The vulnerability of the web interface of the IBM System Storage Virtualization Engine allows a attacker to execute arbitrary JavaScript code and disclose protected information.

The vulnerability of the web interface of the IBM System Storage Virtualization Engine lies in the insufficient protection of the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code and disclose sensitive information...

CVE-2025-53631

flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads to arbitrary JavaScript execution XSS on all pages the post is reflected on including /, /post/ID, /admin/posts, and /user/ID of the user...

CVE-2025-55346 Unintended dynamic code execution leads to remote code execution by network attackers

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-55346 Unintended dynamic code execution leads to remote code execution by network attackers

User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request...

CVE-2025-45315

A cross-site scripting XSS vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the email parameter...

CVE-2025-8911

Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-8911

Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-8910

Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-8911 WellChoose｜Organization Portal System - Reflected Cross-site Scripting

Organization Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2025-8911

CVE-2025-8911 concerns WellChoose’s Organization Portal System, which is affected by a reflected XSS vulnerability. The issue allows unauthenticated attackers to cause arbitrary JavaScript execution in a user’s browser via phishing-style input. Public references across CNVD/NVD/Red Hat and others...

CVE-2025-8910

CVE-2025-8910 affects WellChoose Organization Portal System. The connected sources describe a Reflected Cross-Site Scripting (XSS) vulnerability that enables unauthenticated attackers to execute arbitrary JavaScript in a user’s browser via phishing. The issue is widely reported across NVD, Red Ha...

WellChoose Organization Portal System 跨站脚本漏洞

WellChoose Organization Portal System is an electronic directory service system from WellChoose in Taiwan, China. The WellChoose Organization Portal System suffers from a cross-site scripting vulnerability that originates from the application's lack of effective filtering and escaping of...

CVE-2025-50690: Improper Neutralization of Input During Web Page Generation

A Cross-Site Scripting XSS vulnerability exists in SpatialReference.org OSGeo/spatialreference.org versions prior to 2025-05-17 commit 2120adfa17ddd535bd0f539e6c4988fa3a2cb491. The vulnerability is caused by improper handling of user input in the search query parameter. An attacker can craft a...

CVE-2025-45314

A cross-site scripting XSS vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a user's browser via a crafted payload injected into the add function...

The vulnerability in the software web interface for managing business efficiency of IBM Planning Analytics Local allows a attacker to execute arbitrary JavaScript code.

The vulnerability of the software web interface for managing business efficiency in IBM Planning Analytics Local is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...

The vulnerability in the web interface of the IBM Planning Analytics Local software allows a perpetrator to execute arbitrary JavaScript code.

The vulnerability of the IBM Planning Analytics Local software web interface is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...

The vulnerability of the web interface of the IBM Sterling B2B Integrator and the IBM Sterling File Gateway file server allows a malicious actor to execute arbitrary JavaScript code and disclose protected information.

The vulnerability of the IBM Sterling B2B Integrator and the IBM Sterling File Gateway file server’s software integration interfaces is related to the lack of protective measures for the web interface structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScrip...

The vulnerability of the web interface of the IBM Sterling B2B Integrator and the IBM Sterling File Gateway file server allows a malicious actor to execute arbitrary JavaScript code and disclose protected information.

The vulnerability of the IBM Sterling B2B Integrator and the IBM Sterling File Gateway file server’s software integration interfaces is related to the lack of protective measures for the web interface structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScrip...

CVE-2025-54800 Hydra persistent XSS in build metrics

Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-par...

📄 Anchor CMS 0.12.7 Cross Site Scripting

Anchor CMS version 0.12.7 suffers from a persistent cross site scripting vulnerability. Anchor CMS v0.12.7 - Stored XSS CVE-2025-46041 Anchor CMS v0.12.7 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability in the description field of the /admin/pages/add interface. CVE ID...