CVE-2025-64049

A stored cross-site scripting XSS vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the...

CVE-2025-64049

A stored cross-site scripting (XSS) vulnerability exists in the module management component of REDAXO CMS version 5.20.0 . The root cause is the improper neutralization of input in the Output code field within modules, allowing remote users to inject arbitrary web scripts or HTML. The malicious p...

PT-2025-48037

Name of the Vulnerable Software and Affected Versions REDAXO CMS version 5.20.0 Description A stored cross-site scripting XSS issue exists in the module management component of REDAXO CMS. A remote user can inject arbitrary web script or HTML through the Output code field within modules. This...

Exploit for CVE-2025-64049

CVE-Disclosures Welcome to the CVE disclosures section of thi...

PoC-Stored-XSS-textpattern-4.8.8-Exploit

Textpattern CMS 4.8.8 — Stored XSS Advisory Title: Stored...

CVE-2025-41040

CVE-2025-41040 : appRain CMF 4.0.5 contains a stored authenticated XSS in /apprain/developer/language/lipsum.xml via unsanitized data[code], data[lang][0][key/value], data[lang][1][key], and data[title]. Root cause: improper validation of user input. Impact: cookie-based credential theft potentia...

CVE-2023-23277

Snippet-box 1.0.0 is vulnerable to Cross Site Scripting XSS. Remote attackers can render arbitrary web script or HTML from the "Snippet code" form field...

CVE-2024-8721: Improper Neutralization of Input During Web Page Generation

The Tracking Code Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the tracking code field in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-leve...

kernel: ipv4: Fix uninit-value access in __ip_make_skb()

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix uninit-value access in ipmakeskb KMSAN reported uninit-value access in ipmakeskb 1. ipmakeskb tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt2 with...

AZL-56207 CVE-2024-36927 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix uninit-value access in ipmakeskb KMSAN reported uninit-value access in ipmakeskb 1. ipmakeskb tests HDRINCL to know if the skb has icmphdr. However, HDRINCL can cause a race condition. If calling setsockopt2 with...

CVE-2024-31609

Cross Site Scripting XSS vulnerability in BOSSCMS v3.10 allows attackers to run arbitrary code via the header code and footer code fields in code configuration...

CVE-2024-24135

Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XSS attacks...

CVE-2023-23277

Snippet-box 1.0.0 is vulnerable to Cross Site Scripting XSS. Remote attackers can render arbitrary web script or HTML from the "Snippet code" form field...

Snippet Box 跨站脚本漏洞

Snippet Box is a simple self-hosted application for pawelmalak individual developers. It is used to organize code snippets. A security vulnerability exists in Snippet-box version 1.0.0. An attacker can exploit the vulnerability to see arbitrary web script or HTML in the "Snippet code" form field...

CVE-2022-42992

Multiple stored cross-site scripting XSS vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Train Code, Train Name, and Destination text fields...

PT-2022-26699

Name of the Vulnerable Software and Affected Versions Train Scheduler App version 1.0 Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Train Code, Train Name, and Destination text fields. This enables the execution of maliciou...

CVE-2020-23466

Cross Site Scripting XSS vulnerability exists in the phpgurukul Online Marriage Registration System 1.0 allows attackers to run arbitrary code via the wzipcode field...

CVE-2022-25575

Multiple cross-site scripting XSS vulnerabilities in Parking Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via crafted payloads injected into the user name, password, and verification code text boxes...

Kingdia CD Extractor 3.0.2 Buffer Overflow

Exploit Title: Kingdia CD Extractor 3.0.2 - Buffer Overflow SEH Date: 31.10.2021 Software Link: https://en.softonic.com/download/kingdia-cd-extractor/windows/post-download Exploit Author: Achilles Tested Version: 3.0.2 Tested on: Windows 7 64bit 1.- Run python code : Kingdia.py 2.- Open EVIL.txt...

CVE-2020-25875

A stored cross site scripting XSS vulnerability in the 'Smileys' feature of Codoforum v5.0.2 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payload entered into the 'Smiley Code' parameter...