6238 matches found
Cross-Site Scripting (XSS)
bagisto/bagisto is vulnerable to Cross-Site Scripting. The vulnerability is due to improper validation of uploaded SVG files, which allows an attacker to execute arbitrary code via a crafted file upload...
CVE-2025-51462
Stored Cross-site Scripting XSS vulnerability in api.apps.dialogapp.setdialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to the assistant greeting field, which is stored unsanitised and rendered using a markdown component with rehype-raw...
CVE-2025-51400
A stored cross-site scripting XSS vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...
CVE-2020-26799
A reflected cross-site scripting XSS vulnerability was discovered in index.php on Luxcal 4.5.2 which allows an unauthenticated attacker to steal other users' data...
CVE-2025-7716 Real-time SEO for Drupal - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-091
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Real-time SEO for Drupal allows Cross-Site Scripting XSS.This issue affects Real-time SEO for Drupal: from 2.0.0 before 2.2.0...
CVE-2025-7715 Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Block Attributes allows Cross-Site Scripting XSS.This issue affects Block Attributes: from 0.0.0 before 1.1.0, from 2.0.0 before 2.0.1...
openjdk: Improve scripting supports (Oracle CPU 2025-07)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows...
openjdk: Improve scripting supports (Oracle CPU 2025-07)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows...
CVE-2025-7655
The Live Stream Badger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'livestream' shortcode in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2025-7901
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. The attack may be...
CVE-2025-7901 yangzongzhuan RuoYi Swagger UI index.html cross site scripting
A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. It has been rated as problematic. This issue affects some unknown processing of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. The attack may be...
CVE-2025-7870 Portabilis i-Diario justificativas-de-falta Endpoint cross site scripting
A vulnerability, which was classified as problematic, was found in Portabilis i-Diario 1.5.0. This affects an unknown part of the component justificativas-de-falta Endpoint. The manipulation of the argument Anexo leads to cross site scripting. It is possible to initiate the attack remotely. The...
CVE-2025-7867
CVE-2025-7867 affects Portabilis i-Educar 2.9.0/2.10.0, specifically the Agenda Module’s file /intranet/agenda.php. The vulnerability arises from manipulating the parameters novo_titulo and novo_descricao, leading to cross-site scripting. Attacks can be initiated remotely, and the exploit has bee...
PT-2025-30170 · Portabilis · I-Educar
Name of the Vulnerable Software and Affected Versions: Portabilis i-Educar version 2.9.0 Description: A cross-site scripting issue exists due to the manipulation of the Motivo argument within the Calendar Module. The vulnerability is located in the /intranet/educar calendario dia motivo cad.php...
CVE-2025-6185
Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which would execute in a client browser when accessed by a user, steal session tokens, and control the service...
CVE-2025-7802 PHPGurukul Complaint Management System complaint-search.php cross site scripting
A vulnerability was found in PHPGurukul Complaint Management System 2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/complaint-search.php. The manipulation of the argument Search leads to cross site scripting. The attack may be launched...
openjdk: Improve scripting supports (Oracle CPU 2025-07)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows...
openjdk: Improve scripting supports (Oracle CPU 2025-07)
Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Scripting. Supported versions that are affected are Oracle Java SE: 8u451, 8u451-perf and 11.0.27; Oracle GraalVM Enterprise Edition: 21.3.14. Difficult to exploit vulnerability allows...
CVE-2025-50584
Product affected: StudentManage v1.0. The issue is a cross-site scripting (XSS) vulnerability in the Add A New Teacher module. Root cause details are not provided beyond the XSS finding. Impact, scope, and exploitability are described in general terms (XSS may affect user input handling); explici...
CVE-2025-50581
Summary: CVE-2025-50581 affects MRCMS v3.1.2 and is described as a cross-site scripting (XSS) vulnerability in the /admin/group/save.do component. What’s affected: MRCMS v3.1.2 (web application) as per multiple sources in the connected data. Vulnerability details: XSS via the /admin/group/save.do...