POC_CVE-2024-40492

CVE-2024-40492: XSS Almacenado a ATO Descripción El Cross-Site Scripting XSS Almacenado es un tipo de vulnerabilidad de seguridad que se encuentra típicamente en aplicaciones web. Ocurre cuando un atacante puede inyectar scripts maliciosos en una aplicación web, y esos scripts se almacenan en el...

CVE-2022-24227-updated

CVE-2022-24227 Actualizado - BoltWire v8.00 - Cross-site Scripting Almacenado XSS Descripción CVE-2022-24227 Actualizado : En la versión 8.00 de BoltWire CMS , los campos First Name y Last Name de la página de finalización del registro de miembros también son vulnerables a ataques de cross-site...

CVE-2025-14221

Descripción 1. CVE-2025-14221 2. Descubridor: Fatma Trabelsi 3. Proveedor del producto: SourceCodester 4. Producto afectado: Online Banking System 1.0 POC Existe una vulnerabilidad de Cross-Site Scripting XSS almacenado en la funcionalidad de actualización del perfil de usuario de la aplicación. ...

EUVD-2026-60559

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

CVE-2026-70560

CVE-2026-70560 affects Ultimate POS (Stock Management & Point of Sale). A stored XSS vulnerability allows low-privileged authenticated users to inject arbitrary HTML/script by submitting a malicious payload in the user first-name field during account creation. When such a user with a low-privileg...

CVE-2026-70560 Ultimate POS Stored XSS via First Name Field in Leave Notifications

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-57170

Ultimate POS Stock Management & Point of Sale contains a stored cross-site scripting vulnerability that allows low-privileged authenticated attackers to inject arbitrary HTML and script markup by setting a malicious payload in the user first-name field during account creation. Attackers with a...

EUVD-2026-52965

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

CVE-2026-68501

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

EUVD-2025-210536

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in savestud.php via the parameters fname, lname, and studentclass...

CVE-2025-67404

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in savestud.php via the parameters fname, lname, and studentclass...

CVE-2026-60120 Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php

Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. Th...

📄 Computer Laboratory Management System 1.0 Cross Site Scripting

Computer Laboratory Management System version 1.0 suffers from a persistent cross site scripting vulnerability. Stored Cross-Site Scripting XSS in Computer Laboratory Management System v1.0 Summary A Stored Cross-Site Scripting XSS vulnerability exists in Computer Laboratory Management System v1....

CVE-2026-7296

A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0. This affects the function saveorder of the file /admin/ajax.php?action=saveorder. Performing a manipulation of the argument firstname results in cross site scripting. Remote exploitation of the attack is possible. The explo...

CVE-2026-7089

A security vulnerability has been detected in code-projects Home Service System 1.0. The impacted element is an unknown function of the file /booking.php of the component Appointment Booking. The manipulation of the argument fname/lname leads to cross site scripting. The attack may be initiated...

CVE-2026-9471

A vulnerability was detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file /student.php. Performing a manipulation of the argument FIRSTNAME results in cross site scripting. The attack can be initiated remotely...

CVE-2026-6696

The Zingaya Click-to-Call plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email', 'firstname', 'lastname', and 'phone' parameters on the plugin's sign-up admin page in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output...

GHSA-XF4V-W5X5-PV79 Spree: CSV Formula Injection in Customer Export

Summary CSV formula injection also known as formula injection or CSV injection affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted Export in Microsoft Excel or LibreOffice Calc, formulas embedded in user da...

PT-2026-49156

Summary CSV formula injection also known as formula injection or CSV injection affects customer export. User-controlled values customer names, email addresses, and shipping addresses. When an administrator opens a crafted Export in Microsoft Excel or LibreOffice Calc, formulas embedded in user da...

CVE-2026-42197

RELATE is a web-based courseware package. Versions prior to commit 555f0efb1c5bd7531c07cd73724d7e566a81f620 have a stored cross-site scripting vulnerability that allows any enrolled student to execute arbitrary JavaScript in an administrator's browser session, potentially leading to full admin...