ChuanhuChatGPT Cross-Site Scripting Vulnerability

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. ChuanhuChatGPT suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping o...

PT-2025-13093

Name of the Vulnerable Software and Affected Versions jAlbum Bridge versions 2.0.17 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This enables potential attackers to...

Important: Red Hat Security Advisory: libreoffice security update

An update for libreoffice is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.6 Telecommunications Update Service. Red Hat Product Security has rated this update ...

Important: Red Hat Security Advisory: libreoffice security update

An update for libreoffice is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service. Red Hat Product Security has rated this update ...

PT-2025-12900

Name of the Vulnerable Software and Affected Versions NotFound Frontend Post Submission versions n/a through 1.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS in NotFound Frontend...

Important: Red Hat Security Advisory: libreoffice security update

An update for libreoffice is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

Yonyou UFIDA ERP-NC Code Injection Vulnerability

Yonyou UFIDA ERP-NC is a kind of Enterprise Resource Planning ERP software, which is mainly used for financial management, supply chain management, production management and customer relationship management of enterprises. Yonyou UFIDA ERP-NC suffers from a cross-site scripting vulnerability that...

CVE-2025-29412

A cross-site scripting XSS vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter...

CVE-2025-29410

A cross-site scripting XSS vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the txtEmail parameter...

GHSA-528Q-4PGM-WVG2 Reflected XSS in go-httpbin due to unrestricted client control over Content-Type

Description The go-httpbin framework is vulnerable to XSS as the user can control the Response Content-Type from GET parameter. This allows attacker to execute cross site scripts in victims browser. Affected URLs: - /response-headers?Content-Type=text/html&xss=%3Cimg/src/onerror=alert%27xss%27%3E...

CVE-2019-16151

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiOS 6.4.1 and below, 6.2.9 and below may allow a remote unauthenticated attacker to either redirect users to malicious websites via a crafted "Host" header or to execute JavaScript code in the victim's...

PT-2025-12393 · Zoho · Manageengine Supportcenter Plus +1

Name of the Vulnerable Software and Affected Versions: ManageEngine ServiceDesk Plus versions below 14920 ManageEngine ServiceDesk Plus MSP versions below 14910 ManageEngine SupportCentre Plus versions below 14910 Description: The issue concerns a Stored XSS vulnerability in the task feature. Thi...

CVE-2025-29410

A cross-site scripting XSS vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the txtEmail parameter...

Hospital Management System security vulnerabilities

Hospital Management System is a hospital management system by the individual developer Kishan Lal. A security vulnerability exists in Hospital Management System v1.0, which stems from a cross-site scripting vulnerability in the /contact.php component that could lead to the execution of arbitrary...

PT-2025-12349

Name of the Vulnerable Software and Affected Versions Hospital Management System version 1.0 Description A cross-site scripting XSS issue in the /contact.php component allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the txtEmail parameter. This enable...

PT-2025-12237

Name of the Vulnerable Software and Affected Versions modelscope/agentscope version 21161fe Description A stored cross-site scripting XSS issue exists in the view for inspecting detailed run information. This occurs because a user-controllable string, the run ID, is appended and rendered as HTML,...

CVE-2025-29410

A cross-site scripting XSS vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the txtEmail parameter...

CVE-2025-29412

A cross-site scripting XSS vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter...

CVE-2025-29410

The Hospital Management System v1.0 is vulnerable to a cross-site scripting (XSS) flaw within the /contact.php component. The root cause is the improper neutralization of input during web page generation, specifically allowing attackers to inject a crafted payload into the txtEmail parameter. Suc...

CVE-2025-29412

A cross-site scripting (XSS) vulnerability exists in the Client Profile Update section of Mart Developers iBanking v2.0.0 . The flaw allows an attacker to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name parameter. To mitigate this risk, it is recommended to disa...