PT-2025-11392

Name of the Vulnerable Software and Affected Versions otale Tale Blog version 2.0.5 Description A vulnerability was found in otale Tale Blog, affecting the function saveOptions of the file /options/save of the component Site Settings. The manipulation of the argument Site Title leads to cross-sit...

CVE-2025-1561

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-1561: Improper Neutralization of Input During Web Page Generation

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

ftcms 代码注入漏洞

ftcms is a content management system from ftcms Inc. A code injection vulnerability exists in version 2.1 of ftcms, which stems from an incorrect manipulation of the parameter title that could lead to a cross-site scripting attack...

CVE-2025-2133: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in ftcms 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/index.php/news/edit. The manipulation of the argument title leads to cross site scripting. The attack can be launched remotely. The exploit has been...

CVE-2025-2126: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the...

PT-2025-10454

Name of the Vulnerable Software and Affected Versions JoomlaUX JUX Real Estate version 3.4.0 Description A critical issue was found in the processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of...

JoomlaUX JUX Real Estate 注入漏洞

JoomlaUX JUX Real Estate is a Joomla component from JoomlaUX designed to meet a variety of real estate related needs. An injection vulnerability exists in JoomlaUX JUX Real Estate version 3.4.0, which stems from the fact that incorrect manipulation of the parameter title can lead to SQL injection...

PT-2025-10557

Name of the Vulnerable Software and Affected Versions ftcms version 2.1 Description A vulnerability was found in ftcms, affecting an unknown functionality of the file /admin/index.php/news/edit. The manipulation of the title argument leads to cross-site scripting. The attack can be launched...

WordPress FooGallery plugin <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size vulnerability

Authenticated Custom+ Stored Cross-Site Scripting via Album Title Size vulnerability discovered by Stiofan in WordPress Plugin FooGallery versions = 2.4.29...

PT-2025-10409

Name of the Vulnerable Software and Affected Versions The FooGallery – Responsive Photo Gallery plugin versions up to and including 2.4.29 Description The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the default galle...

MD5 Hash Collision Causes Overwriting of Papers with the Same Title, Leading to Data Loss

Description The ArxivReader class in LlamaIndex is responsible for searching for papers on ArXiv, downloading them, and processing them for AI model training. The workflow of ArxivReader is as follows: 1. The user searches for a specific topic on ArXiv, retrieving a list of relevant papers. impor...

CVE-2024-12611

The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 93.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

PT-2025-10059

Name of the Vulnerable Software and Affected Versions School Management System for Wordpress plugin versions up to, and including, 93.0.0 Description The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts via t...

CVE-2024-12611: Missing Authorization

The School Management System for Wordpress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 93.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2025-1875

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "searchtitle" parameter in search.php...

CVE-2025-1875

The CVE-2025-1875 entry documents an SQL injection in 101news version 1.0, exploitable via the searchtitle parameter in search.php. The vulnerability is described across multiple sources and indicates a critical impact, but the provided materials do not specify an exploit method, affected platfor...

CVE-2025-1807: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability, which was classified as problematic, was found in Eastnets PaymentSafe 2.5.26.0. This affects an unknown part of the file /directRouter.rfc of the component Edit Manual Reply Handler. The manipulation of the argument Title leads to basic cross site scripting. It is possible to...

Cross-site Scripting (XSS)

Overview getformwork/formwork is an a file-based Content Management System CMS to make and manage simple sites. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the title field in the panel/options/site page. An attacker can exploit this vulnerability by embedding...

GHSA-VF6X-59HH-332F Formwork has a cross-site scripting (XSS) vulnerability in Site title

Summary The site title field at /panel/options/site/allows embedding JS tags, which can be used to attack all members of the system. This is a widespread attack and can cause significant damage if there is a considerable number of users. Impact The attack is widespread, leveraging what XSS can do...