Cross-site Scripting (XSS)

symfony/ux-live-component and symfony/ux-twig-component is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper output escaping due to unescaped rendering of ComponentAttributes values, which may contain unsafe user input leading to HTML attribute injection...

CVE-2019-19850

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class QueryGenerator is vulnerable to SQL injection. Exploitation requires having the system extension ext:lowlevel installed, and a valid backe...

CVE-2019-10757

knex.js versions before 0.19.5 are vulnerable to SQL Injection attack. Identifiers are escaped incorrectly as part of the MSSQL dialect, allowing attackers to craft a malicious query to the host DB...

CVE-2025-5062 WooCommerce <= 9.4.2 - PostMessage-Based Cross-Site Scripting

The WooCommerce plugin for WordPress is vulnerable to PostMessage-Based Cross-Site Scripting via the 'customize-store' page in all versions up to, and including, 9.4.2 due to insufficient input sanitization and output escaping on PostMessage data. This makes it possible for unauthenticated...

CVE-2025-5062

The CVE-2025-5062 issue affects the WooCommerce plugin for WordPress, where PostMessage input data on the customize-store page is not properly sanitized or escaped. This allows unauthenticated attackers to inject arbitrary scripts in pages that a user visits if they can entice the user to perform...

CVE-2016-11061

Xerox WorkCentre 3655, 3655i, 58XX, 58XXi, 59XX, 59XXi, 6655, 6655i, 72XX, 72XXi, 78XX, 78XXi, 7970, and 7970i devices before 073.xxx.086.15410 do not properly escape parameters in the support/remoteUI/configrui.php script, which can allow an unauthenticated attacker to execute OS commands on the...

CVE-2017-1002201

In haml versions prior to version 5.0.0.beta.2, when using user input to perform tasks on the server, characters like " ' must be escaped properly. In this case, the ' character was missed. An attacker can manipulate the input to introduce additional attributes, potentially executing code...

WordPress plugin MapSVG 代码问题漏洞

WordPress MapSVG is a powerful WordPress map plugin that not only supports the creation of interactive maps, but also offers a wide range of customization and integration features. A cross-site scripting vulnerability exists in WordPress MapSVG, which stems from insufficient input cleanup and...

PT-2025-22450 · WordPress · Mapsvg

Name of the Vulnerable Software and Affected Versions: MapSVG plugin for WordPress versions up to, and including, 8.6.4 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated...

WordPress plugin Hot Random Image 跨站脚本漏洞

WordPress Hot Random Image is a basic plugin for displaying randomly selected images from a specified folder. A cross-site scripting vulnerability exists in WordPress Hot Random Image, which stems from insufficient link parameter input cleanup and escaping, and can be exploited by an attacker to...

PT-2025-22448 · WordPress · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce plugin for WordPress versions up to, and including, 9.4.2 Description: The issue is related to PostMessage-Based Cross-Site Scripting via the 'customize-store' page due to insufficient input sanitization and output escaping on...

CVE-2025-3750 Network Posts Extended <= 7.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_height Parameter

The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postheight’ parameter in all versions up to, and including, 7.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress plugin WP YouTube Video Optimizer 跨站脚本漏洞

WordPress WP YouTube Video Optimizer is a plugin for optimizing YouTube videos on WordPress websites. A cross-site scripting vulnerability exists in WordPress WP YouTube Video Optimizer. The vulnerability stems from insufficient cleanup and escaping of attribute input provided to the user by the...

PT-2025-22333 · WordPress · Network Posts Extended

Name of the Vulnerable Software and Affected Versions: The Network Posts Extended plugin for WordPress versions up to, and including, 7.7.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...

PT-2025-22340 · WordPress · Slim Seo

Name of the Vulnerable Software and Affected Versions: The Slim SEO – Fast & Automated WordPress SEO Plugin versions up to, and including, 4.5.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's slim seo breadcrumbs shortcode due to insufficient input sanitization...

WordPress plugin Slim SEO 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin NextGEN Gallery 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Vehicle Record Management System profile.php file cross-site scripting vulnerability

Vehicle Record Management System is a vehicle record management system. Vehicle Record Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the name, email, and mobile parameters in...

CVE-2025-3888

The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File inclusion in all versions up to, and including, 4.8.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access an...

CVE-2025-4669

The WP Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpbc shortcode in all versions up to, and including, 10.11.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...