CVE-2025-64260

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marco Milesi ANAC XML Bandi di Gara avcp allows Reflected XSS.This issue affects ANAC XML Bandi di Gara: from n/a through = 7.7...

CVE-2025-66119 WordPress Hostel plugin <= 1.1.5.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through = 1.1.5.9...

CVE-2025-66118 WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected XSS.This issue affects Sprout Clients: from n/a through = 3.2.1...

CVE-2025-66118 WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected XSS.This issue affects Sprout Clients: from n/a through = 3.2.1...

CVE-2025-66102 WordPress FV Antispam plugin <= 2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FolioVision FV Antispam fv-antispam allows Reflected XSS.This issue affects FV Antispam: from n/a through = 2.7...

CVE-2025-64376 WordPress ListingPro theme < 2.9.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CridioStudio ListingPro listingpro allows Reflected XSS.This issue affects ListingPro: from n/a through 2.9.10...

CVE-2025-60182

CVE-2025-60182 affects the WordPress plugin Support Board (versions prior to 3.8.7). The root cause is improper neutralization of input during web page generation, enabling reflected XSS. Impact is reflected cross-site scripting with low moderation of confidentiality, integrity, and availability ...

PT-2025-52166

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods Photography photography allows Reflected XSS.This issue affects Photography: from n/a through = 7.7.2...

CVE-2025-14347

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Proliz Software Ltd. OBS Student Affairs Information System0 allows Reflected XSS. This issue affects OBS Student Affairs Information System0: before 26.5009...

CVE-2025-67170

RiteCMS v3.1.0 is affected by a reflected cross-site scripting (XSS) vulnerability. The issue stems from insufficient filtering/escaping of user-supplied data, enabling an attacker to cause arbitrary script execution in the context of a victim’s browser via a crafted payload. Affected product is ...

📄 WIX.com Cross Site Scripting

WIX.com appears to suffer from a cross site scripting vulnerability. The researcher contacted them months ago and they have ignored his report, so we are posting this to encourage them to address it and to let their users know that they could be affected by this vulnerability. Titles: WIX.com /...

JetBrains TeamCity 跨站脚本漏洞

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides features such as continuous unit testing, code quality analysis and build issue analysis reports. A cross-site scripting vulnerability exists in JetBrai...

CVE-2023-53882

JLex GuestBook 1.6.4 is affected by a reflected cross-site scripting (XSS) vulnerability in the q URL parameter. The issue allows attackers to craft malicious links that inject scripts into victims’ browsers, potentially stealing session tokens or executing arbitrary JavaScript.Reportedly, remedi...

CVE-2023-36337

A reflected cross-site scripting XSS vulnerability in the component /index.php/cuzh4 of PHP Inventory Management System 1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2023-36337

CVE-2023-36337 affects PHP Inventory Management System v1. The vulnerability is a reflected XSS in the component /index.php/cuzh4 that allows an attacker to trigger arbitrary web scripts/HTML via a crafted payload. Metrics indicate CVSS v3.1 base score 6.1 (MEDIUM) with network attack vector, low...

EUVD-2025-202397

The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-34409

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the Failed parameter of /Mondo/lang/sys/Forms/MAI/AddRecipientsResult.aspx. The Failed value is not properly sanitized when processed via a GET request and is reflected in the response, allowing an...

EUVD-2025-202193

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the FieldTo parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The FieldTo value is not properly sanitized when processed via a GET request and is reflected inside a block in the JavaScript variable...

CVE-2025-6924

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Talent Software e-BAP Automation allows Reflected XSS. This issue affects e-BAP Automation: before 42957...

CVE-2025-66309 Grav vulnerable to Cross-Site Scripting (XSS) Reflected endpoint /admin/pages/[page], parameter data[header][content][items], located in the "Blog Config" tab

This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta.1, a Reflected Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This...