CVE-2025-2314

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13.5 due to insufficient input sanitization and output escaping on...

PT-2025-22644 · Suse · Spacewalk-Java

Name of the Vulnerable Software and Affected Versions: spacewalk-java versions prior to 4.3.85-150400.3.105.3 spacewalk-java versions prior to 5.0.24-150600.3.25.1 Description: A Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in spacewalk-java allows...

PT-2025-16911 · Hitachi Vantara · Analyzer +1

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 10.2.0.2, including 9.3.x and 8.3.x Description: The software does not properly neutralize user-controllable input before it is placed in output that is used as a web page,...

PT-2025-16603 · Wpcasa · Wpcasa

Name of the Vulnerable Software and Affected Versions: WPCasa versions through 1.3.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. Recommendations: For versions through 1.3.2, update t...

CVE-2024-40069

Sourcecodester Online ID Generator System 1.0 is affected by a Stored Cross-Site Scripting (XSS) flaw in id_generator/classes/Users.php?f=save, triggered by the POST parameters firstname and lastname. Root cause is unescaped user input leading to script execution in the context of authenticated/u...

CVE-2024-42200 HCL BigFix Web Reports is potentially susceptible to a Stored Cross-Site Scripting (XSS) attack

HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting XSS attack, due to a potentially weak validation of user input...

CVE-2024-42200

CVE-2024-42200 affects HCL BigFix Web Reports, where stored XSS can arise from weak input validation of user-supplied data. The consolidated sources describe the issue as a Stored Cross-Site Scripting vulnerability in the Web Reports component of HCL BigFix, with no detailed exploit path or confi...

CVE-2025-3573

Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting XSS in the showLabel function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary...

PT-2025-16313 · WordPress · Advance Wp Query Search Filter

Name of the Vulnerable Software and Affected Versions: Advance WP Query Search Filter versions 1.0.10 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS in the Advance WP Query...

PT-2025-16514 · Jetengine · Jetengine

Name of the Vulnerable Software and Affected Versions: JetEngine versions 3.6.4.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based Cross-site Scripting XSS. This means that an attacker could potentially inject...

PT-2025-16302 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns unvalidated user input in the Apache HTTP Server. No specific details about the number of potentially affected devices or real-world incidents are provided...

PT-2025-16327 · Fs Poster · Fs Poster

Name of the Vulnerable Software and Affected Versions: FS Poster versions n/a through 6.5.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables potential attackers to inject...

RHEL 7 : redhat-access-plugin-openstack (RHSA-2015:0645)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2015:0645 advisory. The Red Hat Support plug-in for Red Hat OpenStack is a Technology Preview feature which offers seamless integrated access to Red Hat subscription...

CVE-2024-13896

The WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a regular expression via the wpgeshifilterreplacecode function, which could lead to Regular Expression Denial of Service ReDoS issue...

Adobe ColdFusion Input Validation Error Vulnerability

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. An input validation error vulnerability exists in Adobe ColdFusion that stems from a failure to...

PT-2025-16059 · Vimeo & Youtube · Workbox Video

Name of the Vulnerable Software and Affected Versions: Workbox Video from Vimeo & Youtube versions 3.2.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This enables attackers to...

CVE-2025-30013

SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privileges, improperly handle user input, allowing attacker to inject arbitrary OS commands. This vulnerability allows the execution of unintende...

CVE-2024-13896

The WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a regular expression via the wpgeshifilterreplacecode function, which could lead to Regular Expression Denial of Service ReDoS issue...

Cross-Site Scripting (XSS)

drupal/core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper neutralization of user-supplied input during web page generation, which allows malicious scripts to be executed in the context of a user's browser...

CVE-2024-13896

CVE-2024-13896 affects WP-GeSHi-Highlight for WordPress up to version 1.4.3. The plugin processes user-supplied input as a regular expression in wp_geshi_filter_replace_code(), which could trigger a Regular Expression Denial of Service (ReDoS). This is described in multiple connected records (inc...