WordPress plugin Nextend Facebook Connect has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plug-in. A cross-site scriptin...

WordPress plugin Card Elements for WPBakery – Cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host a personal blog site on a PHP and MySQL based server.WordPress plugin is an application plugin. A cross-site...

WordPress plugin WP Frontend Admin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site scripti...

PHPGurukul Car Rental Project Code Injection Vulnerability

Car Rental Project is a car rental program. Car Rental Project suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter autofocus in the file /carrental/search.php, which can be exploited by an attacker t...

PT-2025-39066

Name of the Vulnerable Software and Affected Versions MagicProject AI version 9.1 Description MagicProject AI version 9.1 is affected by a Cross-Site Scripting XSS issue within the chatbot generation feature accessible to authenticated admin users. The issue is located in the prompt parameter...

CVE-2025-57205

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

CVE-2025-57203

MagicProject AI (version 9.1) is vulnerable to a Cross-Site Scripting (XSS) flaw within the chatbot generation feature. The root cause is insufficient input sanitization of the prompt parameter submitted via a multipart/form-data POST request to the /dashboard/user/generator/generate-stream endpo...

D-Link DSL7740C traceroute6 Command Execution

The vulnerability of the traceroute6 function in the microprogramming-based router D-Link DSL7740C is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

D-Link DSL-7740C Router Command Execution

The vulnerability of the ping function in D-Link DSL-7740C router microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

CVE-2025-9969

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Vizly Web Design Real Estate Packages allows Content Spoofing, CAPEC - 593 - Session Hijacking, CAPEC - 591 - Reflected XSS.This issue affects Real Estate Packages: before 5.1...

CVE-2025-10181 Draft List <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

Stored Cross-site Scripting (XSS)

com.liferay, com.liferay.plugins.admin.web is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization in the components tab, which allows an attacker to inject and execute arbitrary web scripts or HTML in the victim’s browser...

CVE-2025-10458

Parameters are not validated or sanitized, and are later used in various internal operations...

CVE-2025-10125

The Memberlite Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugins's 'row' shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-8394

The Productive Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's displayproductivebreadcrumb shortcode in all versions up to, and including, 1.1.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

Linksys E5600 runtime.ddnsStatus() Command Execution

The vulnerability of the runtime.ddnsStatus function in Linksys E5600 router microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system’s processing of the hostname parameter. Exploiting this vulnerability allows a remote attacke...

Security Bulletin: IBM Lakehouse Command Injection via Insufficient Input Sanitization , affects watsonx.data

Summary IBM Lakehouse could allow an authenticated privileged user to execute arbitrary commands on the system due to improper validation of user supplied input.This can affect watsonx.data. Vulnerability Details CVEID:CVE-2025-36143 DESCRIPTION: IBM Lakehouse could allow an authenticated...

CVE-2025-57145

A cross-site scripting XSS vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize user input submitted through a form field, allowing an attacker to inject arbitrary JavaScript code. The malicious payload is stored in the...

PT-2025-38292

Name of the Vulnerable Software and Affected Versions itsourcecode Online Petshop Management System version 1.0 Description A cross-site scripting issue exists in the Available Products Page component of the software, specifically within the addcnp.php file. Manipulation of the name/description...

CVE-2025-0546

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting', Improper Restriction of Rendered UI Layers or Frames vulnerability in Mevzuattr Software MevzuatTR allows Phishing, iFrame Overlay, Clickjacking, Forceful Browsing. This issue needs high privileges. This...