PT-2025-7191 · WordPress · Wp Font Awesome

Name of the Vulnerable Software and Affected Versions: Font Awesome WP versions n/a through 1.0 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS. This enables potential attackers to...

PT-2025-7179 · Prezi · Prezi Embedder

Name of the Vulnerable Software and Affected Versions: Prezi Embedder versions prior to 2.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject malicious scripts...

Code-Projects Job Recruitment 代码注入漏洞

Code-Projects Job Recruitment is an open source job portal by Code-Projects. A code injection vulnerability exists in Code-Projects Job Recruitment version 1.0, which stems from unknown code in the /parse/loaduser-profile.php file that does not properly handle user input...

D-Link DIR-853 安全漏洞

The D-Link DIR-853 is a router from China-based AUO D-Link. The D-Link DIR-853 suffers from a buffer overflow vulnerability that stems from the IPv6PppoePassword parameter in the SetIPv6PppoeSettings module not properly handling user input. No detailed vulnerability details are provided at this...

D-Link DIR-853 安全漏洞

The D-Link DIR-853 is a router from China's AUO D-Link. The D-Link DIR-853 suffers from a buffer overflow vulnerability that stems from the AccountPassword parameter in the SetSysEmailSettings module not properly handling user input. No details of the vulnerability are provided at this time...

CVE-2024-57241

Dedecms 5.71sp1 and earlier is vulnerable to URL redirect. In the web application, a logic error does not judge the input GET request resulting in URL redirection...

Adobe Commerce 跨站脚本漏洞

Adobe Commerce is an enterprise-grade e-commerce solution designed to deliver a superior online shopping experience for B2B and B2C businesses worldwide. A cross-site scripting vulnerability exists in Adobe Commerces. The vulnerability stems from a failure to properly process user input and can b...

PT-2025-6400

Name of the Vulnerable Software and Affected Versions Dedecms versions 5.71sp1 and earlier Description The issue is related to a logic error in the web application that does not properly judge the input GET request, resulting in URL redirection. This allows for potential URL redirect attacks...

Fortinet FortiSandbox 跨站脚本漏洞

Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from US-based Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. The Fortinet FortiSandbox suffers from a cross-site scripting...

Prototype Pollution

@rpldy/uploader is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of user-supplied input in the lib.createUploader function, allowing attackers to manipulate object properties and cause a Denial of Service DoS attack via a crafted payload...

SAP NetWeaver Application Server Java 跨站脚本漏洞

SAP NetWeaver Application Server Java is an application server from SAP Germany that provides a Java runtime environment. The product is primarily used to develop and run Java EE applications. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server Java, which stems from t...

PT-2025-6113 · Unknown · Zoo-Project

Name of the Vulnerable Software and Affected Versions: ZOO-Project versions prior to commit 7a5ae1a Description: The ZOO-Project Web Processing Service WPS Server contains a Cross-Site Scripting XSS vulnerability in its EchoProcess service. The vulnerability exists because the EchoProcess service...

SAP BusinessObjects BI LaunchPad 跨站脚本漏洞

SAP BusinessObjects BI LaunchPad is a standard Web portal for users of the SAP BusinessObjects Business Intelligence BI platform from SAP, Germany. A cross-site scripting vulnerability exists in SAP BusinessObjects BI LaunchPad that stems from improper input handling and can lead to a cross-site...

CVE-2024-52882

An issue was discovered in AudioCodes One Voice Operations Center OVOC before 8.4.582. Due to improper neutralization of input via the devices API, an attacker can inject malicious JavaScript code XSS to attack logged-in administrator sessions...

Reflected Cross-Site Scripting (Reflected XSS)

Better-auth is vulnerable to Reflected cross-site scripting XSS. The vulnerability is due to HTML injection due to improper handling of user input on the /api/auth/error page, allowing an attacker to execute arbitrary JavaScript in a victim’s browser...

PT-2025-5953 · Theasys · Theasys

Name of the Vulnerable Software and Affected Versions: Theasys versions 1.0.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For Theasys versions...

PT-2025-5924 · Unknown · Nextgen Cooliris Gallery

Name of the Vulnerable Software and Affected Versions: NextGen Cooliris Gallery versions 0.7 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS attacks. This means that an attacker can inject malicious scripts...

AudioCodes One Voice Operations Center 安全漏洞

AudioCodes One Voice Operations Center AudioCodes OVOC is a web-based voice network management solution from AudioCodes, Inc. A security vulnerability exists in AudioCodes One Voice Operations Center OVOC versions prior to 8.4.582, which stems from improper neutralization of inputs via the device...

WordPress plugin WP SimpleWeather 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripti...

WordPress plugin Theasys 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...