PT-2025-7186

Name of the Vulnerable Software and Affected Versions: sureshdsk Bootstrap collapse versions 1.0.0 through 1.0.4 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS in sureshdsk Bootstrap...

PT-2025-7188

Name of the Vulnerable Software and Affected Versions: Aparat Responsive versions n/a through 1.3 Description: The issue is related to improper neutralization of input during web page generation, allowing DOM-Based XSS. This enables an attacker to inject malicious scripts into the website,...

WordPress plugin Yottie Lite has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-7187

Name of the Vulnerable Software and Affected Versions: Naver Syndication V2 versions 0.8.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can inject malicio...

PT-2025-7197

Name of the Vulnerable Software and Affected Versions: Google Drive WP Media versions prior to 2.4.4 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject malicious...

PT-2025-7180

Name of the Vulnerable Software and Affected Versions: petkivim Embed Google Map versions n/a through 3.2 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Stored XSS in petkivim Embed Google Map...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the X-Islandora-Args header. An attacker can execute arbitrary code on the server by sending a crafted request containing malicious inp...

Progress Telerik UI command injection vulnerability

Progress Telerik UI is a suite of UI user interface controls for application development from Progress, Inc. A command injection vulnerability exists in Progress Telerik UI prior to version 2025 Q1, which stems from a command injection attack that can be performed by incorrectly neutralizing...

CVE-2024-13543: Improper Neutralization of Input During Web Page Generation

The Zarinpal Paid Download WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Fortinet FortiWeb operating system command injection vulnerability

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning, and other attacks to secure web applications and protect sensitive database content. Fortinet FortiWeb suffers from an operating...

CVE-2025-25105

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in coffeestudios Pop Up popup-seo-optimized allows Stored XSS.This issue affects Pop Up: from n/a through = 0.1...

CVE-2025-22653

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tuyennv Music Press Pro music-press-pro allows Stored XSS.This issue affects Music Press Pro: from n/a through = 1.4.6...

CVE-2025-22664

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through = 5.1.3.5...

CVE-2024-52882

An issue was discovered in AudioCodes One Voice Operations Center OVOC before 8.4.582. Due to improper neutralization of input via the devices API, an attacker can inject malicious JavaScript code XSS to attack logged-in administrator sessions...

CVE-2025-25159

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in robertkolatzek WP doodlez wpdoodlez allows Stored XSS.This issue affects WP doodlez: from n/a through = 1.0.10...

CVE-2025-25117

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Alex Polonski Smart Countdown FX smart-countdown-fx allows Stored XSS.This issue affects Smart Countdown FX: from n/a through = 1.5.5...

CVE-2025-25098

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Zack Katz Links in Captions links-in-captions allows Stored XSS.This issue affects Links in Captions: from n/a through = 1.2...

CVE-2025-25078

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Andrew Norcross Google Earth Embed google-earth-tours allows Stored XSS.This issue affects Google Earth Embed: from n/a through = 1.0...

CVE-2025-25159

CVE-2025-25159 affects the WordPress plugin WP doodlez. The vulnerability is a Stored Cross-Site Scripting (XSS) due to improper input neutralization during web page generation, impacting WP doodlez versions up to 1.0.10. The available connected documents confirm affected software and the XSS nat...

CVE-2025-25105 WordPress Pop Up Plugin <= 0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in coffeestudios Pop Up allows Stored XSS. This issue affects Pop Up: from n/a through 0.1...