CVE-2025-55124

Improper neutralisation of input in Revive Adserver 6.0.0+ causes a reflected XSS attack in the banner-zone.php script...

CVE-2025-63879

A reflected cross-site scripted XSS vulnerability in the /ecommerce/products.php component of E-commerce Project v1.0 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the id parameter...

CVE-2025-65013

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting XSS vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without...

CVE-2025-63879

A reflected cross-site scripted XSS vulnerability in the /ecommerce/products.php component of E-commerce Project v1.0 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the id parameter...

CVE-2024-8528

Reflected XSS using a specific URL in Automated Logic WebCTRL and Carrier i-VU can allow delivery of malicious payload due to a specific GET parameter not being sanitized...

PT-2025-47488

Name of the Vulnerable Software and Affected Versions Astro versions prior to 5.15.8 Description A reflected cross-site scripting XSS issue exists in Astro when the server islands feature is utilized. The issue affects applications using the server islands feature, regardless of the component...

CVE-2025-12079 WP Twitter Auto Publish <= 1.7.4 - Reflected Cross-Site Scripting via PostMessage

The WP Twitter Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-12078 ArtiBot Free Chat Bot for WebSites <= 1.1.7 - Reflected Cross-Site Scripting via PostMessage

The ArtiBot Free Chat Bot for WebSites plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2025-47253

Name of the Vulnerable Software and Affected Versions ArtiBot Free Chat Bot for WebSites plugin for WordPress versions through 1.1.7 Description The software is susceptible to Reflected Cross-Site Scripting via PostMessage due to inadequate input sanitization and output escaping. This allows...

CVE-2025-63725

Reflected Cross-Site Scripting XSS vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php...

CVE-2025-64745 Astro development server error page vulnerable to reflected Cross-site Scripting

Astro is a web framework. Starting in version 5.2.0 and prior to version 5.15.6, a Reflected Cross-Site Scripting XSS vulnerability exists in Astro's development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScript code that executes ...

CVE-2025-11560

CVE-2025-11560 — Concrete details exist for the WordPress plugin. The affected software is the Team Members Showcase WordPress plugin (versions before 3.5.0; e.g., ≤3.4.0). The root cause is a lack of sanitization/escaping of a parameter before outputting it on the page, causing a reflected cross...

CVE-2025-42886

Due to a Reflected Cross-Site Scripting XSS vulnerability in SAP Business Connector, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed during web page generation, resulting in...

EUVD-2025-60951

The WP-OAuth plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'errordescription' parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2025-64167 Combodo iTop vulnerable to reflected XSS in webservices/export.php

Combodo iTop is a web based IT service management tool. Versions prior to 2.7.13 and 3.2.2 are vulnerable to a cross-site scripting attack leading to JS execution when editing the URL parameter. Versions 2.7.13 and 3.2.2 don't use export.php, which was deprecated. They use export-v2.php instead...

CVE-2025-64491

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Versions 7.14.7 and below allow unauthenticated reflected Cross-Site Scripting XSS. Successful exploitation could lead to full account takeover, for example by altering the login form to send...

CVE-2025-12064 WP2Social Auto Publish <= 2.4.7 - Reflected Cross-Site Scripting via PostMessage

The WP2Social Auto Publish plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via PostMessage in all versions up to, and including, 2.4.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-64491 SuiteCRM is vulnerable to unauthenticated reflected XSS through its Login page

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Versions 7.14.7 and below allow unauthenticated reflected Cross-Site Scripting XSS. Successful exploitation could lead to full account takeover, for example by altering the login form to send...

PT-2025-45546

Name of the Vulnerable Software and Affected Versions WP2Social Auto Publish versions through 2.4.7 Description The WP2Social Auto Publish plugin for WordPress is susceptible to Reflected Cross-Site Scripting via PostMessage due to inadequate input sanitization and output escaping. This allows...

CVE-2025-58964

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup Enzy enzy allows Reflected XSS.This issue affects Enzy: from n/a through 1.6.4...