1164514 matches found
CVE-2025-65342
The code-projects Blood System 1.0 is vulnerable to Cross-Site Scripting (XSS) . The flaw exists in the /don.php page, specifically when processing the city field due to improper neutralization of input during web page generation. While technical details regarding the root cause and remediation a...
WordPress plugin Appointment Hour Booking cross-site scripting vulnerability
WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed to enhance functionality of the platform. The Appointment Hour Booking plugi...
PT-2026-66576
Name of the Vulnerable Software and Affected Versions CleverTap Web SDK version 1.15.1 Description Cross Site Scripting XSS occurs because the application fails to sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious...
CVE-2026-13344: Improper Neutralization of Input During Web Page Generation
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...
PT-2026-66445
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
CVE-2025-65341: Improper Neutralization of Input During Web Page Generation
Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...
CVE-2025-0152: Improper Neutralization of Input During Web Page Generation
IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended...
CVE-2025-36431: Improper Neutralization of Input During Web Page Generation
IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.01 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...
PT-2026-66516
A carefully crafted editing request could trigger an XSS vulnerability on Apache JSPWiki when parsing errors on the markdown renderer, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. This issue affects Apache JSPWik...
PT-2026-66116
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description An inappropriate implementation in CSS allows a remote attacker to perform Universal Cross-Site Scripting UXSS, which is a vulnerability that enables the execution of arbitrary scripts ...
PT-2026-66164
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
PT-2026-66197
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
PT-2026-66058
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.72 Description Insufficient policy enforcement in Extensions allows an attacker to inject arbitrary scripts or HTML Universal Cross-Site Scripting or UXSS via a crafted Chrome Extension, provided the...
CVE-2025-65341
Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...
PT-2026-66385
Name of the Vulnerable Software and Affected Versions tourmaster WordPress plugin versions prior to 5.4.8 Description The plugin fails to perform a nonce check when storing a custom-filter label received from a request parameter and does not escape this label when displaying it on the filter admi...
PT-2026-66479
IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server is affected by cross-site scripting in the Administrative Console...
CVE-2025-51684
CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...
PT-2026-66578
Name of the Vulnerable Software and Affected Versions Ecommerce Fruits Bazar version 1.0 Description Cross Site Scripting XSS occurs in the 'admin/edit product.php' endpoint. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. Recommendations At...
CVE-2025-51684
CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...
