CVE-2025-1071

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox.This issue affects Firewa...

CVE-2025-1239 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Blocked Sites List

A stored cross-site scripting XSS vulnerability exists in the management interface of WatchGuard Firebox appliances via the Blocked Sites list. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox...

PT-2025-6830

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS versions 12.0 through 12.5.12+701324 WatchGuard Fireware OS versions 12.6 through 12.11 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting...

CVE-2024-53943

An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to XSS via the 2.4 GHz and 5 GHz name parameters, allowing an attacker to execute JavaScript within the context of the current user by injecting JavaScript into the SSID...

Exploit for CVE-2024-42327

Zabbix-CVE-2024-42327 RCE PoC...

Exploit for Cross-site Scripting in Sensaphone Web600_Firmware

SENSAPHONE VULNERABILITY DISCLOSURE Summary In mid-Sep...

Exploit for CVE-2024-22120

Usage bash python exploit.py --ip --sid --hostid --phps...

ItSourceCode 'Online Blood Bank Management System in PHP" Stored XSS

Stored XSS in Online Blood Bank Management System V1.0...

Exploit for Code Injection in Crushftp

CVE-2024-4040: CrushFTP File Read Vulnerability Overview...

GHSA-PMWW-V6C9-7P83 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Summary Piccolo's admin panel provides the ability to upload media files and view them within the admin panel. If SVG is an allowed file type for upload; the default; an attacker can upload an SVG which when loaded under certain contexts allows for arbitrary access to the admin page. This access...

CVE-2024-29401

xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything...

PT-2024-22668 · Unknown · Easy-Popup-Show

Name of the Vulnerable Software and Affected Versions: easy-popup-show versions all Description: A cross-site request forgery CSRF issue allows a remote unauthenticated attacker to hijack the authentication of the administrator and perform unintended operations if the administrator views a...

PT-2024-20167 · Elecom · Elecom Wireless Lan Repeater +4

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers and wireless LAN repeater affected versions not specified Description: A cross-site request forgery CSRF issue allows a remote unauthenticated attacker to hijack the authentication of administrators and perform...

CVE-2024-22220

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview...

Cross site scripting

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview...

PT-2024-19285 · Terminalfour · Terminalfour +1

Name of the Vulnerable Software and Affected Versions: Terminalfour versions 7.4 through 7.4.0004 QP3 Terminalfour versions 8 through 8.3.19 Formbank versions through 2.1.10-FINAL Description: An issue allows Unauthenticated Stored Cross-Site Scripting, potentially leading to Admin Session...

CVE-2024-22220

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview...

CVE-2024-22220

An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. Unauthenticated Stored Cross-Site Scripting can occur, with resultant Admin Session Hijacking. The attack vectors are Form Builder and Form Preview...

Terminalfour Security Vulnerability

Terminalfour is a digital marketing and web content management platform for higher education from US-based Terminalfour, Inc. A security vulnerability exists in Terminalfour versions 7.4 through 7.4.0004 QP3, and 8 through 8.3.19, which stems from the possibility of unauthenticated stored...

CVE-2024-22220

CVE-2024-22220 affects Terminalfour and Formbank: unauthenticated stored cross-site scripting can lead to admin session hijacking via the Form Builder and Form Preview. Affected: Terminalfour 7.4–7.4.0004 QP3, Terminalfour 8–8.3.19, and Formbank up to 2.1.10-FINAL. Root cause is XSS in form-relat...