Improve Your Security with Attack Insights in Web Security Analytics

...

CVE-2025-5034 WP File Download < 6.2.6 - Reflected XSS

The wp-file-download WordPress plugin before 6.2.6 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

Cross-site Scripting (XSS)

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via TokenReplace operations when handling input in some SkinObjects. An attacker can execute arbitrary...

CVE-2025-52707

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored XSS.This issue affects Firelight Lightbox: from n/a through = 2.3.16...

PT-2025-26369 · Unknown · Fridaysystems Inventory Presser

Name of the Vulnerable Software and Affected Versions: fridaysystems Inventory Presser versions through 15.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

WordPress plugin Buying Buddy IDX CRM 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. The WordPress Buying Buddy IDX CRM plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of...

PT-2025-26397 · Stellarwp · Stellarwp Wpcomplete

Name of the Vulnerable Software and Affected Versions: StellarWP WPComplete versions n/a through 2.9.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-26384 · Unknown · Xootix Login/Signup Popup

Name of the Vulnerable Software and Affected Versions: xootix Login/Signup Popup versions n/a through 2.9.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in the xootix Login/Signup Popu...

The vulnerability of Adobe Experience Manager’s content and media data management system lies in the insufficient protection of website structures, which allows attackers to carry out XSS attacks.

The vulnerability of the Adobe Experience Manager content and media data management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to carry out XSS attacks...

The Network Configuration Manager (NCM) software, which is related to the failure to protect the structure of web pages, allows attackers to carry out XSS attacks.

The Network Configuration Manager NCM software is associated with the failure to take measures to protect the structure of web pages. Exploiting this vulnerability can allow a malicious actor to carry out XSS attacks remotely...

CVE-2025-49316

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Saleswonder Team: Tobias WP2LEADS wp2leads allows Reflected XSS.This issue affects WP2LEADS: from n/a through = 3.5.0...

CVE-2025-6069

The html.parser.HTMLParser class had worse-case quadratic complexity when processing certain crafted malformed inputs potentially leading to amplified denial-of-service...

WordPress Raisely Donation Form Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Raisely Donation Form, which stems from insufficient cleanup and escaping of user-supplied attribute inputs in the...

Astra Linux – Vulnerability in PHP 8.2

In PHP versions starting from 8.1. up to 8.1.32, and from 8.2. up to 8.2.28, and from 8.3. up to 8.3.19, as well as in PHP versions starting from 8.4. up to 8.4.5, headers that lack a colon : are treated as valid headers, even though they are not. This can cause applications to accept invalid...

BIT-GITLAB-2025-4278 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting with 18.0 before 18.0.2. Under certain conditions html injection in new search page could lead to account takeover...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-15841)

Adobe Experience Manager is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. Adobe...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-15744)

Adobe Experience Manager is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

Adobe Experience Manager cross-site scripting vulnerability (CNVD-2025-15541)

Adobe Experience Manager is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2025-49004

Caido is a web security auditing toolkit. Prior to version 0.48.0, due to the lack of protection for DNS rebinding, Caido can be loaded on an attacker-controlled domain. This allows a malicious website to hijack the authentication flow of Caido and achieve code execution. A malicious website load...

PT-2025-25253 · Joomla · Media Gallery

Name of the Vulnerable Software and Affected Versions: RSMediaGallery! component versions 1.7.4 through 2.1.7 Description: A SQL injection issue was discovered in the dashboard component of the RSMediaGallery! component for Joomla. The problem arises because user-supplied input is not properly...