EUVD-2022-4892

Malicious code in bioql PyPI...

CVE-2025-43781

Reflected cross-site scripting XSS vulnerability in Liferay Portal 7.4.3.110 through 7.4.3.128, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.12 allows remote attackers to inject arbitrary web script or HTML via the URL in search bar portl...

Linux Distros Unpatched Vulnerability : CVE-2018-10095

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in Dolibarr before 7.0.2 allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to...

CVE-2025-43775

Stored cross-site scripting XSS vulnerability in Liferay Portal 7.4.0 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.5, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.12, and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via remote...

Mozilla Focus for iOS Cross-Site Scripting Vulnerability (CNVD-2025-19557)

Mozilla Focus for iOS is a privacy browser from the US-based Mozilla Foundation designed for iOS devices. A cross-site scripting vulnerability exists in versions prior to Mozilla Focus for iOS 142, which can be exploited by an attacker to execute arbitrary web script or HTML via injection of a...

Dell Unity Cross-Site Scripting Vulnerability (CNVD-2025-18244)

Dell Unity is a set of virtual Unity storage environments from Dell USA. A cross-site scripting vulnerability exists in Dell Unity 5.5 and earlier versions, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited by an attacker to...

CVE-2025-6690

The WP Tournament Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘field’ parameter in all versions up to, and including, 1.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

rsblog

Extension: RSBlog! Version: Old 1.14.4, 1.14.5 / New 1.14.6 Update details: Versions affected 1.11.6 to 1.14.5 Stored XSS allows remote authenticated attackers to inject arbitrary web script or HTML via the tag parameter. Fixed in 1.14.6 Update URL:...

CVE-2024-53288

CVE-2024-53288 is an XSS vulnerability in the NTP Region functionality of Synology Router Manager (SRM) versions prior to 1.3.1-9346-11. The issue allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified vectors. Affected product: Syno...

CVE-2024-53288

Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in NTP Region functionality in Synology Router Manager SRM before 1.3.1-9346-11 allows remote authenticated users with administrator privileges to inject arbitrary web script or HTML via unspecified...

CVE-2025-8015

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide link' fields in all versions up to, and including, 7.4.2 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2025-50126

A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to inject arbitrary web script or HTML via the jformtagstext parameter...

CVE-2025-50056 Extension - rsjoomla.com - Reflected XSS vulnerability RSMail! component 1.19.20-1.22.28 for Joomla

A reflected XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 28 Joomla was discovered. The issue allows remote attackers to inject arbitrary web script or HTML via the crafted parameter...

CVE-2025-5754

CVE-2025-5754 affects the WordPress plugin Useful Tab Block – Responsive & AMP-Compatible . The vulnerability is a Stored Cross-Site Scripting (XSS) via the className parameter caused by insufficient input sanitization and output escaping. It requires authentication at Contributor level or higher...

WordPress Contest Gallery plugin cross-site scripting vulnerability

WordPress Contest Gallery plugin is a powerful plugin that is mainly used to organize all kinds of online contests in WordPress websites, supporting the uploading and displaying of photos, videos, audios, documents and other types of files. WordPress Contest Gallery plugin suffers from a cross-si...

CVE-2025-28245

Cross-site scripting XSS vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body...

PT-2025-29130 · Alteryx · Alteryx Server

Name of the Vulnerable Software and Affected Versions: Alteryx Server version 2023.1.1.460 Description: A cross-site scripting XSS issue exists in Alteryx Server. This allows remote attackers to inject arbitrary web script or HTML through the notification body. Recommendations: Update Alteryx...

CVE-2025-2540

Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto library version 3.1.6 in various versions due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers,...

WordPress Color Palette plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Color Palette plugin, which stems from insufficient input cleanup and escaping, and can be exploited by an attacker ...

WordPress Auto Attachments plugin cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. WordPress Auto Attachments plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of user-supplied...