CVE-2025-48993

Group-Office (enterprise CRM/groupware) is affected by a reflected XSS via the Look and Feel Formatting fields. The issue arises because input in these fields is not properly sanitized. Affected versions: before 6.8.123 and before 25.0.27. Patches exist: 6.8.123 and 25.0.27. Remediation: upgrade ...

CVE-2025-40729

Reflected Cross-Site Scripting XSS in /customersupport/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code via the page parameter...

CVE-2025-40729 Reflected Cross-Site Scripting (XSS) vulnerability in Customer Support System

Reflected Cross-Site Scripting XSS in /customersupport/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code via the page parameter...

CVE-2025-40727 Reflected Cross-Site Scripting (XSS) in Phoenix CMS

A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...

CVE-2025-40727

Consolidated findings for CVE-2025-40727: The Phoenix Site CMS contains a Reflected XSS vulnerability in the /search endpoint, exploitable via the s GET parameter. The root cause is reflected input being echoed unsafely, enabling remote attackers to execute arbitrary code in the context of the af...

CVE-2025-40727 Reflected Cross-Site Scripting (XSS) in Phoenix CMS

A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...

PT-2025-25532 · Nosto · Nosto

Name of the Vulnerable Software and Affected Versions: Nosto affected versions not specified Description: A Reflected Cross-Site Scripting XSS issue exists in the /pages/search-results-page endpoint of Nosto. This allows remote attackers to execute arbitrary code via the q GET request parameter...

PT-2025-25534 · Unknown · Customer Support System

Name of the Vulnerable Software and Affected Versions: Customer Support System version 1.0 Description: The issue is related to a Reflected Cross-Site Scripting XSS in the /customer support/index.php endpoint, which allows remote attackers to execute arbitrary code via the page parameter. This...

PT-2025-25529 · Unknown · Phoenix Site Cms

Name of the Vulnerable Software and Affected Versions: Phoenix Site CMS versions affected versions not specified Description: A Reflected Cross Site Scripting XSS issue was found in the "/search" endpoint, allowing remote attackers to execute arbitrary code via the s GET parameter. Recommendation...

CVE-2025-5301

ONLYOFFICE Docs DocumentServer in versions equal and below 8.3.1 are affected by a reflected cross-site scripting XSS issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response...

Exploit for CVE-2025-46181

CVE-2025-46181 - Reflected XSS in an Online Appointment Bookin...

PT-2025-29175 · Advantech · Advantech Iview

Name of the Vulnerable Software and Affected Versions: Advantech iView versions prior to 5.7.05 build 7057 Description: A reflected cross-site scripting XSS issue exists. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially...

B&R Systems Diagnostics Manager Improper Neutralization of Input During Web Page Generation (CVE-2022-4286)

A reflected cross-site scripting XSS vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions =3.00 and =3.00 and =C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session. This plugin only works with Tenable.ot...

CVE-2025-47094

Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browse...

CVE-2025-5301

ONLYOFFICE Docs DocumentServer in versions equal and below 8.3.1 are affected by a reflected cross-site scripting XSS issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response...

CVE-2025-5301

ONLYOFFICE Docs (DocumentServer) <= 8.3.1 is affected by a reflected XSS when opening files via WOPI, caused by improper sanitization of crafted HTTP POST requests. The XSS can result in malicious scripts being reflected in the server’s HTML response. Affected product/version: ONLYOFFICE Docs ...

CVE-2025-4652

The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-47094

Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browse...

CVE-2025-46857

Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If a low privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

CVE-2025-48143

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in salesup2019 Formulario de contacto SalesUp! formularios-de-contacto-salesup allows Reflected XSS.This issue affects Formulario de contacto SalesUp!: from n/a through = 1.0.14...