PT-2025-35063

Name of the Vulnerable Software and Affected Versions: Captcha.eu affected versions not specified Description: This issue involves improper neutralization of input during web page generation, leading to a Reflected Cross-site Scripting XSS condition. The vulnerability allows for the injection of...

CVE-2025-9503

A security vulnerability has been detected in Campcodes Online Loan Management System 1.0. Affected is an unknown function of the file /ajax.php?action=saveborrower. The manipulation of the argument lastname leads to sql injection. Remote exploitation of the attack is possible. The exploit has be...

Bian Que Feijiu Intelligent Emergency and Quality Control System 安全漏洞

Bian Que Feijiu Intelligent Emergency and Quality Control System Bian Que Feijiu Intelligent Emergency and Quality Control System is an emergency management system based on the concepts of grand emergency and regional collaborative treatment by Bian Que Feijiu Bian Que Feijiu, a Chinese company. ...

Gitblit 安全漏洞

Gitblit is an open source, pure Java Git solution from Gitblit for managing, viewing, and serving Git repositories. A security vulnerability exists in Gitblit version 1.7.1, which stems from improper handling of the r parameter and could lead to a reflective cross-site scripting attack...

CVE-2025-9471

A vulnerability has been found in itsourcecode Apartment Management System 1.0. This vulnerability affects unknown code of the file /maintenance/addmaintenancecost.php. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2025-9439

A weakness has been identified in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this vulnerability is an unknown functionality of the file /rse/admin/editfaculty.php?id=2. This manipulation of the argument Name causes cross site scripting. The attack is...

CVE-2025-9434 1000projects Online Project Report Submission and Evaluation System edit_title.php cross site scripting

A vulnerability was determined in 1000projects Online Project Report Submission and Evaluation System 1.0. This affects an unknown function of the file /admin/edittitle.php?id=1. Executing manipulation of the argument desc can lead to cross site scripting. The attack may be launched remotely. The...

Exploit for OS Command Injection in Php

CVE-2024-4577 CTF Challenge Overview This CTF challenge de...

Linux Distros Unpatched Vulnerability : CVE-2016-5731

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in examples/openid.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote...

Linux Distros Unpatched Vulnerability : CVE-2018-12016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libephymain.so in GNOME Web aka Epiphany through 3.28.2.1 allows remote attackers to cause a denial of service application crash via certain window.open and...

CVE-2025-5352

CVE-2025-5352 describes a critical stored XSS in Lunary Analytics; the NEXT_PUBLIC_CUSTOM_SCRIPT environment variable is injected into the DOM via dangerouslySetInnerHTML without sanitization in Lunary versions

CVE-2025-43769

CVE-2025-43769 describes a stored XSS in the Components portlet of Liferay Portal (7.4.0–7.4.3.131) and Liferay DXP (2024.Q3.1–2024.Q3.8, 2024.Q2.0–2024.Q2.13, 2024.Q1.1–2024.Q1.12, and 7.4 GA up to update 92). The vulnerability allows remote attackers to execute arbitrary web script or HTML via ...

CVE-2025-55522

Cross-site scripting XSS vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name parameter...

Esri Portal for ArcGIS Enterprise Sites 跨站脚本漏洞

esri Portal for ArcGIS Enterprise Sites is an enterprise-level geographic information sharing platform from ESRI that allows users within an organization to view, edit, and share geographic information through the portal. A cross-site scripting vulnerability exists in esri Portal for ArcGIS...

CVE-2025-43746

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7....

CVE-2025-48296

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in skygroup UpStore upstore allows Reflected XSS.This issue affects UpStore: from n/a through = 1.7.0...

CVE-2025-48151

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through = 2.1.6...

CVE-2025-49392

The CVE-2025-49392 entry describes a Stored Cross-Site Scripting (XSS) vulnerability in Themify Audio Dock for WordPress, applicable to versions up to 2.0.5. The issue arises from improper input neutralization during web page generation. Public sources in connected documents (NVD, PatchStack, PT-...

CVE-2025-49892

CVE-2025-49892 describes an LFI (Local File Inclusion) in the WordPress plugin Uxper Booking (uxper-booking) up to version 1.3.3. The vulnerability arises from improper control of filename handling in PHP include/require statements, allowing an attacker to include local files via crafted input. I...

The vulnerability of the Apache Superset data visualization software lies in the lack of measures to neutralize script-related tags on web pages. This allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the Apache Superset data visualization software is related to the failure to take measures to neutralize script-related tags on web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...