Exploit for CVE-2025-32965

This is a PoC exploit for CVE-2025-32965, a supply chain attack...

The server for managing Fortinet FortiClient Enterprise Management Server is vulnerable. This vulnerability stems from the lack of security measures taken to protect the website structure, allowing attackers to send messages containing JavaScript code.

The vulnerability of the Fortinet FortiClient Enterprise Management Server EMS server exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to send messages containing JavaScript code via a specially created link...

CVE-2025-32960

The CVE-2025-32960 vulnerability affects the CUBA REST API add-on prior to 7.2.7, where the input parameter (file path and name) can be manipulated to cause the server to return Content-Type: text/html for names ending in .html, enabling execution of malicious JavaScript in the browser after an a...

GHSA-88H5-34XW-2Q56 XSS in the /files Endpoint of the Generic REST API

Impact The input parameter, which consists of a file path and name, can be manipulated to return the Content-Type header with text/html if the name part ends with .html. This could allow malicious JavaScript code to be executed in the browser. For a successful attack, a malicious file needs to be...

CVE-2025-26159

CVE-2025-26159 affects Laravel Starter 11.11.0. The vulnerability is an XSS in the tags feature where any user who can create or modify tags can inject malicious JavaScript into the name field. The exact root cause and affected components are described in the connected documents as an XSS issue i...

PT-2025-17590 · Unknown · Laravel Starter

Name of the Vulnerable Software and Affected Versions: Laravel Starter version 11.11.0 Description: The issue concerns Cross Site Scripting XSS in the tags feature. Users who can create or modify tags can inject malicious JavaScript code into the name field. Recommendations: For Laravel Starter...

CVE-2025-25427 XSS in TP-Link TL-WR841N v14/v14.6/v14.8 Upnp page

A stored cross-site scripting XSS vulnerability in the upnp.htm page of the web Interface in TP-Link WR841N v14/v14.6/v14.8 = Build 241230 Rel. 50788n allows remote attackers to inject arbitrary JavaScript code via the port mapping description. This leads to an execution of the JavaScript payload...

CVE-2025-25427

Stored XSS vulnerability CVE-2025-25427 in TP-Link WR841N web interface (upnp.htm) allows injection of arbitrary JavaScript via the port mapping description. Impact: payload executes when the upnp page loads. Affected: WR841N v14/v14.6/v14.8

Azure Linux 3.0 Security Update: rabbitmq-server (CVE-2025-30219)

The version of rabbitmq-server installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-30219 advisory. - RabbitMQ is a messaging and streaming broker. Versions prior to 4.0.3 are vulnerable to a...

CVE-2025-1983 Stored Cross-Site Scripting in Ready_

A cross-site scripting XSS vulnerability in Ready's File Explorer upload functionality allows injection of arbitrary JavaScript code in filename. Injected content is stored on server and is executed every time a user interacts with the uploaded file...

CVE-2025-1983

CVE-2025-1983 describes an XSS in Ready_’s File Explorer upload: an attacker can inject JavaScript via the filename. The injected content is stored server-side and executes whenever a user interacts with the uploaded file. Connected sources (NVD and Red Hat CVEs) confirm the same description, ide...

The vulnerability of the E-Staff automated recruitment process system, related to errors in data filtering in document display functions, allows a perpetrator to execute arbitrary JavaScript code.

The vulnerability of the E-Staff recruitment process automation system is related to errors in data filtering in document display functions. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code remotely...

CVE-2025-3423

IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2022-43850

IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-3423

IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-3423 IBM Aspera Faspex 5 cross-site scripting

IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-3423

IBM Aspera Faspex 5.x (versions 5.0.0–5.0.11) is affected by a DOM-based cross-site scripting vulnerability that lets an authenticated user embed arbitrary JavaScript in the Web UI, potentially leading to credential disclosure within a trusted session. The issue stems from inadequate input handli...

CVE-2023-42007

IBM Sterling Control Center 6.2.1, 6.3.1, and 6.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Security Bulletin: IBM Aspera Faspex 5 is vulnerable to cross-site scripting (CVE-2025-3423)

Summary IBM Aspera Faspex 5 is vulnerable to DOM-based cross-site scripting. Attackers could use this vulnerability to trick users into opening malicious URLs, allowing client-side scripts to process and execute at the user's browser. Vulnerability Details CVEID:CVE-2025-3423 DESCRIPTION: IBM...

Security Bulletin: IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities

Summary IBM QRadar Wincollect is vulnerable to using components with known vulnerabilities. IBM has addressed the relevant vulnerabilities with updates. Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for writing next generation JavaScript. When using versions of Babel...