3956 matches found
CVE-2025-59593
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through 1.0.334...
CVE-2025-49908
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPClever WPC Countdown Timer for WooCommerce wpc-countdown-timer allows Stored XSS.This issue affects WPC Countdown Timer for WooCommerce: from n/a through = 3.1.4...
CVE-2025-39534
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Somonator Terms Dictionary terms-dictionary allows Reflected XSS.This issue affects Terms Dictionary: from n/a through = 1.5.1...
CVE-2025-52753
CVE-2025-52753 affects the WordPress plugin Contact Form by Supsystic (versions up to and including 1.7.35). The issue is a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient input filtering/escaping in web page generation, allowing an attacker to inject arbitrary script vi...
PT-2025-43205
Name of the Vulnerable Software and Affected Versions Jonatan Jumbert WPCode Content Ratio versions through 2.0 Description The software contains a flaw due to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This means that malicio...
PT-2025-43206
Name of the Vulnerable Software and Affected Versions Shortcode Generator versions through 1.1 Description The software contains a flaw related to improper input handling during web page creation, which allows for Reflected Cross-site Scripting XSS. This means that malicious code can be injected...
CVE-2023-53691
CVE-2023-53691 affects Hikvision CSMP iSecure Center prior to or through 2023-06-25, where a directory traversal flaw in /center/api/files enables file upload. Exploitation has been observed in the wild during 2024 and 2025. The vulnerability arises from improper handling of file paths in the fil...
EUVD-2025-35299
Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications component: Security Management System. Supported versions that are affected are 2.9.0.0.0-7.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with...
CVE-2025-12031 HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute
HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
CVE-2025-10612
CVE-2025-10612 concerns giSoft Information Technologies City Guide. Connected sources confirm a reflected XSS flaw caused by improper input neutralization during web page generation, affecting City Guide versions prior to 1.4.45. The vulnerability permits injection that is reflected back in the r...
Web-Security-Assessment-Suite-based-on-OWASP-Top-10
Web-Security-Assessment-Suite-based-on-OWASP-Top-10 A...
CVE-2025-62701 Stored XSS through system messages
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44...
EUVD-2025-35132
Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Mediawiki Foundation - Springboard Extension: master...
Liferay Portal和Liferay DXP 跨站脚本漏洞
Liferay Portal and Liferay DXP are both products of Liferay, Inc.Liferay Portal is a J2EE-based portal solution. The solution uses technologies such as EJB as well as JMS and can be used as a Web publishing and sharing workspace, enterprise collaboration platform, social network, etc. Liferay DXP...
D-Link DI-7001 MINI Buffer Overflow Vulnerability
D-Link DI-7001 MINI is a multi-functional intelligent gateway from China AUO D-Link. The D-Link DI-7001 MINI suffers from a buffer overflow vulnerability, which is caused by incorrect bounds checking of functions in the file /dbsrv.asp. An attacker could exploit the vulnerability to execute...
CVE-2025-60280
CVE-2025-60280 affects Bang Resto v1.0 and is described as a Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization or output encoding. The vulnerability could allow attacker-controlled input to be rendered in the browser, enabling potential theft of session cookies, u...
CVE-2025-62652
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation MediaWiki WebAuthn extension allows Stored XSS.This issue affects MediaWiki WebAuthn extension: 1.39, 1.43, 1.44...
CVE-2025-62664 Stored XSS through a system message in ImageRating
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - ImageRating Extension allows Stored XSS.This issue affects Mediawiki - ImageRating Extension: from master before 1.39...
CVE-2025-11851 Apeman ID71 set_alias.cgi cross site scripting
A vulnerability has been found in Apeman ID71 EN75.8.53.20. The affected element is an unknown function of the file /setalias.cgi. Such manipulation of the argument alias leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be...