CVE-2024-56924

A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...

CVE-2024-56924

A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...

CVE-2024-56924

A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...

CVE-2024-56924: Cross-Site Request Forgery (CSRF)

A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...

Silverpeas Core 跨站脚本漏洞

Silverpeas Core is an open source project from Silverpeas Open Source for building and running collaborative and social web portals. A cross-site scripting vulnerability exists in Silverpeas Core version 6.4.1. An attacker can exploit this vulnerability to execute arbitrary JavaScript code...

CVE-2025-0583 aEnrich Technology a+HRD - Reflected Cross-site Scripting(XSS)

The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-23207

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with "renderToString" could encounter malicious input using "\htmlData" that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgra...

KaTeX \htmlData does not validate attribute names

Impact KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Patches Upgrade to KaTeX v0.16.21 to remove this vulnerability. Workarounds - Avoid use of or turn off the...

CVE-2024-47140

A cross-site scripting xss vulnerability exists in the addalertcheck page of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitrary javascript code execution. An authenticated user would need to click a malicious link provided by the attacker...

PT-2025-2680

Name of the Vulnerable Software and Affected Versions Observium CE version 24.4.13528 Description A cross-site scripting XSS issue exists in the weather map editor functionality. This can be exploited through a specially crafted HTTP request, leading to the execution of arbitrary JavaScript code...

CVE-2024-45061: Improper Neutralization of Input During Web Page Generation

A cross-site scripting xss vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitrary javascript code execution. An authenticated user would need to click a malicious link provided by the attacker...

PT-2025-2761

Name of the Vulnerable Software and Affected Versions: Observium CE version 24.4.13528 Description: A cross-site scripting XSS issue exists in the add alert check page, allowing an attacker to execute arbitrary JavaScript code through a specially crafted HTTP request. An authenticated user would...

CVE-2024-47140: Improper Neutralization of Input During Web Page Generation

A cross-site scripting xss vulnerability exists in the addalertcheck page of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitrary javascript code execution. An authenticated user would need to click a malicious link provided by the attacker...

CVE-2021-29669

CVE-2021-29669 affects IBM Jazz Foundation (versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, 7.0.2). The issue is a cross-site scripting vulnerability that could allow an attacker to embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The public m...

PT-2025-7270

Name of the Vulnerable Software and Affected Versions WEEEK affected versions not specified Description The issue is related to the lack of protection of the web page structure, allowing an attacker to execute arbitrary JavaScript code. Recommendations At the moment, there is no information about...

CVE-2024-46073

A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS . The root cause is the improper sanitization of the "next" parameter , which is included in the application's response without adequate escaping. An attacker can exploit this flaw by tricking a use...

The vulnerability of the document viewer library in the web version of the eXpress communication system lies in the insufficient protection of the website structure, allowing attackers to execute arbitrary Java Script code.

The vulnerability of the document viewer library in the web version of the eXpress communication system is due to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary Java Script code by sending a specially crafted file...

PT-2025-4484

Name of the Vulnerable Software and Affected Versions Optimizely EPiServer.CMS.Core versions prior to 12.22.0 Description A high-severity Stored Cross-Site Scripting XSS issue exists in the CMS, allowing malicious actors to inject and execute arbitrary JavaScript code, potentially compromising us...

GHSA-WV23-996V-Q229 PhpSpreadsheet has a Cross-Site Scripting (XSS) vulnerability in custom properties

Cross-Site Scripting XSS vulnerability in custom properties Product: Phpspreadsheet Version: version 3.6.0 CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' CVSS vector v.3.1: 5.4 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS vector v.4.0: 4.8...

CVE-2025-21610

Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.12 are vulnerable to cross-site scripting when pasting malicious code in the link field. An attacker could trick the user to copy&paste a malicious javascript: URL as a link that would execute...