3933 matches found
CVE-2025-15435
CVE-2025-15435 affects Yonyou KSOA 9.0. The vulnerability is an SQL injection in an unknown functionality of file /worksheet/work_update.jsp, triggered by manipulating the Report argument. The attack can be initiated remotely and an exploit has been published; vendor response is not provided. Con...
CVE-2025-15432 yeqifu carRental com.yeqifu.sys.controller.FileController downloadShowFile.action downloadShowFile path traversal
A vulnerability has been found in yeqifu carRental up to 3fabb7eae93d209426638863980301d6f99866b3. This vulnerability affects the function downloadShowFile of the file /file/downloadShowFile.action of the component com.yeqifu.sys.controller.FileController. The manipulation of the argument path...
CVE-2025-15424 Yonyou KSOA HTTP GET Parameter agent_worksdel.jsp sql injection
A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agentworksdel.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The...
CVE-2025-49337
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in janhenckens Dashboard Beacon wp-dashboard-beacon allows Stored XSS.This issue affects Dashboard Beacon: from n/a through = 1.2.0...
PHPEMS 安全漏洞
PHPEMS is a PHP online practice exam system from PHPEMS open source. A security vulnerability exists in PHPEMS 11.0 and earlier versions, which stems from vulnerability to cross-site request forgery attacks...
EUVD-2025-206078
STVS ProVision 5.9.10 contains a cross-site scripting vulnerability in the 'files' POST parameter that allows authenticated attackers to inject arbitrary HTML code. Attackers can exploit the unvalidated input to execute malicious scripts within a user's browser session in the context of the...
CVE-2025-23705
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Terry Zielke Zielke Design Project Gallery zielke-design-project-gallery allows Reflected XSS.This issue affects Zielke Design Project Gallery: from n/a through = 2.5.0...
CVE-2021-47725
CVE-2021-47725 affects STVS ProVision 5.9.10. The vulnerability is an authenticated, reflected cross-site scripting flaw in the HTML context via the POST parameter named “files,” where input is not properly validated. Exploitation allows an attacker with credentials to inject arbitrary HTML/JS th...
CVE-2021-47725 STVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting via Files Parameter
STVS ProVision 5.9.10 contains a cross-site scripting vulnerability in the 'files' POST parameter that allows authenticated attackers to inject arbitrary HTML code. Attackers can exploit the unvalidated input to execute malicious scripts within a user's browser session in the context of the...
CVE-2025-23608
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Omar Mohamed Mohamoud LIVE TV live-tv allows Reflected XSS.This issue affects LIVE TV: from n/a through = 1.2...
CVE-2025-63021
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in codetipi Valenti Engine valenti-engine allows DOM-Based XSS.This issue affects Valenti Engine: from n/a through = 1.0.3...
CVE-2025-62149
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Stored XSS.This issue affects Add Custom Codes: from n/a through = 4.80...
EUVD-2025-205966
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Plainware Locatoraid Store Locator allows Stored XSS.This issue affects Locatoraid Store Locator: from n/a through 3.9.65...
EUVD-2025-205967
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Webvitaly Extra Shortcodes allows Stored XSS.This issue affects Extra Shortcodes: from n/a through 2.2...
Esri ArcGIS Server 代码问题漏洞
Esri ArcGIS Server is a web-oriented enterprise software platform available for providing geolocation services from Esri. A code issue vulnerability exists in Esri ArcGIS Server 11.5 and prior versions that stems from not properly validating an uploaded file, which could result in the upload of a...
PT-2025-54324
Name of the Vulnerable Software and Affected Versions zookatron MyBookTable Bookstore versions through 3.5.5 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential Cross-site Scripting XSS issue. Specifically, this...
PT-2025-54414
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in eLEOPARD Behance Portfolio Manager allows Stored XSS.This issue affects Behance Portfolio Manager: from n/a through 1.7.5...
PT-2025-54299
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shuttlethemes Shuttle allows Stored XSS.This issue affects Shuttle: from n/a through 1.5.0...
CVE-2025-68868
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in codeaffairs Wp Text Slider Widget wp-text-slider-widget allows Stored XSS.This issue affects Wp Text Slider Widget: from n/a through = 1.0...