CVE-2025-13736 Username Enumeration via Login Interface in Multiple WSO2 Products Allows User Account Discovery

When Multi-Attribute Login is enabled, the login interface fails to consistently mask the existence of user accounts. For valid users, the server resolves and displays their canonical username, while for non-existent users, it echoes the original input. This occurs regardless of the...

CVE-2026-25624

An administrative cross-site scripting XSS vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall NGFW. Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vector payload processin...

PT-2026-45875

Name of the Vulnerable Software and Affected Versions Go affected versions not specified Description Functions within the net/textproto package include input as part of the error when returning errors. This behavior allows an attacker to inject misleading content into errors that are subsequently...

reflected-xss-demo

Reflected XSS Demo Small intentionally vulnerable loca...

CVE-2024-10483

The Simple:Press Forum WordPress plugin before 6.10.11 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

Hotel Management System Cross-Site Scripting Vulnerability

Hotel Management System is a hotel management system based MIS project by Prem Chand Saini, an individual developer in India. A cross-site scripting vulnerability exists in Hotel Management System v1.0, which originates when the checkoutdate parameter in reservation.php is copied in plain text...

Hotel Management System Cross-Site Script Vulnerabilities

Hotel Management System is an MIS project based on a hotel management system. Hotel Management System v1.0 suffers from a cross-site scripting vulnerability that originates when the adults parameter in reservation.php is copied in plain text between tags in an HTML document, and any input is echo...

CVE-2023-44484

Online Blood Donation Management System v1.0 is vulnerable to a Stored Cross-Site Scripting vulnerability. The 'firstName' parameter of the users/register.php resource is copied into the users/member.php document as plain text between tags. Any input is echoed unmodified in the users/member.php...

PT-2021-23329 · Archibus · Archibus Web Central

Name of the Vulnerable Software and Affected Versions: ARCHIBUS Web Central versions 21.3.3.815 and earlier Description: The issue occurs in the /archibus/dwr/call/plaincall/workflow.runWorkflowRule.dwr endpoint because the data received as input from clients is re-included within the HTTP respon...