PT-2026-8001

A cross-site scripting XSS vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Phone Number parameter...

EUVD-2019-6781

Malware in sbrugna...

EUVD-2019-8023

Malware in sbrugna...

CVE-2023-1179

A vulnerability, which was classified as problematic, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. Affected is an unknown function of the component Add Supplier Handler. The manipulation of the argument companyname/province/city/phonenumber leads to cross site...

CVE-2025-48366 GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persisten...

CVE-2025-48366

GroupOffice (Intermesh BV) contains a stored blind XSS in the user profile Phone Number field, exploitable prior to versions 6.8.119 and 25.0.20. The payload can persist and execute when other users view the Address Book, enabling actions like forced redirects and unauthorized fetches. Versions 6...

CVE-2025-48366 GroupOffice's Blind Stored XSS in Phone Number Field Enables Forced Redirect and Unauthorized Actions

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persisten...

CVE-2025-48366: Improper Neutralization of Input During Web Page Generation

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a stored and blind XSS vulnerability exists in the Phone Number field of the user profile within the GroupOffice application. This allows a malicious actor to inject persisten...

UBUNTU-CVE-2024-22122

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem...

Cross site scripting

Multiple Stored XSS Vulnerabilities in the Source Code of iOrder 1.0 allow remote attackers to execute arbitrary code via signup form in the Name and Phone number field...

PT-2021-23846

Name of the Vulnerable Software and Affected Versions iOrder version 1.0 Description The issue allows remote attackers to execute arbitrary code via the signup form in the Name and Phone number fields. This is due to multiple stored XSS vulnerabilities in the source code. Recommendations For iOrd...

CVE-2021-43440: Improper Neutralization of Input During Web Page Generation

Multiple Stored XSS Vulnerabilities in the Source Code of iOrder 1.0 allow remote attackers to execute arbitrary code via signup form in the Name and Phone number field...

CVE-2019-18223

ZOOM International Call Recording 6.3.1 suffers from multiple authenticated stored XSS vulnerabilities via the phoneNumber field in the 1 User Edit or 2 User Add form, 3 name field in the Role Add form, 4 name or number field in the Edit Group form, 5 tagKey or tagValue field in the Recording Rul...

Cross site scripting

The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field...

CVE-2019-15870

The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field...

CVE-2019-15870: Improper Neutralization of Input During Web Page Generation

The CarSpot theme before 2.1.7 for WordPress has stored XSS via the Phone Number field...

Cross site scripting

Cross-site scripting XSS vulnerability in Webasyst Shop-Script 5.2.2.30933 allows remote attackers to inject arbitrary web script or HTML via the phone number field in a new contact to phpecom/index.php/webasyst/contacts/...

PT-2014-8500

Name of the Vulnerable Software and Affected Versions Webasyst Shop-Script version 5.2.2.30933 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the phone number field in a new contact to "phpecom/index.php/webasyst/contacts/"...

CVE-2014-8377: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Webasyst Shop-Script 5.2.2.30933 allows remote attackers to inject arbitrary web script or HTML via the phone number field in a new contact to phpecom/index.php/webasyst/contacts/...

Webasyst Shop Script 5.2.2.30933 Cross Site Scripting

Exploit Title:webasyst shop script stored xss Date: 8/12/2014 Exploit Author: Ankit Bharathan Description: shop-Script 5 Emerging PHP ecommerce framework that helps you increase sales.Feature-rich PHP shopping cart solution & ecommerce framework developed in 2013--2014. One of the leading shoppin...