Fluxbb 安全漏洞

Fluxbb is a Php-based forum system organized by Fluxbb. A security vulnerability exists in Fluxbb version 1.5.11, which stems from the Forum Description Field in adminforums.php being vulnerable to cross-site scripting attacks...

IBM Security Guardium 跨站脚本漏洞

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. A cross-site scripting vulnerability exists in IBM Security...

PT-2025-21333

Name of the Vulnerable Software and Affected Versions: Bootstrap versions 3.4.1 through 3.4.x Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows attackers to run malicious scripts. A DOM-based XSS...

CVE-2025-47783 label-studio vulnerable to Cross-Site Scripting (Reflected) via the label_config parameter.

Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attack...

Dell Storage Manager Cross-Site Scripting Vulnerability

Dell Storage Manager is a centralized storage management platform from Dell that supports the configuration, monitoring and automated operation and maintenance of the full range of Dell EMC storage systems. A cross-site scripting vulnerability exists in Dell Storage Manager that originates from...

firefox: thunderbird: URL Bar Spoofing via non-BMP Unicode characters

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack...

libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect...

libsoup: Information disclosure may leads libsoup client sends Authorization header to a different host when being redirected by a server

A flaw was found in libsoup. When libsoup clients encounter an HTTP redirect, they mistakenly send the HTTP Authorization header to the new host that the redirection points to. This allows the new host to impersonate the user to the original host that issued the redirect...

PT-2025-20079 · Unknown · Chris Reynolds Progress Bar

Name of the Vulnerable Software and Affected Versions: Chris Reynolds Progress Bar versions through 2.2.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to...

PT-2025-20080 · Unknown · Cc Bmi Calculator

Name of the Vulnerable Software and Affected Versions: CC BMI Calculator versions n/a through 2.1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-20133 · Unknown · Ajay Top 10

Name of the Vulnerable Software and Affected Versions: Ajay Top 10 versions n/a through 4.1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. Recommendations: For versions n/a through...

WordPress plugin Beds24 Online Booking 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability exis...

PT-2025-20109

Name of the Vulnerable Software and Affected Versions SKT Skill Bar versions n/a through 2.4 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables attackers to inject malicious scripts...

PT-2025-20085 · Unknown · Meow Gallery

Name of the Vulnerable Software and Affected Versions: Meow Gallery versions through 5.2.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject maliciou...

CVE-2024-42212

HCL BigFix Compliance is affected by an improper or missing SameSite attribute. This can lead to Cross-Site Request Forgery CSRF attacks, where a malicious site could trick a user's browser into making unintended requests using authenticated sessions...

Webmin Privilege Escalation

The vulnerability in the Webmin server’s web control panel relates to the failure to handle CRLF sequences properly. Exploiting this vulnerability allows a malicious actor to enhance their privileges by sending specially crafted CGI requests remotely...

[SECURITY] Fedora 42 Update: chromium-136.0.7103.59-1.fc42

Chromium is an open-source web browser, powered by WebKit Blink...

WordPress plugin Abundatrade Plugin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

PHPGurukul Online Nurse Hiring System 安全漏洞

PHPGurukul Online Nurse Hiring System is an online nurse hiring system from PHPGurukul, Inc. A security vulnerability exists in version 1.0 of the PHPGurukul Online Nurse Hiring System that stems from improper handling of the file /admin/edit-nurse.php, which could lead to a SQL injection attack...

CVE-2025-28102

A cross-site scripting XSS vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the postContent parameter at /createpost...