PT-2025-14118

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.19 Description The issue is related to Improper Neutralization of Script-Related HTML Tags in a Web Page, also known as Basic XSS. This is a type of security vulnerability that occurs when an application...

WordPress plugin Better Section Navigation Widget 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

CVE-2025-24361: Exposed Dangerous Method or Function

Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack builder or version 3.12.2 through 3.152 of the rspack builder and a victim opens a malicious web site. Because the request for classic script b...

PT-2025-5498 · Unknown · Listamester

Name of the Vulnerable Software and Affected Versions: Listamester versions through 2.3.4 Description: The issue is related to improper neutralization of script-related HTML tags in a web page, which allows for Stored XSS attacks. This means an attacker can inject malicious scripts into the web...

Fortinet FortiPortal 安全漏洞

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. A cross-site scripting vulnerability exists in Fortinet FortiPortal that stems from an...

CVE-2025-23026 HTML templates containing Javascript template strings are subject to XSS in jte

jte Java Template Engine is a secure and lightweight template engine for Java and Kotlin. In affected versions Jte HTML templates with script tags or script attributes that include a Javascript template string backticks are subject to XSS. The javaScriptBlock and javaScriptAttribute methods in th...

WordPress plugin wpForo Forum 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-36101

Name of the Vulnerable Software and Affected Versions: ARForms Form Builder versions through 1.7.1 Description: The issue is related to improper neutralization of script-related HTML tags in a web page, allowing code injection. This is a Basic XSS vulnerability that affects ARForms Form Builder,...

Django Filer 代码问题漏洞

Django Filer is an open source file management application for Django from the Django CMS Association. A code issue vulnerability exists in Django Filer version 3 up to and including version 3.3, which stems from allowing unlimited uploads of dangerous types of files, improper input validation, a...

CVE-2024-51757

A flaw was found in happy-dom. This vulnerability allows remote code execution via a script tag, potentially executing code in the user context of happy-dom...

PT-2024-34888 · Happy-Dom · Happy-Dom

Name of the Vulnerable Software and Affected Versions: happy-dom versions prior to 15.10.2 Description: happy-dom is a JavaScript implementation of a web browser without its graphical user interface. It may execute code on the host via a script tag, which would execute code in the user context of...

happy-dom 代码注入漏洞

happy-dom is a JavaScript implementation of a web browser without a graphical user interface by the individual developer David Ortner. A code injection vulnerability exists in happy-dom versions prior to 15.10.2, which originates from code execution on the host via script tags, leading to code...

CVE-2024-51757: Improper Control of Generation of Code

happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the host via a script tag. This would execute code in the user context of happy-dom. Users are advised to upgrade to version 15.10.2. There ar...

DEBIAN-CVE-2024-47878

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the /extension/gdata/authorized endpoint includes the state GET parameter verbatim in a tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing...

UBUNTU-CVE-2024-47878

OpenRefine is a free, open source tool for working with messy data. Prior to version 3.8.3, the /extension/gdata/authorized endpoint includes the state GET parameter verbatim in a tag in the output, so without escaping. An attacker could lead or redirect a user to a crafted URL containing...

CVE-2024-44061

: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in WPFactory EU/UK VAT Manager for WooCommerce allows Cross-Site Scripting XSS.This issue affects EU/UK VAT Manager for WooCommerce: from n/a through 2.12.14...

ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function

The ReDoS can be exploited through the parseHTML function in the html-parser.ts file. This flaw allows attackers to slow down the application by providing specially crafted input that causes inefficient processing of regular expressions, leading to excessive resource consumption. To demonstrate...

CVE-2024-2010

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in TE Informatics V5 allows Reflected XSS.This issue affects V5: before 6.2...

CVE-2024-29833

The image upload component allows SVG files and the regular expression used to remove script tags can be bypassed by using a Cross Site Scripting payload which does not match the regular expression; one example of this is the inclusion of whitespace within the script tag. An attacker must target ...

WordPress plugin PhotoGallery 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...