CVE-2024-13287

Summary (CVE-2024-13287): Drupal Views SVG Animation contains an XSS vulnerability due to improper neutralization of input during web page generation. Affected versions are 0.0.0 through 1.0.0; fixed in 1.0.1 and later. The issue is documented in multiple sources (SA-CONTRIB-2024-051, DRUPAL-SA-C...

CVE-2024-13247

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Coffee allows Cross-Site Scripting XSS.This issue affects Coffee: from 0.0.0 before 1.4.0...

CVE-2025-22539 WordPress Custom DataBase Tables Plugin <= 2.1.34 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ka2 Custom DataBase Tables allows Reflected XSS.This issue affects Custom DataBase Tables: from n/a through 2.1.34...

CVE-2025-22808 WordPress Surbma | Premium WP plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Surbma Surbma | Premium WP allows DOM-Based XSS.This issue affects Surbma | Premium WP: from n/a through 9.0...

WordPress plugin VR Views 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Cross-site Scripting (XSS)

Koji is vulnerable to cross-site scripting XSS. The vulnerability is due to unsanitized input due to malicious JavaScript code from a crafted link being reflected in the resulting web page, although XSS protections prevent actions or changes in Koji...

SUSE CVE-2025-21620

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

CVE-2025-22354 WordPress Digi Store theme <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Code Themes Digi Store digi-store allows DOM-Based XSS.This issue affects Digi Store: from n/a through = 1.1.4...

CVE-2025-22308

CVE-2025-22308 is a stored XSS vulnerability in WordPress plugin Smart Custom Fields (aka Smart Custom Fields by Takashi Kitajima). The issue affects Smart Custom Fields versions up to 5.0.0 and is tied to improper input neutralization during web page generation (stored XSS). The vulnerability is...

Cross-site Scripting (XSS)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user input sanitization passed through the generateMeta parameter of the class...

PhpSpreadsheet 跨站脚本漏洞

PhpSpreadsheet is an open source PHP library from PHPOffice for reading and writing spreadsheet files. PhpSpreadsheet suffers from a cross-site scripting vulnerability that originates from HTML pages formed without cleaning up the hyperlink library, resulting in a cross-site scripting XSS...

CVE-2024-56242 WordPress Arconix Shortcodes plugin <= 2.1.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through = 2.1.14...

CVE-2024-56022 WordPress Preloader by WordPress Monsters plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WordPress Monsters Preloader by WordPress Monsters allows Reflected XSS.This issue affects Preloader by WordPress Monsters: from n/a through 1.2.3...

CVE-2024-12595

CVE-2024-12595 concerns the AHAthat Plugin for WordPress (versions ≤ 1.6). The issue is a reflected XSS caused by the plugin not escaping the PHP global $_SERVER['REQUEST_URI'] when it is echoed back inside an HTML attribute. This can enable a attacker-controlled input to be reflected in the page...

Code-Projects Chat System 安全漏洞

Chat System is a chat system. Chat System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter id of the /admin/deleteroom.php file. An attacker can exploit this vulnerability to execute illegal SQL commands t...

PT-2024-36759 · Unknown · Ledenbeheer

Name of the Vulnerable Software and Affected Versions: Ledenbeheer versions prior to 2.1.0 Description: The issue is related to improper neutralization of input during web page generation, allowing stored Cross-site Scripting XSS. This enables attackers to inject malicious scripts into the websit...

WordPress plugin Embed PDF Viewer 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. WordPress plugin is an application plug-in. WordPress plugin Embed PDF Viewer...

CVE-2024-47925

Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the /admin/articles/create endpoint due to improper user input sanitization. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS by sending a crafted payload to the /info endpoint via the lgslquery40 function. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an...