26400 matches found
caluma (>=6.0.0, <=6.3.1), mycms (>=0.1.9, <=0.1.12) +1 more potentially affected by CVE-2025-64458 via django (2.2.14)
django PYPI version 2.2.14 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =6.0.0, =0.1.9, =0.1.12 - x-net-django-color-field 1.0.0 Source cves: CVE-2025-64458 Source advisory: OSV:GHSA-QW25-V68C-QJF3...
CVE-2025-11745 Ad Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field through the plugin's 'adinserter' shortcode in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping on user supplied...
Cross-Site Scripting (XSS)
dotnetnuke.core is vulnerable to a Cross-Site Scripting XSS. The vulnerability is due to improper input validation in the Biography field, which allows an attacker to inject and execute malicious JavaScript code in the context of the website, affecting other users including administrators and...
Stored Cross-Site Scripting (XSS)
com.liferay, com.liferay.change.tracking.service is vulnerable to Stored Cross-Site Scripting XSS. The vulnerability is due to improper validation of user-supplied input in the notifications widget’s “Name” text field, which allows an attacker to inject arbitrary web scripts or HTML into a...
CVE-2025-57244
OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...
CVE-2025-57244
OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990242)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990242 advisory. In the Linux kernel, the following vulnerability has been resolved: HID: betop: check shape of output reports betopffinit only checks the total sum of the report...
CVE-2025-57244
OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) within the user account creation interface. The vulnerability arises from insufficient front-end validation , where the Name field accepts script tags and the Email field is susceptible when a POST request is modif...
CVE-2025-57244: Improper Neutralization of Input During Web Page Generation
OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...
AIxBlock Cross-Site Scripting Vulnerability
AIxBlock is an AI automation platform. A cross-site scripting vulnerability exists in AIxBlock version 04f305, which stems from a modeldesc field that does not validate input and can be exploited by an attacker to cause a stored cross-site scripting attack...
CVE-2025-63417: Improper Neutralization of Input During Web Page Generation
A Stored Cross-Site Scripting XSS vulnerability in the chat functionality of the SelfBest platform 2023.3 allows authenticated attackers to inject arbitrary web scripts or HTML via the chat message input field. This malicious content is stored and then executed in the context of other users'...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-989424)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989424 advisory. In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Bounds check struct nfctarget arrays While running under CONFIGFORTIFYSOURCE=y, syzkall...
Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989963)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989963 advisory. In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix possible buffer overflow struct hcidevinfo has a fixed size name8 field s...
Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990283)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990283 advisory. In the Linux kernel, the following vulnerability has been resolved: traceeventshist: add check for return value of 'createhistfield' Function 'createhistfield' is...
Liferay Portal 7.2.0 < 7.4.3.112 XSS
Cross-site scripting XSS vulnerability in the Blogs widget in Liferay Portal allows remote attackers to inject arbitrary web script or HTML via a crafted injected into a blog entry's 'Content' text field. The Blogs widget does not add the sandbox attribute to elements, which allows remote attacke...
CVE-2025-57244
OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting XSS in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation...
CVE-2025-62722 LinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature
LinkAce is a self-hosted archive to collect website links. In versions 2.3.1 and below, the social media sharing functionality contains a Stored Cross-Site Scripting XSS vulnerability that allows any authenticated user to inject arbitrary JavaScript by creating a link with malicious HTML in the...
CVE-2025-8900
The Doccure Core plugin for WordPress is vulnerable to privilege escalation in versions up to, and excluding, 1.5.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'usertype' field. This makes it possible for unauthenticated attacke...