CVE-2025-25299 Cross-site scripting (XSS) in the real-time collaboration package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting XSS vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within...

CVE-2025-25299

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting XSS vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within...

CVE-2025-0423

In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their...

CVE-2024-56882

Sage DPW before 202412000 is vulnerable to Cross Site Scripting XSS. Low-privileged Sage users with employee role privileges can permanently store JavaScript code in the Kurstitel and Kurzinfo input fields. The injected payload is executed for each authenticated user who views and interacts with...

CVE-2025-25299: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting XSS vulnerability was discovered in the CKEditor 5 real-time collaboration package. This vulnerability affects user markers, which represent users' positions within...

CVE-2024-28776

IBM Cognos Controller 11.0.0 through 11.0.1 FP3 and IBM Controller 11.1.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2025-0423

In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their...

CVE-2025-0424

Cordaware bestinformed Web is affected by authenticated stored cross-site scripting due to improper input sanitization. An authenticated attacker can inject JavaScript into other users’ sessions, potentially enabling horizontal movement to higher-privileged accounts. The available connected sourc...

CVE-2025-0423 Multiple Unauthenticated Stored Cross-Site Scripting

In the "bestinformed Web" application, some user input was not properly sanitized. This leads to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker is able to compromise the sessions of users on the server by injecting JavaScript code into their...

PT-2025-9550

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a stored crafted link which, when clicked, could potentially execute...

PT-2025-9556

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a stored crafted link which, when clicked, could potentially execute...

PT-2025-9559

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker with high privileges, specifically publisher capabilities, to create a crafted link...

IBM Aspera Shares Cross-Site Scripting Vulnerability (CNVD-2025-04172)

IBM Aspera Shares is a Web application from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Aspera Shares versions 1.9.0 through 1.10.0 PL6. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which...

IBM ApplinX Cross-Site Scripting Vulnerability (CNVD-2025-04170)

IBM ApplinX is an International Business Machines IBM company focused on converting green screen interfaces into modern web-based applications. A cross-site scripting vulnerability exists in IBM ApplinX version 11.1. The vulnerability stems from the application's lack of effective filtering and...

CVE-2024-56882

Sage DPW , an HR system from Sage UK, is vulnerable to Cross-Site Scripting (XSS) in versions prior to 2024_12_000 . The root cause is the unfiltered scripting of input fields, specifically Kurstitel and Kurzinfo . Low-privileged users with employee role privileges can permanently store malicious...

PT-2025-9554

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a stored crafted link which, when clicked, could potentially execute...

PT-2025-9544

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker with high privileges, specifically publisher capabilities, to create a crafted link...

PT-2025-9541

Name of the Vulnerable Software and Affected Versions ArcGIS Server versions 10.9.1 through 11.3 Description The issue is a stored Cross-site Scripting vulnerability that may allow a remote, authenticated attacker to create a stored crafted link which, when clicked, could potentially execute...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2025-04976)

IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2025-04978)

IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. A cross-site scripting...