CVE-2025-4388

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated...

CVE-2025-2806

The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2025-2806 tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'

The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2025-2806

CVE-2025-2806 — tagDiv Composer (WordPress) Reflected XSS Description: The tagDiv Composer plugin for WordPress (used by the Newspaper theme) is vulnerable to Reflected Cross-Site Scripting via the data parameter in all versions up to and including 5.3 due to insufficient input sanitization and o...

CVE-2025-2806 tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'

The tagDiv Composer plugin for WordPress, used by the Newspaper theme, is vulnerable to Reflected Cross-Site Scripting via the ‘data’ parameter in all versions up to, and including, 5.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

CVE-2025-28073

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized...

CVE-2025-28073

CVE-2025-28073 affects phpList before 3.6.15. The issue is a Reflected Cross-Site Scripting (XSS) in /lists/dl.php where the id parameter is not properly sanitized, allowing an attacker to inject arbitrary JavaScript and potentially perform actions in the victim’s browser. Documented impact inclu...

PT-2025-20411 · Phplist · Phplist

Name of the Vulnerable Software and Affected Versions: phpList versions 3.6.3 through 3.6.14 Description: The issue concerns Reflected Cross-Site Scripting XSS via the "/lists/dl.php" endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly...

CVE-2025-28073

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized...

Reflected Cross-Site Scripting (Reflected XSS)

yeswiki/yeswiki is vulnerable to reflected cross-site scripting XSS. The vulnerability is due to improper sanitization of user input in the file upload form, which allows attackers to craft malicious links that execute arbitrary scripts in the victim’s browser...

Cross-Site Scripting (XSS)

yeswiki/yeswiki is vulnerable to Reflected Cross-Site Scripting Reflected XSS. The vulnerability is due to insufficient sanitization of user-supplied input in URLs, which allows attackers to inject malicious scripts that are reflected in the server’s response...

Cross-Site Scripting (XSS)

yeswiki/yeswiki is vulnerable to reflected cross-site scripting. The vulnerability is due to insufficient sanitization of user-supplied input in URL parameters, which allows malicious scripts to be injected and executed in the context of a user's browser...

CVE-2025-27921

A reflected cross-site scripting XSS vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization o...

Liferay Portal Reflected XSS in marketplace-app-manager-web

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated...

CVE-2025-4388

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated...

CVE-2025-4388

Liferay Portal/DXP CVE-2025-4388 is a reflected XSS affecting Portal 7.4.0–7.4.3.131 and DXP 2024.Q1.1–Q4.5 across multiple 2024 releases up to 7.4 GA with update 92. The vulnerability allows a remote, unauthenticated attacker to inject JavaScript into the modules/apps/marketplace/marketplace-app...

CVE-2025-27921

A reflected cross-site scripting XSS vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization o...

Mars: RXSS on ██████ via customerId parameter

A Reflected Cross-Site Scripting XSS vulnerability was identified on the Mars website at ██████. The vulnerability was located in the customerId parameter, which was inadequately sanitized before being reflected back to users in the HTTP response. When the parameter was manipulated with malicious...

CVE-2025-27921

A reflected cross-site scripting XSS vulnerability was discovered in Output Messenger before 2.0.63, where unsanitized input could be injected into the web application’s response. This vulnerability occurs when user-controlled input is reflected back into the browser without proper sanitization o...

CVE-2025-21572

OpenGrok 1.13.25 has a reflected Cross-Site Scripting XSS issue when producing the history view page. This happens through improper handling of path segments. The application reflects unsanitized user input into the HTML output...