CVE-2024-12385

The CVE-2024-12385 entry concerns the WP Abstracts WordPress plugin. The connected Red Hat entry confirms a Cross-Site Request Forgery flaw in WP Abstracts up to version 2.7.2, caused by missing nonce validation in wpabstracts_load_status() and wpabstracts_delete_abstracts(). This could allow una...

Cross-site Scripting (XSS)

github.com/rancher/rancher is vulnerable to Cross-site Scripting XSS. The vulnerability is due to a Stored XSS attack, which occurs when a malicious actor can inject and store malicious scripts via the cluster description field, leading to potential execution of unauthorized code within the UI...

CVE-2025-23200 Stored XSS-LibreNMS-Misc Section in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: ajaxform.php - param: state. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page...

CVE-2025-23200

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: "ajaxform.php" - param: state. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page...

CVE-2025-23200 Stored XSS-LibreNMS-Misc Section in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: ajaxform.php - param: state. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page...

Librenms has a reflected XSS on error alert

XSS on the parameters:/addhost - param: community of Librenms versions 24.10.1 https://github.com/librenms/librenms allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potentia...

GHSA-G84X-G96G-RCJC Librenms has a reflected XSS on error alert

XSS on the parameters:/addhost - param: community of Librenms versions 24.10.1 https://github.com/librenms/librenms allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potentia...

LibreNMS Ports Stored Cross-site Scripting vulnerability

StoredXSS-LibreNMS-Ports Description: Stored XSS on the parameter: /ajaxform.php - param: descr Request: http POST /ajaxform.php HTTP/1.1 Host: X-Requested-With: XMLHttpRequest X-CSRF-TOKEN: Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie:...

LibreNMS Display Name Stored Cross-site Scripting vulnerability

Description: XSS on the parameters Replace $DEVICEID with your specific $DEVICEID value:/device/$DEVICEID/edit - param: display of Librenms versions 24.9.0, 24.10.0, and 24.10.1 https://github.com/librenms/librenms allows remote attackers to inject malicious scripts. When a user views or interact...

GHSA-PM8J-3V64-92CQ LibreNMS Display Name Stored Cross-site Scripting vulnerability

Description: XSS on the parameters Replace $DEVICEID with your specific $DEVICEID value:/device/$DEVICEID/edit - param: display of Librenms versions 24.9.0, 24.10.0, and 24.10.1 https://github.com/librenms/librenms allows remote attackers to inject malicious scripts. When a user views or interact...

PT-2025-5206

Name of the Vulnerable Software and Affected Versions Incredible Font Awesome versions n/a through 1.0 Description The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject maliciou...

PT-2025-5128

Name of the Vulnerable Software and Affected Versions Rene Hermenau QR Code Generator versions 1.2.6 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject...

PT-2025-5219

Name of the Vulnerable Software and Affected Versions MeinTurnierplan.de Widget Viewer versions n/a through 1.1 Description The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS, where an attacker can...

PT-2025-4684

Name of the Vulnerable Software and Affected Versions WP Post Corrector versions 1.0.2 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows Reflected XSS. This means that an attacker can inject malicious scripts into the website...

CVE-2024-50859

The ipimportaclcsv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data...

CVE-2025-23033

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarsituacao.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts...

CVE-2025-23037

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the control.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the...

CVE-2025-23030 Cross-Site Scripting (XSS) Reflected endpoint 'cadastro_funcionario.php' parameter 'cpf' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the cadastrofuncionario.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious...

CVE-2025-23031 Cross-Site Scripting (XSS) Stored endpoint 'adicionar_alergia.php' parameter 'nome' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionaralergia.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in...

CVE-2025-23035 Cross-Site Scripting (XSS) Stored endpoint 'adicionar_tipo_quadro_horario.php' parameter 'tipo' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionartipoquadrohorario.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious...