DNN 跨站脚本漏洞

DNN also known as DotNetNuke is a set of American DNN company by Microsoft support, based on the ASP.NET platform of open source content management system CMS. The system is easy to install, scalable, feature-rich and so on. A cross-site scripting vulnerability exists in versions prior to DNN...

CVE-2025-59573

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in CozyThemes Cozy Blocks cozy-addons allows Code Injection.This issue affects Cozy Blocks: from n/a through = 2.1.29...

CVE-2025-58648

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Stored XSS.This issue affects Simple JWT Login: from n/a through = 3.6.4...

CVE-2025-59586 WordPress Penci Portfolio Plugin <= 3.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Penci Portfolio penci-portfolio allows DOM-Based XSS.This issue affects Penci Portfolio: from n/a through = 3.5...

CVE-2025-53458

CVE-2025-53458 describes a Stored Cross-Site Scripting (XSS) in Goracash for WordPress, caused by improper neutralization of input during web page generation. Affected: Goracash plugin versions up to 1.1 (description notes “from n/a through 1.1”). The impact is stored XSS, enabling an attacker to...

CVE-2025-57910

CVE-2025-57910 involves an stored cross-site scripting (XSS) vulnerability in the WordPress plugin stack for AnyClip Luminous Studio (anyclip-media). The description states improper input neutralization during web page generation, enabling Stored XSS. Affected version range is AnyClip Luminous St...

CVE-2025-57992 WordPress Mail Baby SMTP plugin <= 2.8 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in InterServer Mail Baby SMTP mail-baby-smtp allows Cross Site Request Forgery.This issue affects Mail Baby SMTP: from n/a through = 2.8...

CVE-2025-58665 WordPress Form Generator for WordPress Plugin <= 1.52 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tmontg1 Form Generator for WordPress form-generator-powered-by-jotform allows Stored XSS.This issue affects Form Generator for WordPress: from n/a through = 1.52...

CVE-2025-10806

A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. This vulnerability affects unknown code of the file /admin/bwdates-reports-details.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack may be initiated remotely. The exploi...

CVE-2025-57205

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

PT-2025-38779

Name of the Vulnerable Software and Affected Versions AWP Classifieds versions through 4.3.5 Description A flaw exists in Strategy11 Team AWP Classifieds that allows code injection due to improper neutralization of script-related HTML tags on a web page. This is a Basic Cross-Site Scripting XSS...

PT-2025-38936

Name of the Vulnerable Software and Affected Versions Will.I.am Simple Restaurant Menu versions through 1.2 Description The Simple Restaurant Menu software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This means...

PT-2025-38923

Name of the Vulnerable Software and Affected Versions Ronald Huereca Highlight and Share – Social Text and Image Sharing versions through 5.1.1 Description The software contains a flaw related to improper neutralization of input during web page generation, which allows for Stored Cross-site...

CVE-2025-0879

The CVE-2025-0879 entry describes an XSS vulnerability in Shopside App caused by improper neutralization of input during web page generation. Affected product: Shopside App (versions before 17.02.2025). Underlying cause: input is not properly sanitized before being embedded into generated pages, ...

webvulnscanner

Web Vulnerability Scanner A Python-based tool designed for ethic...

CVE-2025-10562

A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. This affects an unknown function of the file /ajax.php?action=saveproduct. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be...

CVE-2025-10562

CVE-2025-10562 affects Campcodes Grocery Sales and Inventory System v1.0. The flaw is in /ajax.php?action=save_product where manipulation of the ID parameter enables SQL injection, allowing remote exploitation (exploit published). The CVSS indicates high/critical impact across confidentiality, in...

CVE-2025-6575 XSS in Dolusoft's Omaspot

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Dolusoft Omaspot allows Reflected XSS. This issue affects Omaspot: before 12.09.2025...

TYPO3 Form to Database 安全漏洞

TYPO3 Form to Database is an open source database extension for TYPO3. A security vulnerability exists in TYPO3 Form to Database, which is vulnerable to cross-site scripting attacks. The following versions are affected: versions prior to 2.2.5, versions 3.0.0 through 3.2.2, versions 4.0.0 through...

CVE-2025-10427 SourceCodester Pet Grooming Management Software user.php unrestricted upload

A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/operation/user.php. Executing manipulation of the argument websiteimage can lead to unrestricted upload. It is possible to launch the attack remotely. The...