4994 matches found
104 eHRMS 跨站脚本漏洞
104 eHRMS is a Human Resource Management System from 104 Inc. A cross-site scripting vulnerability exists in 104 eHRMS V202412 and prior versions, which stems from reflective cross-site scripting and could lead to the execution of arbitrary JavaScript code...
BIT-GRAFANA-2025-2703
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript...
CVE-2025-2703
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript...
CVE-2025-2703
CVE-2025-2703 affects Grafana’s built-in XY Chart plugin through a DOM XSS flaw. The advisory text states that a user with Editor permissions can modify a panel to execute arbitrary JavaScript, indicating that the vulnerability stems from client-side script handling in the chart component and cou...
CVE-2025-2703
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript...
CVE-2025-2703
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript...
CVE-2025-2703
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript...
CVE-2025-29526
A Cross-Site Scripting (XSS) vulnerability exists in the search function of the Q4 Inc Investor Relations Platform v5.147.1.2 . The root cause is unfiltered input provided to the SearchTerm parameter, which allows an attacker to inject and execute arbitrary Javascript . This exploitation could le...
CVE-2025-2703: Improper Neutralization of Input During Web Page Generation
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript...
XSS in XY Chart Plugin in Grafana
The built-in XY Chart plugin is vulnerable to a DOM XSS vulnerability. A user with Editor permissions is able to modify such a panel in order to make it execute arbitrary JavaScript. This vulnerability first appeared in Grafana v11.1.0, and is fixed in 11.6.0+security-01, 11.5.3+security-01,...
Firefox ESR 115.11 - PDF.js Arbitrary JavaScript execution
Exploit Title: Firefox ESR 115.11 - Arbitrary JavaScript execution in PDF.js Date: 2025-04-16 Exploit Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL MiRROR-H: https://mirror-h.org/search/hacker/49626/ Vendor Homepage:...
The vulnerability of the SafeInspect system for privileged users relates to the lack of measures taken to protect the structure of the web page, allowing a perpetrator to execute arbitrary JavaScript code.
The vulnerability of the SafeInspect privilege-controlled user control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary JavaScript code...
The vulnerability of the SafeInspect system for privileged users relates to the lack of measures taken to protect the structure of the web page, allowing a perpetrator to execute arbitrary JavaScript code.
The vulnerability of the SafeInspect privilege control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code during the user creation process...
The vulnerability of the SafeInspect system for privileged users relates to the lack of measures taken to protect the structure of the web page, allowing a perpetrator to execute arbitrary JavaScript code.
The vulnerability of the SafeInspect privilege-controlled user control system is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary JavaScript code...
PT-2025-16594
Name of the Vulnerable Software and Affected Versions Ready File Explorer affected versions not specified Description A cross-site scripting XSS issue in the upload functionality of Ready File Explorer allows the injection of arbitrary JavaScript code in the filename. The injected content is stor...
CVE-2025-22465
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required...
CVE-2025-31476
tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges access to the site's source code or a CMS plugin to enter a URL containing an insecure scheme such as javascript:alert. Before the fix, URL...
CVE-2025-22465
Ivanti Endpoint Manager is affected by CVE-2025-22465 (Reflected XSS) in versions older than 2024 SU1 or older than 2022 SU7. An unauthenticated remote attacker can cause the victim’s browser to execute arbitrary JavaScript. The issue arises from insufficient input handling in the web interface. ...
CVE-2025-22465
Reflected XSS in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. Unlikely user interaction is required...
PT-2025-15439
Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions prior to 2024 SU1 Ivanti Endpoint Manager versions prior to 2022 SU7 Description: The issue allows a remote unauthenticated attacker to execute arbitrary javascript in a victim's browser. User interaction is...