Moderec Tourtella SQL注入漏洞

Moderec Tourtella is a software application from the Turkish company Moderec. Moderec Tourtella suffers from a SQL injection vulnerability that stems from improper neutralization of special elements, which could lead to a SQL injection attack...

CVE-2025-4700 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS...

CVE-2025-4700 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific circumstances, could have potentially allowed a successful attacker to trigger unintended content rendering leading to XSS...

CVE-2025-7716

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripting XSS.This issue affects Real-time SEO for Drupal: from 2.0.0 before 2.2.0...

CVE-2025-41674

A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...

GHSA-4J66-8F4R-3PJX bun vulnerable to OS Command Injection

All versions of the package bun are vulnerable to Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in the $ shell API due to improper neutralization of user input. An attacker can exploit this by providing specially crafted input that includes command-line...

CVE-2024-53288

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in NTP Region functionality in Synology Router Manager SRM before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified...

CVE-2024-53287

Synology Router Manager (SRM) is affected by CVE-2024-53287: an XSS in the VPN Setting functionality where improper input neutralization during web page generation allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. Affec...

WordPress Plugin Infility Global Cross-Site Scripting Vulnerability

WordPress is a set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers, WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress plugin Infility Global, which stems from improper...

CVE-2025-43488: Improper Neutralization of Input During Web Page Generation

A potential security vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.2. The vulnerability could allow a bypass of the application's XSS filter by submitting untrusted characters. HP has addressed the issue in the latest software update...

WordPress Bold Page Builder Cross-Site Scripting Vulnerability

WordPress Bold Page Builder is a free and open source page builder plugin that allows users to quickly create custom page layouts through a drag and drop interface without writing code. WordPress Bold Page Builder suffers from a cross-site scripting vulnerability that originates from improper inp...

WordPress JetPopup Cross-Site Scripting Vulnerability

WordPress JetPopup is an Elementor plugin designed for WordPress, which is mainly used to create various popups e.g. subscription forms, offer banners, etc., and supports a variety of triggers and template customization. WordPress JetPopup suffers from a cross-site scripting vulnerability that...

WordPress ELEX WooCommerce Advanced Bulk Edit Products,Prices&Attributes SQL Injection Vulnerability

WordPress ELEX WooCommerce Advanced Bulk Edit Products,Prices&Attributes is a plugin for bulk editing of WooCommerce product information, prices and attributes with support for Simple, Variant, External and Bundled products. WordPress ELEX WooCommerce Advanced Bulk Edit Products,Prices&Attributes...

WordPress WP Delicious Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress WP Delicious, which stems from improper input neutralization, and can be exploited by attackers to tamper with web...

CVE-2025-43486: Improper Neutralization of Input During Web Page Generation

A potential stored cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website allows user input to be stored and rendered without proper sanitization. HP has addressed the issue in the latest software update...

WordPress Pay with Contact Form 7 Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Pay with Contact Form 7, which stems from improper input neutralization, and can be exploited by an attacker to...

CVE-2025-46383

CWE-79 Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting'...

CVE-2025-4294

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in HotelRunner B2B allows Cross-Site Scripting XSS. This issue affects B2B: before 04.06.2025...

CVE-2025-4294

CVE-2025-4294: HotelRunner B2B has an XSS flaw due to improper neutralization of input during web page generation in versions prior to 04.06.2025. Affects HotelRunner B2B; impact is Cross-Site Scripting with potential user interaction required. Remediation: update to version 04.06.2025 or later. ...

CVE-2025-53472

ELECOM WRC-BE36QS-B and WRC-W701-B have an OS command injection vulnerability in the WebGUI caused by improper neutralization of special elements. A remote attacker who can log in to WebGUI may execute arbitrary OS commands. Impact is described as high (possible remote code execution); exploitati...