CVE-2025-40730

The CVE-2025-40730 entry concerns HTML injection in Vox Media’s Chorus CMS. The vulnerability arises from an injection in the /search?q parameter, allowing an attacker to execute JavaScript in a victim’s browser and potentially steal session cookies or perform actions on behalf of the user. Affec...

CVE-2025-40730 HTML injection in Vox Media's Chorus CMS

HTML injection in Vox Media's Chorus CMS. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the 'q' parameter in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to...

Security Bulletin: Informix HQ is vulnerable to HTML injection and does not lock out users after multiple incorrect password attempts.

Summary The Informix HQ "alerting configuration" feature is vulnerable to HTML injection because it accepts HTML scripts in the script Location field and only affects their own session, not any other user sessions. Additionally, the Informix HQ application does not enforce a lockout policy, even...

Vox Media Chorus CMS Cross-site Scripting Vulnerability

Vox Media Chorus CMS is a content publishing system from Vox Media, Inc. Vox Media Chorus CMS suffers from a cross-site scripting vulnerability that originates from HTML injection and could lead to cross-site scripting attacks...

PT-2025-31113 · Ibm · Ibm Informix Dynamic Server

Name of the Vulnerable Software and Affected Versions: IBM Informix Dynamic Server versions 12.10 and 14.10 Description: IBM Informix Dynamic Server is susceptible to HTML injection. A remote attacker can inject malicious HTML code that executes in a victim’s web browser within the security conte...

PT-2025-31063 · Vox Media · Horus Cms

Name of the Vulnerable Software and Affected Versions: Vox Media Chorus CMS affected versions not specified Description: An HTML injection issue exists in Vox Media’s Chorus CMS. An attacker can execute JavaScript code in a victim’s browser by sending a malicious URL utilizing the q parameter in...

CVE-2025-40730: Improper Neutralization of Input During Web Page Generation

HTML injection in Vox Media's Chorus CMS. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the 'q' parameter in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to...

CVE-2024-49343: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

IBM Informix Dynamic Server 12.10 and 14.10 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2023-53155

goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter...

CVE-2023-53155

goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter...

CVE-2023-53155

goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter...

PT-2025-30896 · Embedthis · Goahead

Name of the Vulnerable Software and Affected Versions: EmbedThis GoAhead version 2.5 Description: The software contains a flaw that allows for HTML injection through the name parameter in the goform/formTest component. Recommendations: At the moment, there is no information about a newer version...

CVE-2025-45406: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbartime parameter. NOTE: this is disputed by the Supplier because attackers cannot influence the value of debugbartime, and...

CVE-2023-53155: Improper Neutralization of Input During Web Page Generation

goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter...

CVE-2023-53155

CVE-2023-53155 affects EmbedThis GoAhead 2.5. The vulnerability is an HTML injection (XSS) via the name parameter in goform/formTest. Exploitation and public attestations exist (e.g., Exploit-DB); multiple mirrors/alerts reiterate the same flaw. Connected entries corroborate the issue across vend...

[SECURITY] [DLA 4249-1] mediawiki security update

Debian LTS Advisory DLA-4249-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin July 23, 2025 https://wiki.debian.org/LTS Package : mediawiki Version : 1:1.35.13-1+deb11u4 CVE ID : CVE-2025-3469 CVE-2025-6590 CVE-2025-6591 CVE-2025-6593 CVE-2025-6594 CVE-2025-6595...

CVE-2025-51400

A stored cross-site scripting XSS vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

CVE-2025-50481: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into a blog post...

CVE-2025-51400: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the Personal Canned Messages of Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

CVE-2025-51396: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter...