

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security...

firefox: thunderbird: Incorrect parsing of URLs could have allowed embedding of youtube.com

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an embed tag. This could have bypassed website security...

firefox: thunderbird: Content-Disposition header ignored when a file is included in an embed or object tag

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: When a file download is specified via the Content-Disposition header, that directive would be ignored if the file was included via a or tag, potentially making a website vulnerab...

CVE-2025-36027 IBM Datacap clickjacking

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against...

CVE-2023-38007

IBM Cloud Pak System 2.3.5.0, 2.3.3.7, 2.3.3.7 iFix1 on Power and 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.4.0, 2.3.4.1 on Intel operating systems is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browse...

CVE-2025-53199

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HT Plugins HT Slider For Elementor ht-slider-for-elementor allows DOM-Based XSS.This issue affects HT Slider For Elementor: from n/a through = 1.6.5...

CVE-2025-53206 WordPress HT Mega – Absolute Addons for WPBakery Page Builder plugin <= 1.0.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows Stored XSS.This issue affects HT Mega – Absolute Addons for WPBakery Page Builder: from n/a through = 1.0....

CVE-2025-39478 WordPress Smart Notification Plugin <= 10.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in smartiolabs Smart Notification allows Reflected XSS. This issue affects Smart Notification: from n/a through 10.3...

School Fees Payment System branch.php file cross-site scripting vulnerability

School Fees Payment System is a tuition payment system. School Fees Payment System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter Branch/Address/Detail in the file /branch.php, which can be...

PT-2025-27167 · WordPress · File Manager Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: File Manager Plugin For Wordpress versions prior to 7.5 Description: The issue allows attackers to upload dangerous files, including web shells, to a web server, compromising its security. This is due to an Unrestricted Upload of File with...

PT-2025-27095 · Woocommerce · Woocommerce Line Notify

Name of the Vulnerable Software and Affected Versions: WooCommerce Line Notify versions 1.1.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means an attacker can inject malicious...

PT-2025-27122 · Quanticalabs · Quanticalabs Css3 Vertical Web Pricing Tables

Name of the Vulnerable Software and Affected Versions: QuanticaLabs CSS3 Vertical Web Pricing Tables versions n/a through 1.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This mean...

JetBrains TeamCity NPM Registry Integration Cross-Site Scripting Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. JetBrains TeamCity suffers from a cross-site...

PT-2025-26961 · Drupal +1 · Drupal +1

Name of the Vulnerable Software and Affected Versions: Toc.Js versions 0.0.0 through 3.2.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, in Drupal Toc.Js. This allows an attacker to perform Cross-Site...

DRUPAL-CONTRIB-2025-080

Klaro Cookie & Consent Management module is used for consent management for cookies and external sources. It makes changes to the markup to enable or disable loading. The module doesn't sufficiently sanitize some HTML attributes allowing persistent Cross-site Scripting XSS attacks. This...