CVE-2025-45314

A cross-site scripting XSS vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function...

CVE-2025-45314

A cross-site scripting XSS vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function...

CVE-2025-45315

A cross-site scripting XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter...

CVE-2025-51629

A cross-site scripting XSS vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Temp parameter...

CVE-2025-51629

A cross-site scripting (XSS) vulnerability exists in the PdfViewer component of Agenzia Impresa Eccobook version 2.81.1 . The flaw is caused by the improper handling of the Temp parameter, which allows an attacker to inject a crafted payload to execute arbitrary web scripts or HTML. As a temporar...

When Good Sounds Go Adversarial: Jailbreaking Audio-Language Models with Benign Inputs

As large language models become increasingly integrated into daily life, audio has emerged as a key interface for human-AI interaction. However, this convenience also introduces new vulnerabilities, making audio a potential attack surface for adversaries. Our research introduces WhisperInject, a...

CVE-2025-26065

A cross-site scripting XSS vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a visiting Wi-Fi network...

CVE-2025-45778

A stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description text field...

📄 SeoToaster 2.5.0 Cross Site Scripting

SeoToaster version 2.5.0 suffers from multiple persistent cross site scripting vulnerabilities. Exploit Title: Stored XSS "Edit Header" Functionality - seotoasterv2.5.0 Date: 07/2025 Exploit Author: Andrey Stoykov Version: 2.5.0 Tested on: Debian 12 Blog: https://msecureltd.blogspot.com/ Stored X...

WordPress Gutentor plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. WordPress Gutentor plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, whi...

Emby Windows 跨站脚本漏洞

Emby Windows is a media playback application for the Windows platform developed by Emby LLC that supports Windows 10, 11 and later systems. Emby Windows suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied...

Simple forum /forum_edit1.php file cross-site scripting vulnerability

Simple forum is a simple forum. Simple forum suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter text in the file /forumedit1.php, which can be exploited by an attacker to execute arbitrary Web scrip...

iOS Activation Flaw Enables Pre-User Device Compromise

A critical vulnerability exists in Apple’s iOS activation pipeline that allows remote XML payload injection before the user ever interacts with the device...

📄 TinyWebGallery 2.7 Cross Site Scripting

TinyWebGallery version 2.7 suffers from a persistent cross site scripting vulnerability. Exploit Title: TinyWebGallery 2.7 - Authenticated Stored XSS Date: 2025-27-06 Exploit Author: tmrswrr Vendor Homepage: https://www.tinywebgallery.com Version: 2.7 Tested on:...

Exploit for Improper Check for Unusual or Exceptional Conditions in Mozilla Firefox

CVE-2024-4367 POC for PDF.js POC for PDF.js' CVE-2024-4367 vu...

School Fees Payment System branch.php file cross-site scripting vulnerability

School Fees Payment System is a tuition payment system. School Fees Payment System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter Branch/Address/Detail in the file /branch.php, which can be...

WordPress plugin Arconix Shortcodes 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Arconix Shortcodes plugin that originates from an improper neutralization and can be exploited by an attacker to...

WordPress plugin Click to Chat 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Click to Chat plugin, which stems from insufficient input cleanup and escaping, and can be exploited by an attacker ...

CVE-2025-28380

A cross-site scripting XSS vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter...

CVE-2024-37396

A stored cross-site scripting XSS vulnerability in the Calendar function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Notes' field of a calendar event. This could lead to the execution of malicious scripts when the...