15947 matches found
PT-2025-45080
Name of the Vulnerable Software and Affected Versions FunnelKit WordPress plugin versions prior to 3.12.0.1 Description The software does not properly sanitize user-provided data before displaying it in certain checkout-related AJAX operations. This can allow attackers to execute reflected...
Liferay Portal 7.4.3.8 < 7.4.3.112 XSS
Reflected cross-site scripting XSS vulnerability in Language Override in Liferay Portal allows remote attackers to inject arbitrary web script or HTML via the comliferayportallanguageoverridewebinternalportletPLOPortletselectedLanguageId parameter. Note that Nessus has not tested for this issue b...
CVE-2025-61431
A reflected cross-site scripted XSS vulnerability in the /jsp/gsfrfeditorHTML.jsp endpoint of Zucchetti ZMaintenance Infinity and Infinity Zucchetti v4.1 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the...
CVE-2025-61431
CVE-2025-61431 is a reflected XSS in Zucchetti ZMaintenance Infinity (and Infinity Zucchetti) up to v4.1. The flaw arises from unvalidated input delivered to the /jsp/gsfr_feditorHTML.jsp endpoint, allowing an attacker to inject crafted payload into the pHtmlSource parameter and execute arbitrary...
CVE-2025-53883
A Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x8664/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manag...
CVE-2023-53689
Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting XSS vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly...
CVE-2025-62264
Reflected cross-site scripting XSS vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the...
CVE-2025-61427
A reflected cross-site scripting XSS vulnerability in BEO GmbH BEO Atlas Einfuhr Ausfuhr 3.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the userid and password parameters...
PT-2025-44632
Name of the Vulnerable Software and Affected Versions BEO GmbH BEO Atlas Einfuhr Ausfuhr version 3.0 Description A reflected cross-site scripting XSS issue exists in BEO GmbH BEO Atlas Einfuhr Ausfuhr 3.0. This allows attackers to execute arbitrary code within a user’s browser. Exploitation occur...
CVE-2025-27208
Revive Adserver 5.5.2 is affected by a reflected Cross-Site Scripting (XSS) in admin-search.php via the compact parameter. An attacker able to lure a user with UI access into clicking a crafted URL can inject JavaScript to run in the victim’s browser; cookies aren’t exposed, but other actions may...
CVE-2024-13993
Nagios XI versions prior to 2024R1.1.2 are vulnerable to a reflected cross-site scripting XSS via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when...
CVE-2024-13993
Nagios XI versions prior to 2024R1.1.2 are vulnerable to a reflected cross-site scripting XSS via the login page when accessed with older web browsers. Insufficient validation or escaping of user-supplied input reflected by the login page can allow an attacker to craft a malicious link that, when...
CVE-2021-47694
The Core Config Manager CCM in Nagios XI versions prior to CCM 3.1.4 / Nagios XI 5.8.6 contains a reflected cross-site scripting XSS vulnerability via the Test Command functionality. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary...
CVE-2021-47694
Nagios XI CCM (Core Config Manager) prior to CCM 3.1.4 / XI 5.8.6 is affected by a reflected XSS via the Test Command feature. The vulnerability stems from insufficient validation/escaping of user input, allowing an attacker to inject and execute arbitrary script in a victim’s browser. Affected c...
CVE-2023-53689 Nagios Fusion < 4.2.0 License Information Reflected XSS
Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting XSS vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly...
CVE-2025-53883 spacewalk-java has various XSS issues on search page
A Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability allows attackers to run arbitrary javascript via a reflected XSS issue in the search fields.This issue affects Container suse/manager/5.0/x8664/server:latest: from ? before 5.0.28-150600.3.36.8; SUSE Manag...
PT-2025-44559
Name of the Vulnerable Software and Affected Versions Revive Adserver version 5.5.2 Description A reflected Cross-Site Scripting XSS issue exists in Revive Adserver version 5.5.2. An attacker could potentially cause a user with access to the user interface of a Revive Adserver instance to execute...
CVE-2025-62800 FastMCP vulnerable to reflected XSS in client's callback page
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page oauthcallback.py where unescaped user-controlled values are inserted into the generated HTML, allowing arbitrary JavaScri...
CVE-2025-53533
Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level advertisement and internet tracker blocking application. Pi-hole Admin Interface versions 6.2.1 and earlier are vulnerable to reflected cross-site scripting XSS via a malformed URL path. The 404 error page includes t...