CVE-2025-49266 WordPress Ultimate Reviews plugin <= 3.2.14 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Rustaurius Ultimate Reviews allows Reflected XSS. This issue affects Ultimate Reviews: from n/a through 3.2.14...

CVE-2025-49316 WordPress WP2LEADS plugin <= 3.5.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through = 3.5.0...

CVE-2025-48993 Group-Office vulnerable to reflected XSS via Look and Feel Formatting input

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web applicatio...

CVE-2025-48993

Group-Office (enterprise CRM/groupware) is affected by a reflected XSS via the Look and Feel Formatting fields. The issue arises because input in these fields is not properly sanitized. Affected versions: before 6.8.123 and before 25.0.27. Patches exist: 6.8.123 and 25.0.27. Remediation: upgrade ...

CVE-2025-48993 Group-Office vulnerable to reflected XSS via Look and Feel Formatting input

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.123 and 25.0.27, a malicious JavaScript payload can be executed via the Look and Feel formatting fields. Any user can update their Look and Feel Formatting input fields, but the web applicatio...

CVE-2025-40729

Reflected Cross-Site Scripting XSS in /customersupport/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code via the page parameter...

CVE-2025-40729 Reflected Cross-Site Scripting (XSS) vulnerability in Customer Support System

Reflected Cross-Site Scripting XSS in /customersupport/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code via the page parameter...

CVE-2025-40727

Consolidated findings for CVE-2025-40727: The Phoenix Site CMS contains a Reflected XSS vulnerability in the /search endpoint, exploitable via the s GET parameter. The root cause is reflected input being echoed unsafely, enabling remote attackers to execute arbitrary code in the context of the af...

CVE-2025-40727 Reflected Cross-Site Scripting (XSS) in Phoenix CMS

A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...

CVE-2025-40727 Reflected Cross-Site Scripting (XSS) in Phoenix CMS

A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...

PT-2025-25532 · Nosto · Nosto

Name of the Vulnerable Software and Affected Versions: Nosto affected versions not specified Description: A Reflected Cross-Site Scripting XSS issue exists in the /pages/search-results-page endpoint of Nosto. This allows remote attackers to execute arbitrary code via the q GET request parameter...

PT-2025-25534

Name of the Vulnerable Software and Affected Versions Customer Support System version 1.0 Description The issue is related to a Reflected Cross-Site Scripting XSS in the /customer support/index.php endpoint, which allows remote attackers to execute arbitrary code via the page parameter. This...

PT-2025-25529 · Unknown · Phoenix Site Cms

Name of the Vulnerable Software and Affected Versions: Phoenix Site CMS versions affected versions not specified Description: A Reflected Cross Site Scripting XSS issue was found in the "/search" endpoint, allowing remote attackers to execute arbitrary code via the s GET parameter. Recommendation...

CVE-2025-5301

ONLYOFFICE Docs DocumentServer in versions equal and below 8.3.1 are affected by a reflected cross-site scripting XSS issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response...

Exploit for CVE-2025-46181

CVE-2025-46181 - Reflected XSS in an Online Appointment Bookin...

PT-2025-29175 · Advantech · Advantech Iview

Name of the Vulnerable Software and Affected Versions: Advantech iView versions prior to 5.7.05 build 7057 Description: A reflected cross-site scripting XSS issue exists. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially...

B&R Systems Diagnostics Manager Improper Neutralization of Input During Web Page Generation (CVE-2022-4286)

A reflected cross-site scripting XSS vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions =3.00 and =3.00 and =C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session. This plugin only works with Tenable.ot...

CVE-2025-47094

Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browse...

CVE-2025-5301

ONLYOFFICE Docs DocumentServer in versions equal and below 8.3.1 are affected by a reflected cross-site scripting XSS issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response...

CVE-2025-5301

ONLYOFFICE Docs (DocumentServer) versions 8.3.1 and below are vulnerable to a reflected cross-site scripting (XSS) issue. The root cause is the improper sanitization of crafted HTTP POST requests sent via the WOPI protocol . An attacker can inject malicious scripts that are reflected in the serve...