CVE-2025-59480

Mattermost Mobile Apps versions =2.32.0 fail to verify that SSO redirect tokens originate from the trusted server, which allows a malicious Mattermost instance or on-path attacker to obtain user session credentials via crafted token-in-URL responses...

Teamcenter Visualization SSO login service Vulnerability

Teamcenter contains an open-redirect vulnerability in its SSO login service affecting Teamcenter V14.1, V14.2, V14.3, V2312, V2406, and V2412; the SSO accepts user-controlled input that can point to external URLs, allowing an attacker to craft a link that redirects a legitimate user to a maliciou...

CVE-2023-53689

Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting XSS vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly...

CVE-2025-64386

The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session...

CVE-2025-64386 HIJACKING OF THE TOKEN AND GAINING ACCESS

The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done. This will allow an attacker with the token modify parameters of security, access or even steal the session without the legitimate and active session...

CVE-2023-53689

Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting XSS vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly...

CVE-2023-53689 Nagios Fusion < 4.2.0 License Information Reflected XSS

Nagios Fusion versions prior to 4.2.0 contain a reflected cross-site scripting XSS vulnerability in the license key configuration flow that can result in execution of attacker-controlled script in the browser of a user who follows a crafted URL. While the application server itself is not directly...

📄 Wisenshop Cross Site Scripting

Wisenshop suffers from a cross site scripting vulnerability. It is unclear what version is affected as they are not published where this software is sold. Exploit Title: Wisenshop - Stored XSS Exploit Author: CraCkEr Date: 11-10-2025 Author of Script: Wisencode Infotech Vendor: Wisencode Infotech...

Cross-site Scripting (XSS)

org.apache.geode, geode-web-api is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization of user input in the web API REST interface, which allows an attacker to inject malicious scripts and execute arbitrary code on the returned page, potentially leading to...

CVE-2025-60280

CVE-2025-60280 affects Bang Resto v1.0 and is described as a Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization or output encoding. The vulnerability could allow attacker-controlled input to be rendered in the browser, enabling potential theft of session cookies, u...

EUVD-2025-34815

bagisto has Cross Site Scripting XSS in Create New Customer...

bagisto has Cross Site Scripting (XSS) in Create New Customer

Summary In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to reflected / stored Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later...

EUVD-2024-55032

Apache Geode web-api is vulnerable to Cross-site Scripting...

Apache Geode web-api is vulnerable to Cross-site Scripting

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

CVE-2024-44088

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

CVE-2024-44088 Apache Geode: Reflected XSS

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

CVE-2024-44088 Apache Geode: Reflected XSS

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

CVE-2024-44088

Apache Geode web-api (REST) is affected by a Cross-site Scripting (XSS) vulnerability that can be exploited when a logged-in user is tricked into clicking a crafted link, potentially enabling code execution on the victim page and leading to session information theft or account takeover. All Geode...

CVE-2025-40772

A vulnerability has been identified in SiPass integrated All versions V3.0. Affected server applications are vulnerable to stored Cross-Site Scripting XSS, allowing an attacker to inject malicious code that can be executed by other users when they visit the affected page. Successful exploitation...

EUVD-2025-34159

A vulnerability has been identified in SiPass integrated All versions V3.0. Affected server applications are vulnerable to stored Cross-Site Scripting XSS, allowing an attacker to inject malicious code that can be executed by other users when they visit the affected page. Successful exploitation...