CVE-2025-22872 Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

CVE-2025-22872 Incorrect Neutralization of Input During Web Page Generation in x/net in golang.org/x/net

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

CVE-2025-22872

CVE-2025-22872 involves the HTML tokenizer and related parsing logic where unquoted attribute values ending with a slash (/) are misinterpreted as self-closing tags. This only affects tags in foreign content (e.g., , ) and can cause incorrect DOM scope during parsing when using the Tokenizer dire...

CVE-2025-3733

CVE-2025-3733 covers a Cross-Site Scripting (XSS) vulnerability in the Drupal baguetteBox.Js integration. The issue stems from improper input neutralization in baguetteBox.Js when used in Drupal. Affected versions are baguetteBox.Js 0.0.0 through 2.0.3 and 3.0.0 through 3.0.0. Remediation, where ...

CVE-2025-22373

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in SicommNet BASEC on SaaS allows Reflected XSS, XSS Through HTTP Query Strings, Rendering of Arbitrary HTML and alternation of CSS Styles This issue affects BASEC: from 14 Dec 2021...

CVE-2025-39577

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS.This issue affects PropertyHive: from n/a through = 2.1.2...

CVE-2025-39581

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themifyme Themify Shortcodes themify-shortcodes allows Stored XSS.This issue affects Themify Shortcodes: from n/a through = 2.1.3...

CVE-2025-39528

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS. This issue affects Rescue Shortcodes: from n/a through 3.1...

CVE-2025-1981

Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready's Invoices module allows for SQL Injection attacks...

CVE-2025-39515

CVE-2025-39515 affects WordPress Attendance Manager. The issue is a stored cross-site scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. Affected versions are Attendance Manager: from n/a through 0.6.2. The public documents describe the root cause...

CVE-2025-39524 WordPress Html5 Audio Player plugin <= 2.2.28 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through = 2.2.28...

CVE-2025-39555

CVE-2025-39555 – WordPress Church Admin plugin stored XSS is confirmed in multiple sources. The vulnerability affects Church Admin versions from unknown (n/a) up to 5.0.23 and arises from improper input neutralization during web page generation, enabling stored XSS. Public references consistently...

CVE-2025-39575 WordPress WPCasa plugin <= 1.3.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPSight WPCasa wpcasa allows Stored XSS.This issue affects WPCasa: from n/a through = 1.3.2...

CVE-2025-39582 WordPress WP Data Access plugin <= 5.5.36 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows DOM-Based XSS.This issue affects WP Data Access: from n/a through = 5.5.36...

CVE-2025-1981 SQL Injection in Ready_

Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready's Invoices module allows for SQL Injection attacks...

CVE-2025-1981 SQL Injection in Ready_

Improper neutralization of input provided by a low-privileged user into a file search functionality in Ready's Invoices module allows for SQL Injection attacks...

CVE-2024-52281

The CVE-2024-52281 issue is a Stored XSS vulnerability in Rancher UI caused by improper neutralization of cluster description input during web page generation. It affects Rancher versions 2.9.0 through before 2.9.4. Successful exploitation could allow a malicious actor to inject and store malicio...

BIT-DRUPAL-2025-3057 Drupal core - Critical - Cross site scripting - SA-CORE-2025-001

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Drupal core allows Cross-Site Scripting XSS.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 before 10.4.3, from 11.0.0 before 11.0.12, from 11.1.0 before 11.1.3...

WordPress plugin Themify Shortcodes 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin WPAdverts 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...