CVE-2023-49539

CVE-2023-49539 Book Store Management System v1.0 - 跨站脚本（XSS）漏洞在 "index.php/category" - 脆弱字段："Category Name" 描述 ：Book Store Management System v1.0 被发现存在跨站脚本（XSS）漏洞，位于 "/bsmsci/index.php/category"。此漏洞允许攻击者通过向 "Category Name" 字段注入特制载荷来执行任意 web 脚本或 HTML。 脆弱产品版本 ：Book Store Management System v1.0 CVE ...

CVE-2025-25461

📌 CVE-2025-25461 - SeedDMS 6.0.29 存储型跨站脚本（XSS）漏洞 📝 描述 SeedDMS 6.0.29 中存在一个存储型跨站脚本（XSS）漏洞。 拥有 "添加分类" 权限的用户或恶意管理员可以向分类名称字段注入恶意 XSS 载荷。 当文档随后与该分类关联时，载荷会被存储在服务器上，并在未经过滤或输出编码的情况下渲染。 这导致任何查看文档的用户浏览器执行该 XSS 载荷。 🎯 受影响产品 软件： SeedDMS 版本： 6.0.29 组件： 分类名称字段 ⚠️ 影响 会话劫持 数据泄露 钓鱼攻击 远程代码执行（通过 JavaScript） 🔥...

CVE-2026-88867

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

CVE-2026-88867

WWBN AVideo (up to commit c3edcc274c389816d434acadac07ee78eaf330c1 ) is affected by a stored cross-site scripting (XSS) vulnerability. The endpoint objects/categoryAddNew.json.php passes the POST parameters name and iconClass into Category::setName() and Category::setIconClass() without sanitizat...

EUVD-2026-75417

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

CVE-2026-88867 WWBN AVideo Stored XSS via Category Name and Icon Class

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

PT-2026-89378

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

CVE-2026-19336

A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access...

EUVD-2026-54886

A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access...

Cross-site Scripting (XSS)

Overview feehi/cms is a Feehi CMS project template. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Name parameter in the Category module. An attacker can execute arbitrary web scripts or HTML by injecting a crafted payload. Details Cross-site scripting or XSS...

CVE-2026-30527

A Stored Cross-Site Scripting XSS vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management module within the admin panel. The application fails to properly sanitize user input supplied to the "Category Name" field when creating or updating a category. Whe...

CVE-2026-30527

The CVE-2026-30527 issue affects SourceCodester Online Food Ordering System v1.0, specifically in the Category management module of the admin panel. The vulnerability is a Stored XSS arising from insufficient sanitization of the Category Name field when creating or updating categories. When an ad...

CVE-2026-30527

A Stored Cross-Site Scripting XSS vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management module within the admin panel. The application fails to properly sanitize user input supplied to the "Category Name" field when creating or updating a category. Whe...

CVE-2026-30527

A Stored Cross-Site Scripting XSS vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management module within the admin panel. The application fails to properly sanitize user input supplied to the "Category Name" field when creating or updating a category. Whe...

CVE-2026-30527

A Stored Cross-Site Scripting XSS vulnerability exists in SourceCodester Online Food Ordering System v1.0 in the Category management module within the admin panel. The application fails to properly sanitize user input supplied to the "Category Name" field when creating or updating a category. Whe...

CVE-2025-52470

CVE-2025-52470 affects Chamilo LMS prior to version 1.11.30. It is a stored XSS vulnerability in session_category_add.php where improper sanitization of the Category Name allows privileged users to inject persistent JavaScript payloads. The injected script can execute when administrators access a...

CVE-2025-52470 Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name

Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting XSS vulnerability exists in the sessioncategoryadd.php script. The vulnerability is caused by improper sanitization of the Category Name field, allowing privileged users to inject persistent JavaScrip...

EUVD-2025-208175

Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting XSS vulnerability exists in the sessioncategoryadd.php script. The vulnerability is caused by improper sanitization of the Category Name field, allowing privileged users to inject persistent JavaScrip...

CVE-2025-52470 Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name

Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting XSS vulnerability exists in the sessioncategoryadd.php script. The vulnerability is caused by improper sanitization of the Category Name field, allowing privileged users to inject persistent JavaScrip...

CVE-2025-52470 Chamilo: Stored Cross-Site Scripting (XSS) via Session Category Name

Chamilo is a learning management system. Prior to version 1.11.30, a stored cross-site scripting XSS vulnerability exists in the sessioncategoryadd.php script. The vulnerability is caused by improper sanitization of the Category Name field, allowing privileged users to inject persistent JavaScrip...