CVE-2025-49192

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of...

CVE-2025-29756 MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters

SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devices to the user's web browser. The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to. While...

CVE-2025-29756 MQTT implementation in Sungrow iSolarCloud allowed users to subscribe to all data of all connected inverters

SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devices to the user's web browser. The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to. While...

Traffic Offense Reporting System saveuser.php File Cross-Site Scripting Vulnerability

Traffic Offense Reporting System is a traffic violation reporting system. Traffic Offense Reporting System has a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the saveuser.php file parameters...

Freescout String Formatting Vulnerability

FreeScout is an open source helpdesk system built on the PHP Laravel framework, designed to provide users with functionality similar to Zendesk or Help Scout, but without sacrificing privacy or freedom. Freescout suffers from a string formatting vulnerability that stems from insufficient validati...

TOTOLINK A3002RU MAC Filtering Page Component Cross-Site Scripting Vulnerability

TOTOLINK A3002RU is a wireless router product from China's Gion Electronics TOTOLINK. A cross-site scripting vulnerability exists in the TOTOLINK A3002RU, which stems from the lack of effective filtering and escaping of user-supplied data by the MAC Filtering Page component parameter Comment, for...

WordPress Bold Page Builder plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Bold Page Builder plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of...

WordPress WP Extended plugin cross-site scripting vulnerability

WordPress WP Extended plugin is a powerful WordPress plugin designed to extend the core WordPress functionality with all the essential tools needed to manage a professional WordPress website. WordPress WP Extended plugin suffers from a cross-site scripting vulnerability that stems from the...

WordPress FancyBox plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. WordPress FancyBox plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied data, whi...

Fortinet FortiOS Out-of-Bounds Read Vulnerability

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. An out-of-bounds read vulnerabili...

X2000R URL Address Parameter Cross-Site Scripting Vulnerability at Gion Electronics (Shenzhen) Co.

The X2000R is a wireless router from China's Gion Electronics TOTOLINK. Ltd. X2000R version 1.0.0-B20230726.1108 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the parameter URL Address, which can be exploite...

Cross-Site Scripting (XSS)

barryvdh/laravel-translation-manager is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to incorrect input validation and sanitization of user-input data, allowing attackers to inject arbitrary HTML or JavaScript code...

Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

Impact The application is vulnerable to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive...

CVE-2025-40675 Reflected Cross-Site Scripting (XSS) in Bagisto

A Reflected Cross-Site Scripting XSS vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to stea...

CVE-2025-40675 Reflected Cross-Site Scripting (XSS) in Bagisto

A Reflected Cross-Site Scripting XSS vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to stea...

PT-2025-24503 · WordPress · Backup/Staging By Wp Time Capsule

Name of the Vulnerable Software and Affected Versions: Backup and Staging by WP Time Capsule versions 1.22.23 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This means an...

PT-2025-24416 · Bagisto · Bagisto

Name of the Vulnerable Software and Affected Versions: Bagisto version 2.0.0 Description: A Reflected Cross-Site Scripting XSS issue has been found, allowing an attacker to execute JavaScript code in the victim's browser by sending a malicious URL using the query parameter in the "/search" API...

PT-2025-24489 · Lambertgroup · Lambertgroup Universal Video Player

Name of the Vulnerable Software and Affected Versions: LambertGroup Universal Video Player versions 3.8.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that a...

PT-2025-24493 · Unknown · Sneeit Flatnews

Name of the Vulnerable Software and Affected Versions: Sneeit FlatNews versions n/a through 5.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an attacker can injec...

Empower Users and Protect Against GenAI Data Loss

When generative AI tools became widely available in late 2022, it wasn't just technologists who paid attention. Employees across all industries immediately recognized the potential of generative AI to boost productivity, streamline communication and accelerate work. Like so many waves of...