CVE-2024-55488

Umbraco CMS v14.3.1 is affected by a stored cross-site scripting (XSS) vulnerability that allows for the execution of arbitrary web scripts or HTML via a crafted payload. The root cause is a deliberate decision by the vendor not to apply HTML sanitization at the product level. The vendor has disp...

CVE-2024-55488

A stored cross-site scripting XSS vulnerability in Umbraco CMS v14.3.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. NOTE: This has been disputed by the vendor since this potential attack is only possible via authenticated users who have been manually allowed...

Umbraco CMS 安全漏洞

Umbraco CMS is a content management system from Umbraco, Denmark. A security vulnerability exists in Umbraco CMS version v14.3.1 that stems from vulnerability to a stored cross-site scripting attack that allows an attacker to execute arbitrary web script or HTML via a crafted payload...

CVE-2025-23039

Caido is a web security auditing toolkit. A Cross-Site Scripting XSS vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to...

CVE-2024-57776

A cross-site scripting XSS vulnerability in the /apply/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-57771

A cross-site scripting XSS vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-57774

A cross-site scripting (XSS) vulnerability exists in the getBusinessUploadListPage?busid interface of JFinalOA versions prior to v2025.01.01 . The root cause is the improper neutralization of input during web page generation, which allows an attacker to execute arbitrary web scripts or HTML using...

CVE-2024-57772

A cross-site scripting XSS vulnerability in the /bumph/getDraftListPage?type interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

IBM CICS TX Advanced 跨站脚本漏洞

IBM CICS TX Advanced is a transaction processing monitoring system from International Business Machines IBM for running large-scale, high-transaction-volume applications in enterprise environments. IBM CICS TX Advanced suffers from a cross-site scripting vulnerability that stems from the...

CVE-2024-41453

A cross-site scripting XSS vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter...

CVE-2025-22997

A stored cross-site scripting XSS vulnerability in the prftablecontent component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter...

CVE-2024-41453

ProcessMaker pm4core-docker 4.1.21-RC7 is affected by a Stored Cross-Site Scripting (XSS) vulnerability. The flaw allows an attacker to execute arbitrary web scripts or HTML by injecting a crafted payload into the Name parameter. Specifically, an attacker can create a JSON file containing a malic...

CVE-2024-53563

A stored cross-site scripting XSS vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

CVE-2024-53563

A stored cross-site scripting (XSS) vulnerability exists in the Arcadyan Meteor 2 CPE FG360 (Firmware ETV2.10 ). The flaw allows an attacker to execute arbitrary web scripts or HTML by injecting a specially crafted payload . This vulnerability is categorized as an Improper Neutralization of Input...

CVE-2025-22996

A stored cross-site scripting XSS vulnerability in the spftablecontent component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter...

CVE-2025-22996

The Linksys E5600 Router (Ver. 1.1.0.26) contains a stored cross-site scripting (XSS) vulnerability within the spf_table_content component. Attackers can exploit this by injecting a crafted payload into the desc parameter to execute arbitrary web scripts or HTML. Practical consequences include th...

CVE-2024-55494

A PHP Code Injection vulnerability that can lead to Remote Code Execution RCE and XSS in Opencode Mobile Collect Call v5.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the opfunc parameter at /occontrolpanel/index.php...

CVE-2024-55494

The Opencode Mobile Collect Call software, version v5.4.7 , contains a PHP Code Injection vulnerability. An attacker can inject a crafted payload into the op_func parameter at the /occontrolpanel/index.php API endpoint. This flaw can lead to Remote Code Execution (RCE) and Cross-Site Scripting (X...

CVE-2024-42898

A cross-site scripting XSS vulnerability in Nagios XI 2024R1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Account Settings page...

CVE-2024-55494

A PHP Code Injection vulnerability that can lead to Remote Code Execution RCE and XSS in Opencode Mobile Collect Call v5.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the opfunc parameter at /occontrolpanel/index.php...