CVE-2024-54220

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in roninwp FAT Services Booking fat-services-booking allows Stored XSS.This issue affects FAT Services Booking: from n/a through = 5.6...

CVE-2024-11986

Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administrator views the logs using the application's standard functionality, it enables the execution of the payload, resulting in Stored XSS or 'Cross-Site Scriptin...

CVE-2024-31199

A “CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'” allows malicious users to permanently inject arbitrary Javascript code...

CVE-2025-22205

Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x...

CVE-2025-22205

CVE-2025-22205 concerns the Admiror Gallery extension for Joomla, specifically the 4.x branch. The root cause is improper handling of input variables, leading to multiple path traversal vulnerabilities. The CVSS v3.1 base score is 7.5 (HIGH) with Confidentiality Impact: HIGH and no impact on inte...

CVE-2025-22205 Extension - admiror-design-studio.com - Path traversal in the Admiror Gallery 4.x component for Joomla

Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x...

PT-2025-4608 · Unknown · Fm Notification Bar

Name of the Vulnerable Software and Affected Versions: FM Notification Bar versions 1.0.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject maliciou...

PT-2025-5434 · WordPress · Wp Mailster

Name of the Vulnerable Software and Affected Versions: WP Mailster versions 1.8.17.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious scripts in...

PT-2025-4389

Name of the Vulnerable Software and Affected Versions Admiror Gallery extension for Joomla version branch 4.x Description The issue arises from improper handling of input variables, leading to multiple path traversal vulnerabilities. This allows unauthorized access to sensitive files and...

WordPress plugin Find Content IDs 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exis...

WordPress plugin SendPulse Email Marketing Newsletter 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers. WordPress plugin is an application plugin. A cross-site scripting vulnerability exists ...

Admiror Gallery 安全漏洞

Admiror Gallery is an on-the-fly solution for image galleries by Nikola Vasiljevski, an individual developer. A security vulnerability exists in Admiror Gallery that stems from improper handling of input variables, resulting in a multiple path traversal vulnerability...

WordPress plugin Product Blocks for WooCommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin World Cup Predictor 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2025-4704 · Unknown · Landoweb Programador World Cup Predictor

Name of the Vulnerable Software and Affected Versions: Landoweb Programador World Cup Predictor versions 1.9.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Reflected Cross-site Scripting XSS. This means that an...

PT-2025-4633 · Unknown · Notfound Traveler Code

Name of the Vulnerable Software and Affected Versions: NotFound Traveler Code versions n/a through 3.1.0 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows malicious SQL commands to be executed...

WordPress plugin WP24 Domain Check 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2025-24707

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gt3themes Photo Gallery gt3-photo-video-gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through = 2.7.7.24...

CVE-2025-22683

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPDeveloper NotificationX notificationx allows Stored XSS.This issue affects NotificationX: from n/a through = 2.9.5...

WordPress plugin ThriveDesk 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...