CVE-2025-1747 HTML injection vulnerability in OpenCart

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/login...

CVE-2025-22274 HTML injection in CyberArk Endpoint Privilege Manager

It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not...

CVE-2025-22274 HTML injection in CyberArk Endpoint Privilege Manager

It is possible to inject HTML code into the page content using the "content" field in the "Application definition" page. This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of other versions is unknown. After multiple attempts to contact the vendor we did not...

CVE-2025-22274

CVE-2025-22274 affects CyberArk Endpoint Privilege Manager (SaaS) 24.7.1. Affected component: the HTML content entered in the Application definition page can lead to HTML injection in the page output. Root cause described in sources as an HTML injection via the content field; other versions are u...

CVE-2025-22270 Stored XSS in CyberArk Endpoint Privilege Manager

An attacker with access to the Administration panel, specifically the "Role Management" tab, can inject code by adding a new role in the "name" field. It should be noted, however, that the risk of exploiting vulnerability is reduced due to the required additional error that allows bypassing the...

PT-2025-9102 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions prior to 4.1.0 Description: The issue allows an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in "/account/login" API endpoint. This could potentially lead to...

PT-2025-9104 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions prior to 4.1.0 Description: The issue allows an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in the "/account/voucher" API endpoint. This could potentially...

PT-2025-9093 · Cyberark · Cyberark Endpoint Privilege Manager

Name of the Vulnerable Software and Affected Versions: CyberArk Endpoint Privilege Manager version 24.7.1 Description: The issue allows for HTML code injection into the page content through the content field in the Application definition page. The estimated number of potentially affected devices...

PT-2025-9089 · Cyberark · Cyberark Endpoint Privilege Manager

Name of the Vulnerable Software and Affected Versions: CyberArk Endpoint Privilege Manager in SaaS version 24.7.1 Description: The issue allows an attacker with access to the Administration panel, specifically the "Role Management" tab, to inject code by adding a new role in the name field...

Gitea 1.24.0+dev HTML Injection / Cross Site Scripting

Gitea version 1.24.0+dev suffers from an html injection vulnerability that can allow for cross site scripting. Title: Gitea 1.24.0+dev HTML Injection Vulnerability Description: Gitea version 1.24.0+dev-355-g74c8e95e87 is vulnerable to an HTML Injection vulnerability. The issue arises due to...

HTML Injection

leantime/leantime is vulnerable to HTML injection. The vulnerability is due to improper neutralization of HTML tags in users' first names, allowing arbitrary HTML to be injected into emails...

CVE-2025-25825

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section...

Gitlab -- Vulnerabilities

Gitlab reports: XSS in k8s proxy endpoint XSS Maven Dependency Proxy HTML injection leads to XSS on self hosted instances Improper Authorisation Check Allows Guest User to Read Security Policy Planner role can read code review analytics in private projects...

CVE-2025-25823

CVE-2025-25823 is an XSS in Emlog Pro v2.5.4. An attacker can inject a crafted payload into the article header at /admin/article.php to execute arbitrary web scripts/HTML. Reported impact per sources: arbitrary script execution, with CVSSv3.1 vector indicating local access, user interaction requi...

CVE-2025-25825

A cross-site scripting XSS vulnerability in Emlog Pro v2.5.4 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Titile in the article category section...

CVE-2024-49337

IBM OpenPages with Watson 8.3 and 9.0 IBM OpenPages is vulnerable to HTML injection, caused by improper validation of user-supplied input of text fields used to construct workflow email notifications. A remote authenticated attacker could exploit this vulnerability using HTML tags in a text field...

CVE-2023-51308

PHPJabbers Car Park Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, pluginsmsapikey, pluginsmscountrycode, title, pluginsmsapikey, title" parameters...

CVE-2023-51317

PHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, pluginsmsapikey, pluginsmscountrycode, title, pluginsmsapikey, title" parameters...

GHSA-95J3-435G-VJCP Leantime affected by Improper Neutralization of HTML Tags

Summary HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address...

Leantime affected by Improper Neutralization of HTML Tags

Summary HTML can be arbitrarily injected into emails from Leantime due to improper neutralization of HTML tags in users' first names. This effectively allows for the creation of phishing emails from a Leantime instance's email address...