CVE-2025-32072 HTML injection in feed output from i18n message

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43...

Formie for Craft CMS cross-site scripting vulnerability

Formie for Craft CMS is an open source form plugin for Craft CMS by Verbb. A cross-site scripting vulnerability exists in Formie for Craft CMS versions prior to 2.1.44, which stems from the possible injection of malicious code into HTML content...

PT-2025-16117

Name of the Vulnerable Software and Affected Versions: Formie versions prior to 2.1.44 Description: The issue allows malicious code injection into the HTML content of an email notification, which is then rendered on the preview. This requires access to the form's email notification settings. The...

CVE-2025-30166

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-32230 WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a through = 3.4.0...

CVE-2025-32230 WordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Themeum Tutor LMS. This issue affects Tutor LMS: from n/a through 3.4.0...

StudentServlet-JSP Cross-Site Scripting Vulnerability

StudentServlet-JSP is a student course grades teacher information management system . StudentServlet-JSP has a cross-site scripting vulnerability , the vulnerability stems from the parameter Name on the user-supplied data lack of effective filtering and escaping , an attacker to exploit the...

GHSA-X82R-6J37-VRGG Pimcore's Admin Classic Bundle allows HTML Injection

Summary An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. Details The vulnerability was discovered in the...

Pimcore's Admin Classic Bundle allows HTML Injection

Summary An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page content. Details The vulnerability was discovered in the...

CVE-2025-30166

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-30166

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-30166

CVE-2025-30166 affects Pimcore’s Admin Classic Bundle. An HTML injection vulnerability resides in the /admin/email/send-test-email endpoint’s content parameter, allowing authenticated users with email-sending access to inject HTML into emails, potentially leaking session cookies or altering page ...

CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-30166 Pimcore's Admin Classic Bundle allows HTML Injection

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

CVE-2025-30166: Improper Neutralization of Input During Web Page Generation

Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. An HTML injection issue allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the admin interface, potentially leading to session cookie theft and the alteration of page...

Pimcore Admin Classic Bundle Cross-site Scripting Vulnerability

Pimcore Admin Classic Bundle is a Pimcore open source a core bundle of Pimcore. The Pimcore Admin Classic Bundle suffers from a cross-site scripting vulnerability that stems from HTML injection, which can be exploited by an attacker to steal session cookies...

PT-2025-15421

Name of the Vulnerable Software and Affected Versions: Pimcore Admin Classic Bundle versions prior to 1.7.6 Description: An HTML injection issue in Pimcore's Admin Classic Bundle allows users with access to the email sending functionality to inject arbitrary HTML code into emails sent via the adm...

CVE-2024-46494

Typecho v1.2.1 is vulnerable to a cross-site scripting (XSS) vulnerability. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the Name parameter when submitting a comment for an Article. As a temporary workaround, it is recommended to restrict access to the N...

CVE-2024-46494

A cross-site scripting XSS vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into Name parameter under a comment for an Article...