bagisto has Cross Site Scripting (XSS) in Create New Customer

Summary In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to reflected / stored Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields. These payloads may later...

PT-2025-42533

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.8 Description Bagisto version 2.3.7 contains a Cross-Site Scripting XSS issue within the “Create New Customer” feature in the admin panel. An attacker who can access the admin create-customer form can inject...

CVE-2025-62414: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the “Create New Customer” feature in the admin panel is vulnerable to Cross-Site Scripting XSS. An attacker with access to the admin create-customer form can inject malicious JavaScript payloads into certain input fields...

Apache Geode web-api is vulnerable to Cross-site Scripting

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

EUVD-2024-55032

Apache Geode web-api is vulnerable to Cross-site Scripting...

CVE-2024-44088

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

CVE-2024-44088

Apache Geode versions prior to 1.15.2 are vulnerable to a Cross-site Scripting (XSS) flaw in the web-api (REST) interface. The root cause is the improper sanitization of user input , which allows an attacker to inject malicious scripts by tricking a logged-in user into clicking a specially-crafte...

CVE-2024-44088 Apache Geode: Reflected XSS

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

CVE-2024-44088 Apache Geode: Reflected XSS

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

CVE-2025-40772

A vulnerability has been identified in SiPass integrated All versions V3.0. Affected server applications are vulnerable to stored Cross-Site Scripting XSS, allowing an attacker to inject malicious code that can be executed by other users when they visit the affected page. Successful exploitation...

EUVD-2025-34159

A vulnerability has been identified in SiPass integrated All versions V3.0. Affected server applications are vulnerable to stored Cross-Site Scripting XSS, allowing an attacker to inject malicious code that can be executed by other users when they visit the affected page. Successful exploitation...

CVE-2025-40772

A vulnerability has been identified in SiPass integrated All versions V3.0. Affected server applications are vulnerable to stored Cross-Site Scripting XSS, allowing an attacker to inject malicious code that can be executed by other users when they visit the affected page. Successful exploitation...

CVE-2025-40772

A vulnerability has been identified in SiPass integrated All versions V3.0. Affected server applications are vulnerable to stored Cross-Site Scripting XSS, allowing an attacker to inject malicious code that can be executed by other users when they visit the affected page. Successful exploitation...

PT-2025-41884

Name of the Vulnerable Software and Affected Versions SiPass integrated versions prior to 3.0 Description The SiPass integrated server applications are susceptible to stored Cross-Site Scripting XSS. Successful exploitation enables an attacker to inject malicious code that executes in other users...

Siemens SiPass integrated 跨站脚本漏洞

Siemens SiPass Integrated is a powerful and extremely flexible access control system from Siemens, Germany. A cross-site scripting vulnerability exists in versions prior to Siemens SiPass integrated V3.0, which stems from susceptibility to a stored cross-site scripting attack that could allow an...

Apache Geode 安全漏洞

Apache Geode is a U.S.-based Apache Foundation suite of management platforms used in distributed cloud architectures to provide real-time and consistent access to data for data-intensive applications. A security vulnerability exists in Apache Geode versions prior to 1.15.2 that originates from we...

PT-2025-41925

Name of the Vulnerable Software and Affected Versions Apache Geode versions prior to 1.15.2 Description A malicious script injection issue exists in the Apache Geode web-api REST. An attacker can trick a logged-in user into clicking a specially-crafted link, leading to code execution on the...

CVE-2024-44088: Improper Neutralization of Input During Web Page Generation

Malicious script injection 'Cross-site Scripting' vulnerability in Apache Geode web-api REST. This vulnerability allows an attacker that tricks a logged-in user into clicking a specially-crafted link to execute code on the returned page, which could lead to theft of the user's session information...

CVE-2025-40640

Energy CRM v2025 (Status Tracker Ltd) contains a stored Cross-Site Scripting (XSS) flaw exploitable via a POST to /crm/create_invoice_submit.php using the customerName_0 parameter. Lack of input validation allows a remote attacker to craft a query that could be processed by an authenticated user,...

CVE-2025-40640: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request to “/crm/createinvoicesubmit.php”, using the “customerName0” parameter. This vulnerability could allow a...