5763 matches found
WordPress JetPopup Cross-Site Scripting Vulnerability
WordPress JetPopup is an Elementor plugin designed for WordPress, which is mainly used to create various popups e.g. subscription forms, offer banners, etc., and supports a variety of triggers and template customization. WordPress JetPopup suffers from a cross-site scripting vulnerability that...
WordPress Bold Page Builder Cross-Site Scripting Vulnerability
WordPress Bold Page Builder is a free and open source page builder plugin that allows users to quickly create custom page layouts through a drag and drop interface without writing code. WordPress Bold Page Builder suffers from a cross-site scripting vulnerability that originates from improper inp...
CVE-2025-4294
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in HotelRunner B2B allows Cross-Site Scripting XSS. This issue affects B2B: before 04.06.2025...
CVE-2025-4294
CVE-2025-4294: HotelRunner B2B has an XSS flaw due to improper neutralization of input during web page generation in versions prior to 04.06.2025. Affects HotelRunner B2B; impact is Cross-Site Scripting with potential user interaction required. Remediation: update to version 04.06.2025 or later. ...
PT-2025-30416 · Hotelrunner · Hotelrunner B2B
Name of the Vulnerable Software and Affected Versions: HotelRunner B2B versions prior to 04.06.2025 Description: This issue allows for Cross-Site Scripting XSS. The vulnerability is due to improper neutralization of input during web page generation. Recommendations: Update HotelRunner B2B to...
CVE-2025-7715 Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Block Attributes allows Cross-Site Scripting XSS.This issue affects Block Attributes: from 0.0.0 before 1.1.0, from 2.0.0 before 2.0.1...
CVE-2025-41681 Persistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of Input
A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content...
CVE-2025-41681
CVE-2025-41681 is a persistent XSS due to improper neutralization of input, affecting Helmholz REX100 and MB CONNECT LINE mbNET.mini (versions
CVE-2025-41681 Persistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of Input
A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content...
CVE-2025-41675 Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command...
CVE-2025-41675
CVE-2025-41675 concerns MB CONNECT LINE mbNET.mini and Helmholz/mbNET.mini gateways where an OS command injection arises from improper neutralization of special elements in OS commands. The vulnerability allows a high-privilege remote attacker to trigger arbitrary system commands via GET requests...
CVE-2025-41675 Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command...
CVE-2025-41674
The CVE-2025-41674 entry matches an OS command injection in MB CONNECT LINE mbNET.mini (industrial router) and Helmholz REX100/mbNET.mini family where improper neutralization of special elements in OS commands enables remote execution of commands via POST to a diagnostic action. Connected sources...
CVE-2025-41674 Remote Command Injection in diagnostic Action Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...
CVE-2025-41674 Remote Command Injection in diagnostic Action Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command...
CVE-2025-41673 Remote Command Injection in send_sms Action Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via POST requests in the sendsms action due to improper neutralization of special elements used in an OS command...
CVE-2025-41673
CVE-2025-41673 affects MB CONNECT LINE mbNET.mini (industrial router). The vulnerability is an OS command-injection in the send_sms operation caused by improper neutralization of special elements, enabling remote execution of system commands via POST requests. Vulnerable versions are prior to 2.3...
CVE-2025-41673 Remote Command Injection in send_sms Action Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via POST requests in the sendsms action due to improper neutralization of special elements used in an OS command...
Drupal Cookies Addons 安全漏洞
Drupal Cookies Addons is a plugin for the Drupal community. A security vulnerability exists in Drupal Cookies Addons versions prior to 1.2.4, which stems from improper input neutralization during page generation and could lead to a cross-site scripting attack...