3931 matches found
CVE-2026-25472
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeFusion Fusion Builder fusion-builder allows Stored XSS.This issue affects Fusion Builder: from n/a through = 3.14.1...
CVE-2026-27059
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through = 4.1...
CVE-2026-25411
Cross-Site Request Forgery CSRF vulnerability in themastercut Revision Manager TMC revision-manager-tmc allows Cross Site Request Forgery.This issue affects Revision Manager TMC: from n/a through = 2.8.22...
CVE-2019-25359 SD.NET RIM 4.7.3c - 'idtyp' SQL Injection
SD.NET RIM versions before 4.7.3c contain a SQL injection vulnerability that allows attackers to inject malicious SQL statements through POST parameters 'idtyp' and 'idgremium'. Attackers can exploit this vulnerability by crafting specially formed POST requests to the /vorlagen/ endpoint, enablin...
PT-2026-20788
Name of the Vulnerable Software and Affected Versions LibreNMS versions 26.1.1 and below Description LibreNMS, an auto-discovering PHP/MySQL/SNMP based network monitoring tool, contains a Stored Cross-Site Scripting XSS issue. The device group name is not sanitized, allowing attackers with admin...
PT-2026-20396
Reflected Cross-Site Scripting XSS vulnerability in the Graylog Web Interface console, version 2.2.3, caused by a lack of proper sanitization and escaping in HTML output. Several endpoints include segments of the URL directly in the response without applying output encoding, allowing an attacker ...
CVE-2026-2101
A Reflected Cross-site Scripting XSS vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 allows an attacker to execute arbitrary script code in user's browser session...
CODTECH-Task2-Web-Vuln-Scanner
No d...
SHARP MFPs Stored Cross-Site Scripting (CVE-2024-48870)
Sharp and Toshiba Tec MFPs improperly validate input data in URI data registration, resulting in a stored cross-site scripting vulnerability. If crafted input is stored by an administrative user, malicious script may be executed on the web browsers of other victim users. This plugin only works wi...
CVE-2025-59904
Stored Cross-Site Scripting XSS vulnerability in Kubysoft, which is triggered through multiple parameters in the '/kForms/app' endpoint. This issue allows malicious scripts to be injected and executed persistently in the context of users accessing the affected resource...
CVE-2025-59905
CVE-2025-59905 describes a reflected XSS vulnerability in Kubysoft, triggered via multiple parameters to the endpoint /node/kudaby/nodeFN/procedure. The flaw allows arbitrary client-side scripts to be injected and reflected in the HTTP response, executed in the victim’s browser. The provided metr...
PT-2026-8371
Smoothwall Express 3.1-SP4-polar-x86 64-update9 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting crafted input to the ipblock.cgi endpoint. Attackers can inject script tags through the SRC IP and COMMENT...
Kubysoft 跨站脚本漏洞
Kubysoft is an IT asset management software developed by the Spanish company Kubysoft. Kubysoft has a cross-site scripting vulnerability. This vulnerability stems from multiple parameters in the /node/kudaby/nodeFN/procedure endpoints, which are vulnerable to reflection-based cross-site scripting...
Smoothwall Express 安全漏洞
Smoothwall Express is Smoothwall open source a GNU/Linux-based firewall operating system . Smoothwall Express has a cross-site scripting vulnerability. The vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the NTPSERVER parameter of the time.cgi...
CVE-2019-25373
OPNsense 19.1 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input to the category parameter. Attackers can send POST requests to firewallrulesedit.php with script payloads in the category field to execute...
EUVD-2019-19423
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. Attackers can submit crafted payloads through POST requests to diagtraceroute.php to execute...
cyart-vapt-week-2
cyart-vapt-team This repository contains the Week 2 VAPT lab w...
CVE-2025-70094
CVE-2025-70094 describes an XSS flaw in the OpenSourcePOS 3.4.1 Generate Item Barcode function. The vulnerability allows an attacker to inject crafted payloads into the Item Category parameter, enabling execution of arbitrary web scripts/HTML in the victim’s browser. The issue affects the Generat...
CVE-2019-25320 elearning-script 1.0 - Authentication Bypass
E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentials by manipulating login parameters. Attackers can exploit the /login.php file by sending a specific payload '=''or' to bypass authentication and gain...