Improper Input Validation

github.com/mattermost/mattermost-servert is vulnerable to Improper Input Validation. The vulnerability is due to failure to sanitize the team invite ID in the /api/v4/teams/:teamId/restore endpoint, which allows a team admin without invite privileges to obtain the team’s invite ID...

CVE-2025-6575

CVE-2025-6575 is a reflected XSS in Dolusoft Omaspot caused by improper input neutralization during web page generation. Affected versions are prior to 12.09.2025. Attack vector is network with user interaction required for exploitation; impact is partial confidentiality and integrity concerns as...

CVE-2025-2404

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ubit Information Technologies STOYS allows Cross-Site Scripting XSS. This issue affects STOYS: from 2 before 20250916...

CVE-2025-2404 XSS in Ubit Information Technologies' STOYS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Ubit Information Technologies STOYS allows Cross-Site Scripting XSS. This issue affects STOYS: from 2 before 20250916...

PHPGurukul Auto Taxi Stand Management System 安全漏洞

PHPGurukul Auto Taxi Stand Management System is an auto cab stand management system from PHPGurukul. A security vulnerability exists in the PHPGurukul Auto Taxi Stand Management System that stems from not properly cleaning up user input and could lead to a cross-site scripting attack...

Amazon Linux 2 : pki-core, --advisory ALAS2-2025-2995 (ALAS-2025-2995)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-2995 advisory. Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Bootstrap allows Cross-Site Scripting XSS.This issue affects Bootstrap: from 3.4.1 before 4.0.0...

Azora Wireless Network Management SQL注入漏洞

Azora Wireless Network Management is a wireless network management platform from Azora Turkey. An SQL injection vulnerability exists in Azora Wireless Network Management 20250916 and prior versions, which stems from improper neutralization of special elements and could lead to an SQL injection...

PT-2025-37982

Name of the Vulnerable Software and Affected Versions: Workcube ERP versions V12 through V14 through 20250916 Description: Workcube ERP is susceptible to a Reflected Cross-site Scripting XSS issue due to improper neutralization of input during web page generation. Recommendations: Workcube ERP...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input when handling InternetDomainName values. An attacker can access cookies set by the application across subdomains by controlling a website that shares the same top-level domain...

CVE-2024-45431

OpenSynergy BlueSDK aka Blue SDK through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of proper validation of remote L2CAP channel ID CID. An attacker can leverage this to create an L2CAP channel with the null...

CVE-2024-45431

OpenSynergy BlueSDK aka Blue SDK through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of proper validation of remote L2CAP channel ID CID. An attacker can leverage this to create an L2CAP channel with the null...

CVE-2024-45431

OpenSynergy BlueSDK aka Blue SDK through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of proper validation of remote L2CAP channel ID CID. An attacker can leverage this to create an L2CAP channel with the null...

CVE-2024-45431

OpenSynergy BlueSDK aka Blue SDK through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. The issue results from the lack of proper validation of remote L2CAP channel ID CID. An attacker can leverage this to create an L2CAP channel with the null...

CVE-2025-55054

CWE-79 Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting'...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation due to a logic error in ippreadio which is called internally by cupsDoRequest, ippValidateAttributes has a null dereference. An attacker can cause the application to crash by sending specially crafted data over...

CVE-2025-54247

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access...

CVE-2025-58989

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in silverplugins217 Dynamic Text Field For Contact Form 7 dynamic-text-field-for-contact-form-7 allows Stored XSS.This issue affects Dynamic Text Field For Contact Form 7: from n/a through = 1.0...

CVE-2025-54248

Adobe Experience Manager versions 6.5.23.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Scope is...

Fortinet FortiDDoS-F Operating System Command Injection Vulnerability

Fortinet FortiDDoS-F is a distributed denial-of-service protection system from the U.S. company Fiat Fortinet. Fortinet FortiDDoS-F suffers from an operating system command injection vulnerability that stems from improper neutralization of special elements, which can be exploited by an attacker t...

Cross-Site Scripting (XSS)

express-gateway is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input handling in lib/rest/routes/users.js of the REST Endpoint, which allows an attacker to execute malicious scripts remotely...