CVE-2025-57393

A stored cross-site scripting XSS in Kissflow Work Platform Kissflow Application Versions 7337 Account v2.0 to v4.2vallows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

CVE-2025-60991

A reflected cross-site scripted XSS vulnerability in Codazon Magento Themes v1.1.0.0 to v2.4.7 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload injected into the cat parameter...

WordPress plugin Any News Ticker 跨站脚本漏洞

WordPress Any News Ticker plugin is a functional plugin for adding dynamic scrolling news tickers to your website. WordPress Any News Ticker plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of any-ticker, which can...

IBM Planning Analytics Local 跨站脚本漏洞

IBM Planning Analytics Local is a web-based local architecture from International Business Machines IBM. IBM Planning Analytics Local suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, which can be...

Rems Employee Management System 安全漏洞

Rems Employee Management System is an employee management system from Rems, Inc. A security vulnerability exists in Rems Employee Management System version 1.0, which originates from the injection of a malicious payload into the department name field and could lead to a clickjacking attack...

JNDIExploit

This is a Java-based exploit tool for JNDI Java Naming and Directory Interface injection vulnerabilities. The tool is designed to inject a payload into the JNDI repository, allowing an attacker to execute arbitrary code on the target system. The tool is based on the Rogue JNDI project and support...

CVE-2025-45585

Multiple stored cross-site scripting XSS vulnerabilities in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the wifistassid or wifiapssid parameters...

Audi UTR 2.0 安全漏洞

Audi UTR 2.0 is an in-vehicle car recording system from Audi Germany. A security vulnerability exists in Audi UTR 2.0 that originates from the injection of a specially crafted payload in the wifistassid or wifiapssid parameter, which could lead to a stored cross-site scripting attack...

PT-2025-37349

Name of the Vulnerable Software and Affected Versions: Audi UTR 2.0 Universal Traffic Recorder version 2.0 Description: The software contains multiple stored cross-site scripting XSS vulnerabilities. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the wifi...

Stored Cross-site Scripting (XSS)

moonshine/moonshine is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper input validation in the Create Article function’s Link parameter, which allows an attacker to inject a crafted payload and execute arbitrary web scripts or HTML...

PT-2025-36793

Name of the Vulnerable Software and Affected Versions: Proxmox Virtual Environment versions 8.4 Description: A stored cross-site scripting XSS vulnerability exists in the U2F Origin field of the Datacenter configuration. Authenticated users can store malicious input which is rendered unsafely in...

WordPress plugin Add Code To Head cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Add Code To Head exists cross-site scripting vulnerability, the vulnerability stems fro...

WordPress plugin Add Code To Head 跨站脚本漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Add Code To Head exists cross-site scripting vulnerability, the vulnerability stems fro...

CVE-2025-55618

The Hyundai Navigation App (version STD5W.EUR.HMC.230516.afa908d ) is vulnerable to an HTML injection flaw due to improper neutralization of input during web page generation. An attacker can inject HTML payloads into the profile name field, which are subsequently rendered by the application. To m...

CVE-2025-6791 Second order SQL injection available to user with low privilege

In the monitoring event logs page, it is possible to alter the http request to insert a reflect payload in the DB. Caused by an Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Centreon web Monitoring event logs modules allows SQL Injection.This...

BIT-SUPERSET-2025-55672 Apache Superset: Stored XSS on charts metadata

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

CVE-2025-55672

A stored Cross-Site Scripting XSS vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they...

WordPress plugin Anber Elementor Addon 跨站脚本漏洞

WordPress Anber Elementor Addon plugin is an Elementor plugin extension for WordPress, designed to provide more customization for website design. WordPress Anber Elementor Addon plugin suffers from a cross-site scripting vulnerability that stems from insufficient parameter input cleanup, which ca...

WordPress plugin Blocksy 跨站脚本漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin Blocksy 2.1.6 and previous versions of cross-site scripting vulnerability , the...

CVE-2025-45316

A cross-site scripting XSS vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter...