CVE-2025-40675

A Reflected Cross-Site Scripting XSS vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to stea...

CVE-2025-49130

Laravel Translation Manager is a package to manage Laravel translation files. Prior to version 0.6.8, the application is vulnerable to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including...

Exploit for Cross-site Scripting in Cpanel

CVE-2023-29489 The security vulnerability is recorded in the C...

PT-2025-23799 · Oscommerce · Oscommerce

Name of the Vulnerable Software and Affected Versions: osCommerce version 4 Description: The issue is a Reflected Cross-Site Scripting XSS that allows an attacker to execute JavaScript code in the victim's browser. This can be achieved by sending a malicious URL using any parameter name in the...

CVE-2025-40651 Reflected Cross Site Scripting (XSS) in Real Easy Store

Reflected Cross-Site Scripting XSS vulnerability in Real Easy Store. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the keyword parameter in /index.php?a=search. This vulnerability can be exploited to steal...

CVE-2025-40651

Real Easy Store suffers a Reflected Cross-Site Scripting (XSS) via the keyword parameter in /index.php?a=search. An attacker can lure a victim to a crafted URL to execute JavaScript in the browser, potentially stealing session cookies or acting on behalf of the user. The CVSS data indicates a 5.1...

PT-2025-22894 · Unknown · Covermanager

Name of the Vulnerable Software and Affected Versions: CoverManager affected versions not specified Description: The issue is a Stored Cross-Site Scripting XSS vulnerability in the CoverManager booking software. This allows an attacker to inject malicious scripts into the application, which are...

CVE-2024-42470

openHAB, a provider of open-source home automation software, has add-ons including the visualization add-on CometVisu. Several endpoints in versions prior to 4.2.1 of the CometVisu add-on of openHAB don't require authentication. This makes it possible for unauthenticated attackers to modify or to...

CVE-2021-42954

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group non-admin or any guest users, thereby allowing privilege...

CVE-2025-48369

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.119 and 25.0.20, a persistent Cross-Site Scripting XSS vulnerability exists in Groupoffice's tasks comment functionality, allowing attackers to execute arbitrary JavaScript by uploading an fil...

CVE-2019-19293

A vulnerability has been identified in Control Center Server CCS All versions V1.5.0. The web interface of the Control Center Server CCS contains a reflected Cross-site Scripting XSS vulnerability that could allow an unauthenticated remote attacker to steal sensitive data or execute administrativ...

CampCodes Sales and Inventory System /pages/purchase_delete.php File SQL Injection Vulnerability

CampCodes Sales and Inventory System is a sales and inventory system from CampCodes, Inc. The CampCodes Sales and Inventory System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter prid in the file...

CampCodes Online Shopping Portal /my-account.php File SQL Injection Vulnerability

CampCodes Online Shopping Portal is an online shopping portal from CampCodes, Inc. CampCodes Online Shopping Portal suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter Name in the file /my-account.php. An attacker...

CampCodes Online Shopping Portal /forgot-password.php File SQL Injection Vulnerability

CampCodes Online Shopping Portal is an online shopping portal from CampCodes, Inc. Campcodes Online Shopping Portal suffers from a SQL injection vulnerability that originates from a lack of validation of externally-entered SQL statements in the parameter email in the file /forgot-password.php. An...

Employee Record System getData.php File SQL Injection Vulnerability

Employee Record System is an employee record system. Employee Record System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter keywords in the file /dashboard/getData.php. An attacker can exploit this...

CampCodes Online Shopping Portal 注入漏洞

CampCodes Online Shopping Portal is an online shopping portal from CampCodes, Inc. CampCodes Online Shopping Portal suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter Name in the file /my-account.php. An attacker...

CVE-2025-40626

Reflected Cross-Site Scripting XSS vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform...

CVE-2025-40627

Reflected Cross-Site Scripting XSS vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform...

CVE-2025-40626

CVE-2025-40626 corresponds to a reflected XSS in AbanteCart v1.4.0. The issue affects the /about_us endpoint where a malicious XSS payload can be reflected to the victim, enabling JavaScript execution that could steal session cookies or perform actions on behalf of the user, as described in multi...

CVE-2025-40626 Reflected Cross-Site Scripting (XSS) in AbanteCart

Reflected Cross-Site Scripting XSS vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform...