Scada-LTS 代码注入漏洞

Scada-LTS is an open source, web-based, multi-platform solution from Scada-LTS Open Source. A code injection vulnerability exists in Scada-LTS version 2.7.8.1, which stems from improper manipulation of the pointHierarchy/new/fileTitle parameter and could lead to a cross-site scripting attack...

CVE-2025-45313

A cross-site scripting XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter...

CVE-2025-8921

A vulnerability has been found in code-projects Job Diary 1.0. Affected by this issue is some unknown functionality of the file /user-apply.php. The manipulation of the argument jobtitle leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and...

CVE-2025-8921

Code-Projects Job Diary 1.0 is affected by a SQL injection in /user-apply.php via the job_title parameter. Several connected documents confirm remote exploitation and public disclosure of the exploit. The exact vulnerable functionality is unknown beyond that the issue arises in /user-apply.php. R...

CVE-2025-45313

A cross-site scripting XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter...

Code-Projects Job Diary 注入漏洞

Job Diary is a job diary software. Job Diary suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter jobtitle in the file /user-apply.php. An attacker can exploit this vulnerability to execute illegal SQL commands to...

HortusFox 安全漏洞

HortusFox is a free and open source self-hosted plant manager system from HortusFox, Inc. A security vulnerability exists in HortusFox v4.4 that stems from a cross-site scripting attack due to misuse of the parameter title in the /tasks endpoint...

PT-2025-33060 · Unknown · Hortusfox-Web

Name of the Vulnerable Software and Affected Versions: hortusfox-web version 4.4 Description: A cross-site scripting XSS vulnerability exists in the /tasks endpoint. Attackers can execute arbitrary JavaScript in the context of a user's browser by injecting a crafted payload into the title...

CVE-2025-45313

The hortusfox-web v4.4 software is affected by a cross-site scripting (XSS) vulnerability located in the /tasks endpoint. The root cause is the improper handling of the title parameter, which allows an attacker to inject a crafted payload and execute arbitrary JavaScript within the context of a u...

CVE-2025-45313

A cross-site scripting XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter...

CVE-2025-45313

A cross-site scripting XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter...

CVE-2025-45313

A cross-site scripting XSS vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the title parameter...

CVE-2025-50270

A stored Cross Site Scripting xss vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code via a crafted script to the title, categoryTitle, and tmpTag parameters...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through crafted requests. An attacker can execute arbitrary scripts in the context of a user's browser by submitting crafted input to the title, categoryTitle, or tmpTag parameters. Details Cross-site scripting ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through crafted requests. An attacker can execute arbitrary scripts in the context of a user's browser by submitting crafted input to the title, categoryTitle, or tmpTag parameters. Details Cross-site scripting ...

CVE-2025-6385 WP Applink <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter

The WP Applink plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

CVE-2025-6385 WP Applink <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter

The WP Applink plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and...

ZVING ZCMS 代码注入漏洞

ZVING ZCMS Zeyuan Web Content Management System is an enterprise-level web content management software from China Zeyuan Software ZVING Company. A code injection vulnerability exists in ZVING ZCMS version 3.6.0, which originates from improper handling of the parameter Title in the component Creat...

bicycleSharingServer 注入漏洞

bicycleSharingServer is a bicycle sharing JavaWEB backend for huija individual developers in China. An injection vulnerability exists in bicycleSharingServer, which stems from improper manipulation of the Title parameter in the searchAdminMessageShow function in the AdminController.java file, whi...

Notice Board System manage-notices.php file cross-site scripting vulnerability

Notice Board System is a bulletin board system. Notice Board System has a cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the parameters Title/Description in the file /admin/manage-notices.php, which can be...