CVE-2025-41350

CVE-2025-41350 describes a stored Cross-site Scripting (XSS) in WinPlus v24.11.27 by Informática del Este. The vulnerability arises from insufficient validation of user input in the POST parameter descripcion sent to the API endpoint /WinplusPortal/ws/sWinplus.svc/json/savesoldoc_post . A remote,...

CVE-2025-41349

Stored Cross-site Scripting XSSvylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'descripcion' parameter in '/WinplusPortal/ws/sWinplus...

CVE-2025-41349 Stored Cross-Site Scripting (XSS) in WinPlus by Informática del Este

Stored Cross-site Scripting XSSvylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'descripcion' parameter in '/WinplusPortal/ws/sWinplus...

CVE-2025-41349

CVE-2025-41349 affects WinPlus v24.11.27 by Informática del Este. A Stored XSS flaw arises from insufficient validation of the descripcion parameter sent via POST to the API endpoint /WinplusPortal/ws/sWinplus.svc/json/savesolpla_post, exploitable by a remote attacker against an authenticated use...

CVE-2025-63708

Cross-Site Scripting XSS vulnerability exists in SourceCodester AI Font Matcher nid=18425, 2025-10-10 that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly...

PT-2025-47299

Name of the Vulnerable Software and Affected Versions WinPlus version 24.11.27 Description A stored Cross-site Scripting XSS issue exists in WinPlus version 24.11.27 due to insufficient validation of user-supplied data. This allows a remote attacker to send a malicious query to an authenticated...

PT-2025-47300

Name of the Vulnerable Software and Affected Versions WinPlus version 24.11.27 Description A stored Cross-site Scripting XSS issue exists in WinPlus version 24.11.27 due to insufficient validation of user-supplied data. This allows a remote attacker to send a malicious query to an authenticated...

EUVD-2025-197808

Cross-Site Scripting XSS vulnerability exists in SourceCodester AI Font Matcher nid=18425, 2025-10-10 that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly...

CVE-2025-63708

Cross-Site Scripting XSS vulnerability exists in SourceCodester AI Font Matcher nid=18425, 2025-10-10 that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly...

PT-2025-47156

Name of the Vulnerable Software and Affected Versions SourceCodester AI Font Matcher nid=18425 Description A Cross-Site Scripting XSS issue exists that enables remote attackers to execute arbitrary JavaScript in a user's browser. This occurs due to improper sanitization of font family names withi...

CVE-2025-63666

Tenda AC15 v15.03.05.18multi issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to acce...

EUVD-2025-131903

Tenda AC15 v15.03.05.18multi issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to acce...

CVE-2025-63666

Tenda AC15 v15.03.05.18multi issues an authentication cookie that exposes the account password hash to the client and uses a short, low-entropy suffix as the session identifier. An attacker with network access or the ability to run JS in a victim browser can steal the cookie and replay it to acce...

PT-2025-46661

Name of the Vulnerable Software and Affected Versions Tenda AC15 version 15.03.05.18 multi Description The authentication cookie used by the device exposes the account password hash to the client and utilizes a short, low-entropy suffix as the session identifier. An attacker with network access o...

CVE-2025-41107

Stored Cross Site Scripting XSS vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/onlineadmission', wich affects the parameters 'firstname', 'lastname', 'guardianname' and others. This vulnerability could allow a remote user to send ...

CVE-2025-41001 Cross-Site Scripting (XSS) in SOPlanning

Cross Site Scripting XSS vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUTREDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote use...

CVE-2025-41001 Cross-Site Scripting (XSS) in SOPlanning

Cross Site Scripting XSS vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUTREDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote use...

EUVD-2025-44042

Cross Site Scripting XSS vulnerability stored in SOPlanning v1.53.02, which consist of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'LOGOUTREDIRECT' parameter in '/soplanning/www/process/options.php'. This vulnerability could allow a remote use...

CVE-2025-41001

CVE-2025-41001: Stored XSS in SOPlanning 1.53.02 arises from insufficient validation of the LOGOUT_REDIRECT parameter in /soplanning/www/process/options.php. The issue can allow an attacker to inject crafted input that is persisted and later delivered to an authenticated user, enabling theft of c...

CVE-2025-41107 Stored XSS in Smart School

Stored Cross Site Scripting XSS vulnerability in Smart School 7.0 due to lack of proper validation of user input when sending a POST request to '/onlineadmission', wich affects the parameters 'firstname', 'lastname', 'guardianname' and others. This vulnerability could allow a remote user to send ...