CVE-2025-63708

CVE-2025-63708 CVE ID: CVE-2025-63708 Assigned: 11-12-2025 Problem Type: CWE-79 Cross-Site Scripting Affected Product: “AI Font Matcher” posted 2025-10-10, nid=18425 Product page: https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html...

CVE-2026-92385

A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System version 1.0 , specifically in the file /admin/update_category.php (component: Category Update). The affected function is not publicly identified. An attacker with high privileges (i.e., an authenticate...

Trickster-HTB

Trickster Exploitation Report About Trickster Trickster is a medium-difficulty Linux machine featuring multiple vulnerabilities across different services. This report outlines the process of exploiting these vulnerabilities to achieve full system compromise. Exploitation Steps 1. Exploiting...

CVE-2023-24203-and-CVE-2023-24204

CVE-2023-24203-and-CVE-2023-24204 Introduction In the ever-evolving landscape of cybersecurity, web applications remain a prime target for attackers seeking to exploit vulnerabilities. Recently, two critical vulnerabilities were discovered in the SourceCodester Simple Customer Relationship...

Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting

Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...

Roundcube Webmail - Cross-Site Scripting

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in messagebody in program/actions/mail/show.php. id: CVE-2024-42009 info: name:...

OpenEMR < 7.0.1 - Cross-Site Scripting

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. id: CVE-2023-2948 info: name: OpenEMR 7.0.1 - Cross-Site Scripting author: ritikchaddha,princechaddha severity: medium description: | Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr...

rConfig 3.9.4 - Cross-Site Scripting

The rConfig 3.9.4 is vulnerable to cross-site scripting. The devicemgmnt.php file improperly validates the request coming from the user input. Due to this flaw, An attacker can exploit this vulnerability by crafting arbitrary javascript in deviceId GET parameter of devicemgmnt.php resulting in...

Nagios XI 5.7.5 - Cross-Site Scripting

Nagios XI 5.7.5 contains a cross-site scripting vulnerability in the file /usr/local/nagiosxi/html/admin/sshterm.php, due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal session cookies, or it can be chained with th...

CVE-2022-3546

CVE-2022-3546 https://vulners.com/cve/CVE-2022-3546 A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /csms/admin/?page=user/list of the component Create User Handle...

CVE-2025-60654

CVE-2025-60654 - Stored Cross-Site Scripting XSS in Ad Description | ---|--- Researchers| DotAdrien Severity| 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N Software| Script Pag Description...

CVE-2025-57926

Sink: According to the mechanism of WordPress Core, XSS is prevented in post content, but with this plugin, the content is encoded and then decoded when rendered, unintentionally creating an XSS vulnerability." PoC: The base64 encoded payload is PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==...

osticket-stored-xss-security-assessment

CVE-2026-36214 - osTicket Stored XSS via Bootstrap Tooltip Consultant-Style Cybersecurity Report Professional vulnerability assessment report for osTicket stored cross-site scripting, including business impact, remediation, and mitigation strategy. 📍 Report Snapshot...

Vehicle-Service-Management-System-MyAccount-Stored-Cross-Site-Scripting-XSS

CVE-2021-46068 익스플로잇 제목: Vehicle Service Management System - 'MyAccount' 저장형 크로스 사이트 스크립팅 XSS 익스플로잇 작성자: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 MEDIUM 참고 자료: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xss...

CVE-2022-29380

CVE-2022-29380 CVE-2022-29380 root@kitploit: Date: 25/05/2022 Author: OpenXP Team Software: Academy LMS Version: Academy LMS = v4.3 Type: Cross-Site Scripting OWASP TOP 10: A03:2021-Injection CWE: CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' References...

CVE-2017-0055-PoC

CVE-2017-0055 PoC MICROSOFT IIS 7.0/7.5/8.0/8.5/10 /UNCPATH/ CROSS SITE SCRIPTING Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-0055 Base Score: 6.1 Severity: Medium Exploit: http://vulniis/uncpath/%3Cimg%20onerror=alert'xss'%20src=/%3E:/...

Vehicle-Service-Management-System-Service-Requests-Stored-Cross-Site-Scripting-XSS

CVE-2021-46070 Exploit Title: Vehicle Service Management System - 'Service Requests' 저장형 교차 사이트 스크립팅 XSS Exploit Author: SANU P.L CVE: CVE-2021-46070 CVSS: 4.8 MEDIUM 참조: https://www.plsanu.com/vehicle-service-management-system-service-requests-stored-cross-site-scripting-xss...

CVE-2023-32961

CVE-2023-32961 This repository is about XSS vulnerability in Wordpress Zotpress Plugin. Component details Component name Zotpress Vulnerable version ≤ 7.3.3 Component slug zotpress Component link https://wordpress.org/plugins/zotpress/ Pre-requisite Unauthenticated Vulenerability details Short...

CVE-2023-29439

CVE-2023-29439 This repository is about XSS vulnerability in Wordpress Foogallery Plugin. Vulenerability details Description In Foogallery 2.2.35 and earlier, the function foogalleryimageeditormodal in foogallery/includes/admin/class-gallery-attachment-modal.php is vulnerable to XSS attack...

CVE-2024-40509

CVE-2024-40509 Cross Site Scripting vulnerability in openPetra v.2023.02 via the serverMFinDev.asmx function. Description : An unauthenticated user can steal cookies from authenticated user, by exploiting a XSS in openPetra v.2023.02 via the serverMFinDev.asmx function. Vulnerable Product Version...