CVE-2025-5921 SureForms < 1.7.2 - Reflected XSS

The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both authenticated and unauthenticated users...

PT-2025-31616 · WordPress · Sureforms

Name of the Vulnerable Software and Affected Versions: SureForms WordPress plugin versions prior to 1.7.2 Description: The SureForms WordPress plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue. This can be...

CVE-2025-51501

Microweber CMS2.0 is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw in the id parameter of the live_edit.module_settings API endpoint. This vulnerability allows an attacker to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. Practical con...

Exploit for CVE-2025-54589

CVE-2025-54589 – Copyparty Reflected XSS Author: Byte Rea...

CVE-2025-54589

Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter parameter to the URL, which reflects its value directly into a block without proper escaping...

CVE-2025-54589

Copyparty ≤1.18.6 is vulnerable to reflected XSS via the filter parameter on the /?ru endpoint. The input is echoed into a script block without proper escaping, enabling arbitrary JavaScript execution in victim browsers for both authenticated and unauthenticated users. The issue is fixed in versi...

copyparty Reflected XSS via Filter Parameter

Summary Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the filter parameter containing JavaScript code. Details When accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter...

GHSA-8MX2-RJH8-Q3JQ copyparty Reflected XSS via Filter Parameter

Summary Unauthorized reflected Cross-Site-Scripting when accessing the URL for recent uploads with the filter parameter containing JavaScript code. Details When accessing the recent uploads page at /?ru, users can filter the results using an input field at the top. This field appends a filter...

CVE-2025-36563: Improper Neutralization of Input During Web Page Generation

Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script may be executed on the browser...

PT-2025-31523

Name of the Vulnerable Software and Affected Versions Copyparty versions 1.18.6 and below Description Copyparty is a portable file server susceptible to a reflected Cross-Site Scripting XSS issue. When accessing the recent uploads page at /?ru, the application does not properly escape user-suppli...

CVE-2025-32731

A reflected cross-site scripting xss vulnerability exists in the radiationDoseReport.php functionality of meddream MedDream PACS Premium 7.3.5.860. A specially crafted malicious url can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerabilit...

PT-2025-31194

Name of the Vulnerable Software and Affected Versions Human Resource Management System version 1.0 Description Reflected Cross-Site Scripting XSS exists in Human Resource Management System version 1.0. This issue could allow an attacker to execute JavaScript code in the victim's browser by sendin...

CVE-2025-32731

A reflected cross-site scripting xss vulnerability exists in the radiationDoseReport.php functionality of meddream MedDream PACS Premium 7.3.5.860. A specially crafted malicious url can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerabilit...

CVE-2025-32731

Talos-disclosed CVE-2025-32731 is a pre-auth reflected XSS in MedDream PACS Premium 7.3.5.860, specifically in the radiationDoseReport.php script. The vulnerability stems from the path parameter being written into HTML output without sanitization, enabling a crafted URL to execute arbitrary JavaS...

CVE-2025-6588

The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-5084

The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘argsArray'readmoretext'’ parameter in all versions up to, and including, 3.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2025-7022

The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

SonicWall Secure Mobile Access < 10.2.2.1-90sv (SNWLID-2025-0012)

The version of SonicWall Secure Mobile Access installed on the remote host is prior to 10.2.2.1-90sv. It is, therefore, affected by multiple vulnerabilities as referenced in the SNWLID-2025-0012 advisory: - A Reflected cross-site scripting XSS vulnerability exists in the SMA100 series web...

CVE-2025-43484

A potential reflected cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website does not validate or sanitize the user input before rendering it in the response. HP has addressed the issue in the latest software update...

CVE-2025-6588

The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...