CVE-2025-0423 Multiple Unauthenticated Stored Cross-Site Scripting

In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their...

PT-2025-9550

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a stored crafted link which, when clicked, could potentially execute...

IBM ApplinX Cross-Site Scripting Vulnerability (CNVD-2025-04170)

IBM ApplinX is an International Business Machines IBM company focused on converting green screen interfaces into modern web-based applications. A cross-site scripting vulnerability exists in IBM ApplinX version 11.1. The vulnerability stems from the application's lack of effective filtering and...

PT-2025-9544

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker with high privileges, specifically publisher capabilities, to create a crafted link...

PT-2025-9554

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a stored crafted link which, when clicked, could potentially execute...

CVE-2024-56882

Sage DPW , an HR system from Sage UK, is vulnerable to Cross-Site Scripting (XSS) in versions prior to 2024_12_000 . The root cause is the unfiltered scripting of input fields, specifically Kurstitel and Kurzinfo . Low-privileged users with employee role privileges can permanently store malicious...

PT-2025-9541

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a stored crafted link which, when clicked, could potentially execute...

IBM Aspera Shares Cross-Site Scripting Vulnerability (CNVD-2025-04172)

IBM Aspera Shares is a Web application from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Aspera Shares versions 1.9.0 through 1.10.0 PL6. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which...

PT-2025-9556

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a stored crafted link which, when clicked, could potentially execute...

PT-2025-9559

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker with high privileges, specifically publisher capabilities, to create a crafted link...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2025-04977)

IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2025-04978)

IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2025-04976)

IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting...

IBM Security Verify Access Cross-Site Scripting Vulnerability (CNVD-2025-06213)

IBM Security Verify Access ISAM is a service from International Business Machines IBM that improves user access security. The service enables secure and simple access to platforms such as web, mobile, IoT and cloud technologies through the use of risk-based access, single sign-on, integrated acce...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the vlSelectionTuples function, allowing the usage of Function with arbitrary JavaScript code. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious...

CVE-2024-56463

IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2024-56463 IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2024-56463

CVE-2024-56463 (IBM QRadar SIEM 7.5) is a cross-site scripting vulnerability that could allow a privileged user to embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The IBM Security Bulletin confirms affected product/version: IBM QRa...

CVE-2024-56463 IBM QRadar SIEM cross-site scripting

IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2024-36361

Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compileFileClient, or compileClientWithDependenciesTracked function. NOTE: these functions are for compiling Pug templates into JavaScript, and there would...