CVE-2024-12374

A stored cross-site scripting XSS vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript...

CVE-2024-12374

CVE-2024-12374 : Stored XSS in automatic1111/stable-diffusion-webui (git 82a973c). An attacker can upload an HTML file that the app treats as content-type application/html; when a victim visits the malicious link, arbitrary JavaScript runs in the browser. Connected documents confirm the vulnerabi...

FlatPress 跨站脚本漏洞

FlatPress is a lightweight, easy to set up flat file blogging engine from FlatPress open source. A cross-site scripting vulnerability exists in FlatPress version 1.3. An attacker can exploit this vulnerability to upload malicious files and execute arbitrary JavaScript code...

PT-2025-12269

Name of the Vulnerable Software and Affected Versions gaizhenbiao/chuanhuchatgpt version git 20b2e02 Description A stored cross-site scripting XSS issue exists due to improper sanitization of HTML tags in chat history uploads. The sanitization logic fails to handle HTML tags within code blocks...

CVE-2024-10727: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in phpipam/phpipam versions 1.5.0 through 1.6.0. The vulnerability arises when the application receives data in an HTTP request and includes that data within the immediate response in an unsafe manner. This allows an attacker to execute...

PT-2025-12063

Name of the Vulnerable Software and Affected Versions phpipam/phpipam versions 1.5.0 through 1.6.0 Description A reflected cross-site scripting XSS issue exists, arising when the application receives data in an HTTP request and includes that data within the immediate response in an unsafe manner...

PT-2025-12275

Name of the Vulnerable Software and Affected Versions haotian-liu/llava version 1.2.0 Description A Cross-Site Request Forgery CSRF issue allows an attacker to upload files with malicious content without authentication or user interaction. The uploaded file is stored in a predictable path, enabli...

PT-2025-12228

Name of the Vulnerable Software and Affected Versions gaizhenbiao/chuanhuchatgpt affected versions not specified Description A stored Cross-Site Scripting XSS issue exists, allowing an attacker to upload a malicious HTML file with JavaScript code. When this file is accessed, the JavaScript code i...

CVE-2024-8400: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in the latest version of gaizhenbiao/chuanhuchatgpt. The vulnerability allows an attacker to upload a malicious HTML file containing JavaScript code, which is then executed when the file is accessed. This can lead to the execution of arbitrar...

CVE-2024-9311: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF vulnerability in haotian-liu/llava v1.2.0 LLaVA-1.6 allows an attacker to upload files with malicious content without authentication or user interaction. The uploaded file is stored in a predictable path, enabling the attacker to execute arbitrary JavaScript code...

CVE-2024-9900: Improper Neutralization of Input During Web Page Generation

mudler/localai version v2.21.1 contains a Cross-Site Scripting XSS vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts...

CVE-2024-8101: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in the Text Explorer component of aimhubio/aim version 3.23.0. The vulnerability arises due to the use of dangerouslySetInnerHTML without proper sanitization, allowing arbitrary JavaScript execution when rendering tracked texts. This can be...

CVE-2024-12374: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript...

PT-2025-12127

Name of the Vulnerable Software and Affected Versions automatic1111/stable-diffusion-webui version git 82a973c Description A stored cross-site scripting XSS issue exists. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses t...

CVE-2024-55009

CVE-2024-55009 refers to a reflected XSS in AutoBib - Bibliographic collection management system (versions 3.1.140 and earlier). The vulnerability allows an attacker to cause arbitrary JavaScript execution in a victim’s browser by injecting a crafted payload into the WCE=topFrame&WCU= parameter. ...

CVE-2024-55009: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in AutoBib - Bibliographic collection management system 3.1.140 and earlier allows attackers to execute arbitrary Javascript in the context of a victim's browser via injecting a crafted payload into the WCE=topFrame&WCU= parameter...

PT-2025-11974

Name of the Vulnerable Software and Affected Versions AutoBib - Bibliographic collection management system versions 3.1.140 and earlier Description A reflected cross-site scripting XSS issue allows attackers to execute arbitrary Javascript in the context of a victim's browser. This is achieved by...

CVE-2024-48761

Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter...

CVE-2025-25929

A reflected cross-site scripting XSS vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the reportType parameter...

PT-2025-11218

Name of the Vulnerable Software and Affected Versions: The Plugin People Enterprise Mail Handler for Jira Data Center versions prior to 4.1.69-dc Description: An authenticated stored cross-site scripting issue allows attackers with Administrator privileges to execute arbitrary Javascript in the...