CVE-2025-22219 VMware Aria Operations for Logs stored cross-site scripting vulnerability (CVE-2025-22219)

VMware Aria Operations for Logs contains a stored cross-site scripting vulnerability. A malicious actor with non-administrative privileges may be able to inject a malicious script that can perform stored cross-site scripting may lead to arbitrary operations as admin user...

PT-2025-4036 · Embedai · Embedai

Name of the Vulnerable Software and Affected Versions: EmbedAI affected versions not specified Description: A Stored Cross-Site Scripting issue has been found, allowing an authenticated attacker to inject malicious JavaScript code into a message that will be executed when a user opens the chat...

PT-2025-4397 · Vmware · Vmware Aria Operations For Logs

Name of the Vulnerable Software and Affected Versions: VMware Aria Operation for Logs affected versions not specified Description: The issue is related to a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for Logs may be able to inject ...

Stored Cross-site Scripting (XSS)

librenms/librenms is vulnerable to stored cross-site scripting XSS. The vulnerability is due to improper input sanitization of the state parameter in ajaxform.php, which allows an attacker to inject malicious scripts that execute when a user views or interacts with the affected page...

PT-2025-5518 · Unknown · Sebastian Zaha Magic The Gathering Card Tooltips

Name of the Vulnerable Software and Affected Versions: Sebastian Zaha Magic the Gathering Card Tooltips versions n/a through 3.4.0 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting XSS, which allows for Stored XSS...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the search by tag feature due to missing sanitization on the server side when the tag doesn't exist. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a...

Cross-Site Scripting (XSS)

microweber/microweber is vulnerable to Cross Site Scripting. The vulnerability is due to insufficient input sanitization in the First Name and Last Name parameters, allows untrusted data to be executed as code, enabling the attacker to inject malicious scripts into the application...

CVE-2025-23198 Stored-XSS-LibreNMS-Display-Name in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters Replace $DEVICEID with your specific $DEVICEID value:/device/$DEVICEID/edit - param: display. Librenms versions up to 24.10.1 allow remote attackers to inject...

LibreNMS Misc Section Stored Cross-site Scripting vulnerability

StoredXSS-LibreNMS-MiscSection Description: Stored XSS on the parameter: ajaxform.php - param: state Request: http POST /ajaxform.php HTTP/1.1 Host: X-Requested-With: XMLHttpRequest X-CSRF-TOKEN: Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie:...

LibreNMS Display Name 2 Stored Cross-site Scripting vulnerability

StoredXSS-LibreNMS-Display Name 2 Description: XSS on the parameters Replace $DEVICEID with your specific $DEVICEID value:/device/$DEVICEID/edit - param: display of Librenms versions 24.11.0 https://github.com/librenms/librenms allows remote attackers to inject malicious scripts. When a user view...

CVE-2025-0193 Stored Cross-site Scripting (XSS) Vulnerability in the MGate 5121/5122/5123 Series

A stored Cross-site Scripting XSS vulnerability exists in the MGate 5121/5122/5123 Series firmware version v1.0 because of insufficient sanitization and encoding of user input in the "Login Message" functionality. An authenticated attacker with administrative access can exploit this vulnerability...

Cross-site Scripting (XSS)

Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the error message display mechanism. An attacker can inject malicious scripts that are executed in the user's browser by...

CVE-2025-23031 Cross-Site Scripting (XSS) Stored endpoint 'adicionar_alergia.php' parameter 'nome' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionaralergia.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in...

CVE-2025-22616

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the dependenteparentescoadicionar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicio...

CVE-2025-22616 WeGIA Cross-Site Scripting (XSS) Stored endpoint 'dependente_parentesco_adicionar.php' parameter 'descricao'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the dependenteparentescoadicionar.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicio...

CVE-2025-22618 WeGIA Cross-Site Scripting (XSS) Stored endpoint 'adicionar_cargo.php' parameter 'cargo'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarcargo.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into...

CVE-2025-23108

Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnerability was fixed in Firefox for iOS 134...

CVE-2025-23108

Summary (CVE-2025-23108) : Affects Firefox for iOS ≤ 134. Opening a JavaScript link in a new tab via long-press could allow a malicious script to spoof the URL shown in the new tab, potentially misleading users. Root cause described as a tab URL spoofing issue in the iOS client. Exploitation deta...

CVE-2025-23108 Firefox Mobile iOS Full Address Bar Spoof Using Open in New Tab and Javascript URI

Opening Javascript links in a new tab via long-press in the Firefox iOS client could result in a malicious script spoofing the URL of the new tab. This vulnerability was fixed in Firefox for iOS 134...

Rails 安全漏洞

Rails is a set of open source web application frameworks based on the Ruby language by the US-based Rails team. A security vulnerability exists in Rails that stems from the presence of a DOM-based cross-site scripting vulnerability that allows an attacker to inject malicious script into a victim'...