Cadwyn vulnerable to XSS on the docs page

Summary The version parameter of the /docs endpoint is vulnerable to a Reflected XSS Cross-Site Scripting attack. PoC 1. Setup a minimal app following the quickstart guide: https://docs.cadwyn.dev/quickstart/setup/ 2. Click on the following PoC link:...

CVE-2025-7369

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.4.2. This is due to missing or incorrect nonce validation on the preview function. This makes it possible for unauthenticated attackers to execut...

CVE-2025-7920

CVE-2025-7920 describes a reflected Cross-site Scripting vulnerability in the WinMatrix3 Web package from Simopro Technology. The issue arises from lack of proper filtering/escaping of user-supplied data, enabling unauthenticated attackers to induce a user to execute arbitrary JavaScript in the b...

CVE-2025-7920 Simopro Technology｜WinMatrix3 Web package - Reflected Cross-Site Scripting

WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-7920 Simopro Technology｜WinMatrix3 Web package - Reflected Cross-Site Scripting

WinMatrix3 Web package developed by Simopro Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2020-26799

A reflected cross-site scripting XSS vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' data...

CVE-2025-54077 WeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'personalizacao.php' parameter 'err'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in versions prior to 3.4.6 in the personalizacao.php endpoint of the WeGIA application. This vulnerability allows attackers to...

CVE-2025-54076 WeGIA Reflected Cross-Site Scripting (XSS) vulnerability in endpoint 'pre_cadastro_atendido.php' parameter 'msg_e'

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in versions prior to 3.4.6 in the precadastroatendido.php endpoint of the WeGIA application. This vulnerability allows attacke...

CVE-2025-31055

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in vergatheme Electrician - Electrical Service WordPress electrician allows Reflected XSS.This issue affects Electrician - Electrical Service WordPress: from n/a through = 1.0...

CVE-2024-10029

In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console...

CVE-2025-6977

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘pmgetmessengernotification’ function in all versions up to, and including, 5.9.5.4 due to insufficient input sanitization and output escaping. This makes it possib...

PT-2025-30024 · Rsjoomla · Rsmail!

Name of the Vulnerable Software and Affected Versions: RSMail! versions 1.19.20 through 1.22.26 Description: A reflected cross-site scripting XSS issue exists in the RSMail! component for Joomla. The issue allows remote attackers to inject arbitrary web script or HTML via a manipulated parameter...

PT-2025-30085 · Agorum Software Gmbh · Agorum Core

Name of the Vulnerable Software and Affected Versions: agorum Software GmbH Agorum core open versions 11.9.2 and 11.10.1 Description: The software contains a reflected cross-site scripting XSS issue. Recommendations: Update to a newer version that addresses this issue...

CVE-2025-52169

agorum Software GmbH Agorum core open v11.9.2 & v11.10.1 was discovered to contain a reflected cross-site scripting XSS vulnerability...

CVE-2025-53904

CVE-2025-53904 concerns The Scratch Channel (a news site under development) with a potential reflected Cross-Site Scripting (XSS) vulnerability in the file /api/admin.js. The issue arises from code in that file that could allow XSS, as described across multiple sources (NVD/Red Hat/CVE list). The...

CVE-2025-53932

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the cadastroadotante.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers to...

CVE-2025-53936

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the personalizacaoselecao.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers...

CVE-2025-53936 WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint `personalizacao_selecao.php` parameter `nome_car`

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the personalizacaoselecao.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers...

CVE-2025-53935 WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint `personalizacao_selecao.php` parameter `id`

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the personalizacaoselecao.php endpoint of the WeGIA application prior to version 3.4.5. This vulnerability allows attackers...

CVE-2025-53935

WeGIA is an open‑source web manager for welfare organizations. A Reflected Cross‑Site Scripting (XSS) vulnerability exists in the personalizacao_selecao.php endpoint, exploitable via the id parameter, affecting versions prior to 3.4.5. Version 3.4.5 includes a fix. The issue is confirmed across m...