CVE-2025-67342

RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions ca...

CVE-2025-67342

The RuoYi backend management system (versions 4.8.1 and earlier ) is vulnerable to a stored cross-site scripting (XSS) flaw in the /system/menu/edit endpoint. Although an XSS filter is present, it can be bypassed, allowing an attacker with menu modification permissions to impact all users because...

PT-2025-50954

Name of the Vulnerable Software and Affected Versions RuoYi versions 4.8.1 and earlier Description The software contains a stored cross-site scripting XSS issue in the /system/menu/edit API endpoint. The existing XSS filter can be bypassed, allowing for exploitation. Because the menu is shared...

CVE-2025-67342

RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions ca...

Ruoyi 安全漏洞

Ruoyi is a backend management system by Ruoyi's individual developers. A security vulnerability exists in Ruoyi 4.8.1 and earlier versions, which stems from a bypassable stored cross-site scripting vulnerability in the /system/menu/edit endpoint that could affect all users...

CVE-2025-12963: Missing Authorization

The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.2.29. This is due to the plugin not properly validating a user's identity via the...

CVE-2025-67342: Improper Neutralization of Input During Web Page Generation

RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions ca...

CVE-2025-67342

RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions ca...

CVE-2024-58304

SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute...

CVE-2024-58304 SPA-CART CMS < 2.0.0 Stored Cross-Site Scripting

SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute...

CVE-2024-58304 SPA-CART CMS < 2.0.0 Stored Cross-Site Scripting

SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute...

CVE-2025-61074

A stored Cross Site Scripting XSS vulnerability in the bulletin board SchwarzeBrett in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote authenticated users to execute arbitrary JavaScript code in the web browser of other users via manipulation of the 'Inhalt' parameter of the...

PT-2025-50757

Name of the Vulnerable Software and Affected Versions SPA-CART CMS version 1.9.0.3 Description The software contains a stored cross-site scripting issue in the product description parameter. Authenticated administrators can inject malicious scripts. Attackers can submit JavaScript payloads throug...

CVE-2025-66474

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Versions 16.10.9 and below, 17.0.0-rc-1 through 17.4.2 and 17.5.0-rc-1 through 17.5.0 have insufficient protection against /html injection, which...

CVE-2025-61078

Cross-site scripting XSS vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructions parameter for the /app/admin/instructions/edit-result.php endpoint...

CVE-2025-65814

A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a directory traversal...

Currency Exchange System /edit.php File SQL Injection Vulnerability

Currency Exchange System is a currency exchange system. The Currency Exchange System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter ID of file /edit.php. An attacker can exploit this vulnerability to execute...

CVE-2025-65814: Improper Limitation of a Pathname to a Restricted Directory

A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a directory traversal...

EUVD-2025-202432

A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a directory traversal...

RHOPHI Analytics LLP Office App-Edit Word 安全漏洞

RHOPHI Analytics LLP Office App-Edit Word is a document editing software from RHOPHI Analytics LLP. A security vulnerability exists in RHOPHI Analytics LLP Office App-Edit Word version 6.4.1, which stems from a lack of security checks during the file import process and could lead to directory...