CVE-2025-27406

Technical details (affected products, versions, root cause, exploit vectors) are not provided in the connected documents. Monitor for updates.

CVE-2025-27406

Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present in versions 0.10.0 through 1.0.2 allows to set up a template that allows to embed arbitrary Javascript. This enables the attacker to act...

CVE-2025-27404

Icinga Web 2 is affected by CVE-2025-27404. Affected versions are prior to 2.11.5 and 2.12.13, where an attacker can craft a URL that, when visited by any user, allows embedding arbitrary JavaScript into Icinga Web and acting on behalf of that user. The issue is mitigated by upgrading to 2.11.5 o...

CVE-2025-2536

Cross-site scripting XSS vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 82 through update 92 in the Frontend JS module's...

CVE-2025-30143

CVE-2025-30143 affects Akamai App & API Protector (with Akamai ASE) prior to 2024-12-10, where Rule 3000216 does not correctly handle JavaScript variable assignments to built-in functions/properties. The root cause is the mis-evaluation of such assignments, enabling bypass risks in the WAF logic....

Atlassian Plugin People Enterprise Mail Handler for Jira Data Center 安全漏洞

Atlassian Plugin People Enterprise Mail Handler for Jira Data Center is an enterprise message handling plugin from Atlassian Australia. A security vulnerability exists in Atlassian Plugin People Enterprise Mail Handler for Jira Data Center versions prior to 4.1.69-dc. An attacker can exploit this...

Esri ArcGIS Server Cross-Site Scripting Vulnerability (CNVD-2025-05058)

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

CVE-2025-26091

A Cross Site Scripting XSS vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the 'name' parameter when creating a new password in the "My...

Vega 跨站脚本漏洞

Vega is a Javscript-based software from the Vega team that can be used to create interactive visual displays. The software can describe data visualizations using JSON format and generate interactive views using HTML5 Canvas or SVG. Vega suffers from a cross-site scripting vulnerability that stems...

CVE-2024-11831

CVE-2024-11831 is a deserialization/XSS issue in the npm-serialize-javascript package. The impact is described as attackers potentially executing malicious code when serialized data is deserialized by a web browser. Connected docs confirm multiple vendors referencing this CVE: IBM Storage Ceph St...

CVE-2024-49793

Summary: CVE-2024-49793 affects IBM ApplinX 11.1 and is described as a cross-site scripting (XSS) vulnerability in the Web UI that could allow an authenticated user to inject arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. The root cause is improper h...

Prototype Pollution

Overview org.webjars.bower:php-date-formatter is an A Javascript datetime formatting and manipulation library using PHP date-time formats. Affected versions of this package are vulnerable to Prototype Pollution in php-date-formatter.js. Details Prototype Pollution is a vulnerability affecting...

CVE-2022-24358

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2022-37350

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CVE-2024-47610

InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for a registered user to store javascript in markdown notes fields, which are then displayed to other logged in users who visit the same page and executed. The vulnerability has been addresse...

CVE-2024-40700

IBM Security Verify Access Appliance and Container 10.0.0–10.0.8 are affected by CVE-2024-40700, a cross-site scripting flaw allowing an unauthenticated attacker to inject arbitrary JavaScript into the Web UI, potentially leading to credentials disclosure within a trusted session. Root cause: imp...

CVE-2024-47116

IBM Sterling B2B Integrator Standard Edition is affected by CVE-2024-47116: versions 6.0.0.0–6.1.2.5 and 6.2.0.0–6.2.0.3 are vulnerable to cross-site scripting. An authenticated user can embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted sessi...

Prototype Pollution

Overview org.webjars.bowergithub.shprink:canvg is a JavaScript SVG parser and renderer on Canvas. Affected versions of this package are vulnerable to Prototype Pollution in the StyleElement constructor. PoC js async = // Assuming import is set up properly import StyleElement from 'canvg'; // Outp...

CVE-2024-51457 IBM Robotic Process Automation for Cloud Pak cross-site scripting

IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.19 and 23.0.0 through 23.0.19 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

aEnrich a+HRD 跨站脚本漏洞

aEnrich a+HRD is a full-service human resources development solution from Acer aEnrich China. A cross-site scripting vulnerability exists in aEnrich a+HRD 7.5 and earlier versions, which stems from the presence of a reflective cross-site scripting vulnerability that allows attackers to execute...