JVN#21048820: WordPress plugin "Advanced Custom Fields" vulnerable to HTML injection

Advanced Custom Fields provided by WPEngine, Inc. contains the following vulnerability. HTML injection CWE-94 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N Base Score 4.6 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N Base Score 3.4 CVE-2025-54940 Impact Crafted HTML code may be...

WordPress Plugin Advanced Custom Fields: Code Injection Vulnerability

WordPress Advanced Custom Fields Plugin is a powerful custom fields plugin for WordPress that allows you to add many types of custom fields such as images, checkboxes, files, text, etc. to posts, pages, categories, users, and other objects, and supports exporting to XML or PHP code, and can be...

CVE-2025-54940: Improper Control of Generation of Code

An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may be rendered and page display may be tampered...

CVE-2025-51053: Improper Neutralization of Input During Web Page Generation

A Cross-site scripting XSS vulnerability in /apivedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser...

CVE-2025-51534

A cross-site scripting (XSS) vulnerability exists in Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 . The flaw stems from the improper neutralization of input within the Name field , where an attacker can inject a crafted payload to execute arbitrary web scripts or HTML. To remediate th...

CVE-2025-45778: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description text field...

CVE-2025-26064

A cross-site scripting XSS vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the name of a connnected device...

CVE-2025-50848: Improper Neutralization of Input During Web Page Generation

A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestricted upload of HTML files, which are rendered directly in the browser when accessed. This allows an attacker to upload a crafted HTML file containing malicious...

CVE-2024-49343

IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2025-8319

the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter...

CVE-2025-8319

the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter...

CVE-2025-8319

The Barracuda Message Archiver (BMA) email archiving platform is vulnerable to a DOM-based Cross-Site Scripting (XSS) attack. The vulnerability exists in the BMA login interface , where the application fails to properly sanitize the error= URL parameter. This allows an attacker to inject arbitrar...

CVE-2024-49343

IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2024-49343

IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2024-49343 IBM Informix Dynamic Server HTML injection

IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2024-49343 IBM Informix Dynamic Server HTML injection

IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2024-49343

CVE-2024-49343 affects IBM Informix Dynamic Server (IDS) versions 12.10 and 14.10. The issue is an HTML injection vulnerability: a remote attacker can inject malicious HTML that is rendered in the victim’s browser within the hosting site’s security context. The provided documents do not describe ...

CVE-2025-40730

HTML injection in Vox Media's Chorus CMS. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the 'q' parameter in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to...

CVE-2025-40730 HTML injection in Vox Media's Chorus CMS

HTML injection in Vox Media's Chorus CMS. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the 'q' parameter in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to...

CVE-2025-40730

The CVE-2025-40730 entry concerns HTML injection in Vox Media’s Chorus CMS. The vulnerability arises from an injection in the /search?q parameter, allowing an attacker to execute JavaScript in a victim’s browser and potentially steal session cookies or perform actions on behalf of the user. Affec...