CVE-2025-23056 Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the...

CVE-2025-23056 Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the...

CVE-2025-23055

CVE-2025-23055 concerns HPE Aruba Networking Fabric Composer’s web management interface. The vulnerability enables an authenticated remote attacker to perform a stored cross-site scripting (XSS) attack, allowing execution of arbitrary script code in a victim’s browser within the compromised inter...

CVE-2025-23055 Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the...

CVE-2025-23055 Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Aruba Networking Fabric Composer Web Management Interface

A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting XSS attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the...

PT-2025-5627 · Fortinet · Fortiproxy +2

Name of the Vulnerable Software and Affected Versions: FortiOS affected versions not specified FortiProxy affected versions not specified Description: A weakness in the web-based management interfaces of Fortinet Fortigate firewall devices allows attackers to gain administrator access to the...

CVE-2025-23051

CVE-2025-23051 affects ArubaOS (AOS-8 through AOS-10) — a web-based management interface vulnerability allows an authenticated user to perform parameter injection to overwrite arbitrary system files. Root cause: parameter injection in the authenticated context. Impact: potential compromise of sys...

CVE-2025-20620

SQL Injection vulnerability exists in STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may obtain the administrative password of the web management page...

CVE-2025-20620

CVE-2025-20620 is a SQL Injection affecting STEALTHONE D220/D340 (and related models). The vulnerability could allow an unauthenticated attacker with network access to obtain the administrative password on the web management page. Root cause cited in a PT Security advisory points to lack of prote...

CVE-2024-12398

An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00ACLE.3 and WBE660S firmware versions through 6.70ACGG.2 could allow an authenticated user with limited privileges to escalate their privileges to that of an...

CVE-2024-12398

An improper privilege management vulnerability in the web management interface of the Zyxel WBE530 firmware versions through 7.00ACLE.3 and WBE660S firmware versions through 6.70ACGG.2 could allow an authenticated user with limited privileges to escalate their privileges to that of an...

PT-2025-4793 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS versions AOS-8 through AOS-10 Description: An authenticated parameter injection vulnerability exists in the web-based management interface of the ArubaOS. Successful exploitation could allow an authenticated user to leverage parameter...

CVE-2025-22599 WeGIA has a Cross-Site Scripting (XSS) Reflected endpoint `home.php` parameter `msg_c`

WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability was identified in the home.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msgc parameter. This vulnerability is fixed in 3.2.8...

CVE-2025-20167

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...

CVE-2025-20168

Cisco Common Services Platform Collector (CSPC) web-based management interface is vulnerable to cross-site scripting (XSS) due to insufficient input validation. An authenticated, remote attacker with at least a low-privilege account can inject malicious code into specific pages to execute scripts...

CVE-2025-20167

CVE-2025-20167 (Cisco CSPC) describes a cross-site scripting (XSS) vulnerability in the web-based management interface of Cisco Common Services Platform Collector (CSPC). The issue stems from insufficient validation of user-supplied input in the interface. An attacker with at least a low-privileg...

CVE-2025-20167 Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...

CVE-2025-20167 Cisco Common Services Platform Collector Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...

PT-2025-1020 · Cisco · Cisco Crosswork Network Controller

Name of the Vulnerable Software and Affected Versions: Cisco Crosswork Network Controller affected versions not specified Description: The vulnerability exists in the web-based management interface of Cisco Crosswork Network Controller due to improper validation of user-supplied input. An...

PT-2025-1294 · Unknown · Stealthone D220 +2

Name of the Vulnerable Software and Affected Versions: STEALTHONE D220/D340/D440 affected versions not specified Description: A user with administrative privileges who logs in to the web management page of the affected product may execute an arbitrary OS command. The vulnerability is related to t...