GHSA-GV5R-9GXR-V74W Bootstrap Multiselect Vulnerable to CSRF and Reflective XSS via Arbitrary POST Data

An issue was discovered in post.php in bootstrap-multiselect aka Bootstrap Multiselect 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting XSS vulnerability...

CVE-2025-47204

An issue was discovered in post.php in bootstrap-multiselect aka Bootstrap Multiselect 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting XSS vulnerability...

CVE-2025-47204: Cross-Site Request Forgery (CSRF)

An issue was discovered in post.php in bootstrap-multiselect aka Bootstrap Multiselect 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting XSS vulnerability...

CVE-2025-47204

A vulnerability exists in bootstrap-multiselect version 1.1.2 (also identified via org.webjars and org.webjars.npm ) where a PHP script in post.php echoes arbitrary POST data without proper validation. If developers adopt this source code structure in live applications, it can lead to Reflective ...

PT-2025-20925 · Unknown · Bootstrap-Multiselect

Name of the Vulnerable Software and Affected Versions: bootstrap-multiselect version 1.1.2 Description: An issue was discovered in post.php, where a PHP script echoes arbitrary POST data. This could create a Reflective Cross-Site Scripting XSS vulnerability exploitable through Cross-Site Request...

CVE-2025-47204

An issue was discovered in post.php in bootstrap-multiselect aka Bootstrap Multiselect 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting XSS vulnerability...

CVE-2025-47204

An issue was discovered in post.php in bootstrap-multiselect aka Bootstrap Multiselect 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting XSS vulnerability...

CVE-2025-47204

An issue was discovered in post.php in bootstrap-multiselect aka Bootstrap Multiselect 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting XSS vulnerability...

AbanteCart 跨站脚本漏洞

AbanteCart is an open source PHP-based e-commerce platform from AbanteCart. A cross-site scripting vulnerability exists in AbanteCart v1.4.0, which stems from the presence of reflective cross-site scripting in the /eyes parameter, which could lead to the execution of malicious code...

Moodle Cross-Site Scripting Vulnerability (CNVD-2025-09235)

Moodle is Moodle open source set of free e-learning software platform, also known as course management system, learning management system or virtual learning environment. Moodle suffers from a cross-site scripting vulnerability that stems from insufficient return URL cleanup in the policy tool,...

Yordam Library Automation System 跨站脚本漏洞

Yordam Library Automation System is an application from Yordam, Inc. A cross-site scripting vulnerability exists in Yordam Library Automation System prior to version 21.6 that stems from improper input neutralization and could lead to a reflective cross-site scripting attack...

Audiobookshelf 跨站脚本漏洞

Audiobookshelf is a self-hosted audiobook and podcast server from Audiobookshelf open source. A cross-site scripting vulnerability exists in Audiobookshelf versions prior to 2.21.0, which stems from improper handling of input in the /api/upload endpoint and could lead to a reflective cross-site...

104 eHRMS 跨站脚本漏洞

104 eHRMS is a Human Resource Management System from 104 Inc. A cross-site scripting vulnerability exists in 104 eHRMS V202412 and prior versions, which stems from reflective cross-site scripting and could lead to the execution of arbitrary JavaScript code...

Karaz Karazal 安全漏洞

Karaz Karazal is an innovative digital platform from Karaz that provides intelligent business solutions and services. A security vulnerability exists in Karaz Karazal version 2025-04-14 and earlier, which stems from a parameter lang leading to reflective cross-site scripting...

WordPress plugin Custom Admin-Bar Favorites 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists i...

CVE-2025-32533

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Matat Technologies Deliver via Shipos for WooCommerce wc-shipos-delivery allows Reflected XSS.This issue affects Deliver via Shipos for WooCommerce: from n/a through = 2.1.7...

CVE-2025-27289 WordPress Restrict Taxonomies Plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Antoine Guillien Restrict Taxonomies restrict-taxonomies allows Reflected XSS.This issue affects Restrict Taxonomies: from n/a through = 1.3.3...

CVE-2025-39455 WordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery CSRF vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location Variables: from n/a through = 2.9.5...

WordPress plugin IP2Location Variables 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

WordPress plugin All push notification for WP 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...