15844 matches found
WordPress Attachments Handler plugin <= 1.1.7 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin Attachments Handler versions = 1.1.7...
CVE-2025-66845
A reflected Cross-Site Scripting XSS vulnerability has been identified in TechStore version 1.0. The username endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser...
CVE-2025-66845
A reflected Cross-Site Scripting XSS vulnerability has been identified in TechStore version 1.0. The username endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser...
CVE-2025-66845
A reflected Cross-Site Scripting XSS vulnerability has been identified in TechStore version 1.0. The username endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser...
PT-2025-52753
Name of the Vulnerable Software and Affected Versions TechStore version 1.0 Description A reflected Cross-Site Scripting XSS issue exists. The /user name API endpoint reflects the id query parameter directly into the HTML response without proper output encoding or sanitization. This allows for th...
CVE-2025-65270
Reflected cross-site scripting XSS vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's browser...
CVE-2024-25814
MyNET up to v26.05 was discovered to contain a reflected cross-site scripting XSS vulnerability via the msg parameter...
CVE-2025-65790
CVE-2025-65790 affects FuguHub 8.1. The vulnerability arises in the internal file manager interface (/fs/) where SVG files are served without sanitizing or restricting inline script execution, allowing a crafted SVG with a [removed] element to execute attacker-controlled JavaScript in the victim’...
CVE-2024-35321
The CVE-2024-35321 entry concerns AIRC MyNET (up to version 26.08). Affected component/issue: a reflected cross-site scripting (XSS) vulnerability triggered via the msgtipo parameter. The incident description indicates the flaw exists in MyNET up to v26.08; no explicit exploitation details or in-...
EUVD-2025-204626
The Overstock Affiliate Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...
CVE-2025-64191
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through 9.6.1...
JetBrains TeamCity < 2025.11.1 Multiple Vulnerabilities
The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.1. It is, therefore, affected by multiple vulnerabilities as referenced in the advisory. - In JetBrains TeamCity before 2025.11.0 Excessive privileges were possible due to storing GitHub personal access token inste...
CVE-2024-58319 Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS
A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration dialog. Attackers can exploit this vulnerability to execute malicious scripts in administrative users' browsers...
CVE-2023-53736 Kentico Xperience <= 13.0.120 Administration Interface Reflected XSS
A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Attackers can exploit this vulnerability to execute arbitrary scripts within the administrative context...
CVE-2023-53736
CVE-2023-53736 concerns Kentico Xperience. A cross-site scripting vulnerability exists in the administration interface, allowing authenticated users to inject scripts that execute within the administrative context. Documents consistently describe a reflected XSS vector affecting the admin UI; roo...
CVE-2025-64376
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CridioStudio ListingPro listingpro allows Reflected XSS.This issue affects ListingPro: from n/a through 2.9.10...
CVE-2025-64221
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Reflected XSS.This issue affects Reservation Plugin: from n/a through = 1.6...
EUVD-2025-204042
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected XSS.This issue affects Sprout Clients: from n/a through = 3.2.1...
CVE-2025-64376
CVE-2025-64376 affects the WordPress ListingPro theme (and ListingPro listings) prior to version 2.9.10. The root cause is improper neutralization of input during web page generation, allowing Reflected XSS. The entry cites a CVSS v3.1 base score of 7.1 (HIGH) with network access, low attack comp...