Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

A reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML...

GHSA-JHGR-J9CJ-8J62 Liferay Portal is vulnerable to Reflected XSS attack through get_editor path

A reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2025-43783

Reflected XSS in Liferay Portal and Liferay DXP due to insufficient input sanitization in the /c/portal/comment/discussion/get_editor endpoint. Affected: Portal 7.4.3.73–7.4.3.128 and DXP 2024.Q3.0–2024.Q3.1, 2024.Q2.0–2024.Q2.13, 2024.Q1.1–2024.Q1.12, and 7.4 update 73–92. Impact: remote attacke...

CVE-2025-43783

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 update 73 through update 92 allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2025-9367

CVE-2025-9367 affects the Welcart e-Commerce plugin for WordPress (versions up to 2.11.20). It enables stored Cross-Site Scripting via settings due to insufficient input sanitization and output escaping. Authenticated attackers with editor-level permissions or higher can inject scripts that execu...

UPDF 代码问题漏洞

UPDF is a multi-platform PDF editor from the Chinese company UPDF. A code issue vulnerability exists in UPDF version 1.8.5.0, which stems from DLL search path hijacking and could lead to the execution of arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2019-11201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dolibarr ERP/CRM 9.0.1 provides a module named website that provides for creation of public websites with a WYSIWYG editor. It was identified that the editor al...

Linux Distros Unpatched Vulnerability : CVE-2012-5867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HT Editor 2.0.20 has a Remote Stack Buffer Overflow Vulnerability CVE-2012-5867 Note that Nessus relies on the presence of the package as reported by the vendor...

kodbox 路径遍历漏洞

kodbox is a web file manager by the individual developer warlee. A path traversal vulnerability exists in kodbox version 1.61, which is caused by the incorrect operation of the fileGet/fileSave function on the path parameter in the file app/controller/explorer/editor.class.php...

UPDF 代码问题漏洞

UPDF is a multi-platform PDF editor from the Chinese company UPDF. A code issue vulnerability exists in UPDF version 1.8.5.0, which stems from DLL search path hijacking and could lead to the execution of arbitrary code...

Linux Distros Unpatched Vulnerability : CVE-2021-25955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Dolibarr ERP CRM, WYSIWYG Editor module, v2.8.1 to v13.0.2 are affected by a stored XSS vulnerability that allows low privileged application users to store...

The vulnerability of the vsnprintf() function in the console-based image editing tool ImageMagick, which allows a hacker to cause a service failure

The vulnerability of the vsnprintf function in the console-based image editing tool ImageMagick is related to a violation of the buffer boundary. Exploiting this vulnerability could allow an attacker to cause a service failure...

WordPress Admin Menu Editor plugin cross-site scripting vulnerability

WordPress Admin Menu Editor plugin is a plugin for customizing and managing backend menus, supporting reordering, hiding/showing menu items, modifying permissions and more. WordPress Admin Menu Editor plugin suffers from a cross-site scripting vulnerability that stems from insufficient input...

CVE-2025-58746

The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus. Prior to version 2.4.0, a malicious actor with Editor privileges can escalate their privileges to Administrator and perform arbitrary...

CVE-2025-58746 Volkov Labs Business Links plugin vulnerable to privilege escalation attack

The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus. Prior to version 2.4.0, a malicious actor with Editor privileges can escalate their privileges to Administrator and perform arbitrary...

CVE-2025-9493

The Admin Menu Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder’ parameter in all versions up to, and including, 1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level acce...

PT-2025-36525

Name of the Vulnerable Software and Affected Versions: Volkov Labs Business Links panel for Grafana versions prior to 2.4.0 Description: The Volkov Labs Business Links panel for Grafana allows navigation using external links, internal dashboards, time pickers, and dropdown menus. Prior to version...