Audemium ERP 安全漏洞

Audemium ERP is a free and open source enterprise resource planning system for small businesses from Audemium. A security vulnerability exists in Audemium ERP version 0.9.0 and prior versions, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability that allows remote...

CVE-2024-57514

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

XVIDEOS: Stored XSS via SMTP Error Message

A Stored Cross-Site Scripting XSS vulnerability was identified on the /account/email page for www.xvideos.com. The vulnerability arose from the improper handling of SMTP error messages, which were passed into the html method without proper sanitization, allowing an attacker to store and execute...

CVE-2024-57329: Improper Neutralization of Input During Web Page Generation

HortusFox v3.9 contains a stored XSS vulnerability in the "Add Plant" function. The name input field does not sanitize or escape user inputs, allowing attackers to inject and execute arbitrary JavaScript payloads...

CVE-2024-57326: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-Site Scripting XSS vulnerability exists in the search.php file of the Online Pizza Delivery System 1.0. The vulnerability allows an attacker to execute arbitrary JavaScript code in the browser via unsanitized input passed through the search parameter...

CVE-2024-56924

A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...

CVE-2024-56924

A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...

CVE-2024-56924

A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...

CVE-2024-56924: Cross-Site Request Forgery (CSRF)

A Cross Site Request Forgery CSRF vulnerability in Code Astro Internet banking system 2.0.0 allows remote attackers to execute arbitrary JavaScript on the admin page pagesaccount, potentially leading to unauthorized actions such as changing account settings or stealing sensitive user information...

Silverpeas Core 跨站脚本漏洞

Silverpeas Core is an open source project from Silverpeas Open Source for building and running collaborative and social web portals. A cross-site scripting vulnerability exists in Silverpeas Core version 6.4.1. An attacker can exploit this vulnerability to execute arbitrary JavaScript code...

CVE-2025-0583 aEnrich Technology a+HRD - Reflected Cross-site Scripting(XSS)

The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-23207

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with "renderToString" could encounter malicious input using "\htmlData" that runs arbitrary JavaScript, or generate invalid HTML. Users are advised to upgra...

KaTeX \htmlData does not validate attribute names

Impact KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML. Patches Upgrade to KaTeX v0.16.21 to remove this vulnerability. Workarounds - Avoid use of or turn off the...

CVE-2024-47140

A cross-site scripting xss vulnerability exists in the addalertcheck page of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitrary javascript code execution. An authenticated user would need to click a malicious link provided by the attacker...

PT-2025-2680

Name of the Vulnerable Software and Affected Versions Observium CE version 24.4.13528 Description A cross-site scripting XSS issue exists in the weather map editor functionality. This can be exploited through a specially crafted HTTP request, leading to the execution of arbitrary JavaScript code...

CVE-2024-45061: Improper Neutralization of Input During Web Page Generation

A cross-site scripting xss vulnerability exists in the weather map editor functionality of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitrary javascript code execution. An authenticated user would need to click a malicious link provided by the attacker...

PT-2025-2761

Name of the Vulnerable Software and Affected Versions: Observium CE version 24.4.13528 Description: A cross-site scripting XSS issue exists in the add alert check page, allowing an attacker to execute arbitrary JavaScript code through a specially crafted HTTP request. An authenticated user would...

CVE-2024-47140: Improper Neutralization of Input During Web Page Generation

A cross-site scripting xss vulnerability exists in the addalertcheck page of Observium CE 24.4.13528. A specially crafted HTTP request can lead to a arbitrary javascript code execution. An authenticated user would need to click a malicious link provided by the attacker...

CVE-2021-29669

CVE-2021-29669 affects IBM Jazz Foundation (versions 6.0.6, 6.0.6.1, 7.0, 7.0.1, 7.0.2). The issue is a cross-site scripting vulnerability that could allow an attacker to embed arbitrary JavaScript in the Web UI, potentially leading to credentials disclosure within a trusted session. The public m...

PT-2025-7270

Name of the Vulnerable Software and Affected Versions WEEEK affected versions not specified Description The issue is related to the lack of protection of the web page structure, allowing an attacker to execute arbitrary JavaScript code. Recommendations At the moment, there is no information about...