CVE-2025-40730

HTML injection in Vox Media's Chorus CMS. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the 'q' parameter in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to...

CVE-2025-40730

The CVE-2025-40730 entry concerns HTML injection in Vox Media’s Chorus CMS. The vulnerability arises from an injection in the /search?q parameter, allowing an attacker to execute JavaScript in a victim’s browser and potentially steal session cookies or perform actions on behalf of the user. Affec...

PT-2025-31063 · Vox Media · Horus Cms

Name of the Vulnerable Software and Affected Versions: Vox Media Chorus CMS affected versions not specified Description: An HTML injection issue exists in Vox Media’s Chorus CMS. An attacker can execute JavaScript code in a victim’s browser by sending a malicious URL utilizing the q parameter in...

PT-2025-27927 · Unknown · The Beautiful Cookie Consent Banner

Name of the Vulnerable Software and Affected Versions: Nikel Beautiful Cookie Consent Banner versions through 4.6.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2025-27103 · Sneeit · Sneeit Magone

Name of the Vulnerable Software and Affected Versions: Sneeit MagOne versions through 8.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inject...

PT-2025-26852 · C3Crm · C3Crm

Name of the Vulnerable Software and Affected Versions: c3crm versions up to 3.0.4 Description: A cross-site scripting XSS issue in the /Login.php component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login error parameter. This enables attacke...

PT-2025-26386 · Unknown · Sparkle Themes Fitness Park

Name of the Vulnerable Software and Affected Versions: Sparkle Themes Fitness Park versions n/a through 1.1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attack...

CVE-2025-40675 Reflected Cross-Site Scripting (XSS) in Bagisto

A Reflected Cross-Site Scripting XSS vulnerability has been found in Bagisto v2.0.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the parameter 'query' in '/search'. This vulnerability can be exploited to stea...

PT-2025-24416 · Bagisto · Bagisto

Name of the Vulnerable Software and Affected Versions: Bagisto version 2.0.0 Description: A Reflected Cross-Site Scripting XSS issue has been found, allowing an attacker to execute JavaScript code in the victim's browser by sending a malicious URL using the query parameter in the "/search" API...

PT-2025-24493 · Unknown · Sneeit Flatnews

Name of the Vulnerable Software and Affected Versions: Sneeit FlatNews versions n/a through 5.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means that an attacker can injec...

PT-2025-24489 · Lambertgroup · Lambertgroup Universal Video Player

Name of the Vulnerable Software and Affected Versions: LambertGroup Universal Video Player versions 3.8.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that a...

CVE-2024-3509

A stored cross-site scripting XSS vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section. To exploit this vulnerability, a malicious actor must have a valid user account with administrative...

CVE-2024-3509

A stored cross-site scripting XSS vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section. To exploit this vulnerability, a malicious actor must have a valid user account with administrative...

CVE-2024-3509 Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor

A stored cross-site scripting XSS vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section. To exploit this vulnerability, a malicious actor must have a valid user account with administrative...

CVE-2024-3509 Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor

A stored cross-site scripting XSS vulnerability exists in the Management Console of multiple WSO2 products due to insufficient input validation in the Rich Text Editor within the registry section. To exploit this vulnerability, a malicious actor must have a valid user account with administrative...

CVE-2024-3509

CVE-2024-3509 is a stored XSS in the Management Console of multiple WSO2 products caused by insufficient input validation in the Rich Text Editor within the registry section. Exploitation requires a valid admin account; a successful attack can inject persistent JavaScript payloads to exfiltrate d...

PT-2025-23084 · Unknown · Real Easy Store

Name of the Vulnerable Software and Affected Versions: Real Easy Store affected versions not specified Description: A Reflected Cross-Site Scripting XSS issue allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL using the keyword parameter in...

CVE-2024-43006

A stored cross-site scripting XSS vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. An attacker can exploit this vulnerability by sending a specially crafted POST request to /user/askedit.php?action=add, which includes malicious JavaScript code in the 'content' parameter. Whe...

CVE-2023-33387

A reflected cross-site scripting XSS vulnerability in DATEV eG Personal-Management System Comfort/Comfort Plus v15.1.0 to v16.1.1 P4 allows attackers to steal targeted users' login data by sending a crafted link...

PT-2025-22763 · Unknown · Mortgage Calculator Bmi Adult & Kid Calculator

Name of the Vulnerable Software and Affected Versions: Mortgage Calculator BMI Adult & Kid Calculator versions 1.2.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This...