EUVD-2025-32102

Malicious code in bioql PyPI...

CVE-2025-40992

Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/updateprofile', affecting to 'name' parameter via POST. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and...

CVE-2025-40992 Stored XSS in Creativeitem Sociopro

Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/updateprofile', affecting to 'name' parameter via POST. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and...

CVE-2025-40992

CVE-2025-40992 is a Stored XSS vulnerability in Creativeitem Sociopro, affecting the /sociopro/profile/update_profile endpoint where the POSTed name parameter is insufficiently validated. Attackers could inject script that may be executed in an authenticated user’s context, with potential cookie/...

CVE-2025-40991 Stored XSS in Creativeitem Ekushey CRM

Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/projectfile/upload/xxxx", affecting to "description" parameter via POST. This vulnerability could allow a remote attacker to send a...

CVE-2025-40991

CVE-2025-40991 is a Stored XSS in Creativeitem Ekushey CRM v5.0. Root cause: lack of input validation in the project file upload endpoint at /ekushey/index.php/client/project_file/upload/xxxx, specifically the description parameter via POST. Impact (per sources): an attacker could craft input to ...

CVE-2025-40990 Stored XSS in Creativeitem Ekushey CRM

Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/projectbug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to...

CVE-2025-40989 Stored XSS in Creativeitem Ekushey CRM

Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/projectmessage/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a speciall...

CVE-2025-40989

CVE-2025-40989 describes a stored cross-site scripting vulnerability in Ekushey CRM v5.0 (Creativeitem) caused by insufficient validation of user input in the POST endpoint dealing with the applicant’s message, specifically the API path that includes the message parameter. The affected component ...

CVE-2025-40989 Stored XSS in Creativeitem Ekushey CRM

Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/projectmessage/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a speciall...

Creativeitem Ekushey CRM 跨站脚本漏洞

Creativeitem Ekushey CRM is an open source project management script from Creativeitem. A cross-site scripting vulnerability exists in Creativeitem Ekushey CRM version 5.0, which stems from a lack of user input validation and could lead to a stored cross-site scripting attack...

Creativeitem Ekushey CRM 跨站脚本漏洞

Creativeitem Ekushey CRM is an open source project management script from Creativeitem. A cross-site scripting vulnerability exists in Creativeitem Ekushey CRM version 5.0, which stems from a lack of input validation for the title and description parameters and could lead to a stored cross-site...

Creativeitem Ekushey CRM 跨站脚本漏洞

Creativeitem Ekushey CRM is an open source project management script from Creativeitem. A cross-site scripting vulnerability exists in Creativeitem Ekushey CRM version 5.0, which stems from a lack of user input validation and could lead to a stored cross-site scripting attack...

Creativeitem Ekushey CRM 跨站脚本漏洞

Creativeitem Ekushey CRM is an open source project management script by Creativeitem. A cross-site scripting vulnerability exists in Creativeitem Ekushey CRM that stems from insufficient validation of user input and could lead to a stored cross-site scripting attack...

CVE-2024-38959

Cross Site Scripting vulnerability in Creativeitem Academy LMS Learning Management System v.6.8.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via the string parameter...

CVE-2023-3755

A vulnerability has been found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /home/filterlistings. The manipulation of the argument price-range leads to cross site scripting. The attack c...

CVE-2023-3753

A vulnerability classified as problematic has been found in Creativeitem Mastery LMS 1.2. This affects an unknown part of the file /browse. The manipulation of the argument search/featured/recommended/skill leads to cross site scripting. It is possible to initiate the attack remotely. The...

CVE-2023-3752

A vulnerability was found in Creativeitem Academy LMS 5.15. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /home/courses. The manipulation of the argument sortby leads to cross site scripting. The attack may be launched remotely. VDB-234422 is t...

CVE-2023-3754

A vulnerability, which was classified as problematic, was found in Creativeitem Ekushey Project Manager CRM 5.0. Affected is an unknown function of the file /index.php/client/message/messageread/xxxxxxxxrandom-msg-hash. The manipulation of the argument message leads to cross site scripting. It is...

CVE-2023-3756

A vulnerability was found in Creativeitem Atlas Business Directory Listing 2.13 and classified as problematic. Affected by this issue is some unknown functionality of the file /home/search. The manipulation of the argument searchstring leads to cross site scripting. The attack may be launched...