Reflected Cross-Site Scripting (Reflected XSS)

laravel/framework is vulnerable to Reflected Cross-Site Scripting Reflected XSS. The vulnerability is due to improper encoding of route parameters in the debug-mode error page, allows an attacker to inject and execute malicious scripts in a victim’s browser by tricking them into visiting a...

SAP NetWeaver Application Server 跨站脚本漏洞

SAP NetWeaver Application Server ABAP is an application server from SAP for running ABAP applications. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server ABAP that originates from allowing malicious scripts to be executed within the application. An attacker can exploi...

PT-2025-10667

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description The issue allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting XSS vulnerability. This has no impact on the...

Cross-site Scripting (XSS)

redaxo/source is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of the rex-api-result parameter due to insufficient input validation, allowing attackers to inject malicious scripts on the AddOns page...

Stored Cross-site Scripting (XSS)

github.com/matrix-org/pinecone is vulnerable to stored Stored Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user input, allowing malicious scripts to be stored and later executed when accessed by users...

Linux Distros Unpatched Vulnerability : CVE-2022-46165

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Syncthing is an open source, continuous file synchronization program. In versions prior to 1.23.5 a compromised instance with shared folders could sync maliciou...

Linux Distros Unpatched Vulnerability : CVE-2023-29455

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Reflected XSS attacks, also known as non-persistent attacks, occur when a malicious script is reflected off a web application to the victim's browser. The scrip...

PT-2025-9871 · Unknown · Unifiedtransform

Name of the Vulnerable Software and Affected Versions: Unifiedtransform version 2.0 Description: The issue is related to Cross Site Scripting XSS in the Create assignment function, allowing attackers to execute malicious scripts in the context of other users. Recommendations: For Unifiedtransform...

PT-2025-9443

Name of the Vulnerable Software and Affected Versions Theme Options Z versions 1.4 and earlier Description The issue is related to improper neutralization of input during web page generation, which leads to a Stored XSS vulnerability. This allows for the storage of malicious scripts in the...

PT-2025-9397

Name of the Vulnerable Software and Affected Versions Login Watchdog versions 1.0.4 and earlier Description The issue is related to improper neutralization of input during web page generation, which leads to a Stored XSS vulnerability. This allows for the storage of malicious scripts in the...

CVE-2025-25477

A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be executed in the victim's browser...

Stored Cross-site Scripting (XSS)

leantime/leantime is vulnerable to Stored Cross-site Scripting XSS. The vulnerability is due to improper input sanitization and output encoding, allowing attackers to inject malicious scripts that get stored and executed when retrieved by users...

Cross-site Scripting (XSS)

leantime/leantime is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input validation due to the lack of sanitization of the $GET"id" parameter, allowing an attacker to inject malicious scripts...

Stored Cross-site Scripting (XSS)

moodle/moodle is vulnerable to Stored Cross-site Scripting XSS. The vulnerability is due to insufficient sanitization of user-inputted data in the site administration live log, allowing malicious scripts to be stored and executed when viewed...

Reflected Cross-site Scripting (XSS)

github.com/oxyno-zeta/s3-proxy is vulnerable to Reflected Cross-site Scripting XSS. The vulnerability is due to improper input sanitization in the folder-list template, allowing attackers to inject malicious scripts through the Request.URL.Path variable...

PT-2025-7832 · Unknown · Rustaurius Front End Users

Name of the Vulnerable Software and Affected Versions: Rustaurius Front End Users versions 3.2.30 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Stored XSS vulnerability. This allows for the storage of malicious scrip...

Moodle 安全漏洞

Moodle is an open source e-learning software platform, also known as a course management system, learning management system or virtual learning environment. A cross-site scripting vulnerability exists in Moodle. The vulnerability stems from insufficient cleanup and leads to a cross-site scripting...

PT-2025-7621

Name of the Vulnerable Software and Affected Versions Social Warfare versions n/a through 4.5.4 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker could...

Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)

Summary A cross-site scripting XSS vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not...

GHSA-V4Q9-437P-MHPG Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)

Summary A cross-site scripting XSS vulnerability has been identified in Leantime. The vulnerability allows an attacker to inject malicious scripts into certain fields, potentially leading to the execution of arbitrary code or unauthorized access to user-sensitive information. The code does not...