6843 matches found
CVE-2025-62248: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting XSS vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through...
Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget
A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,...
CVE-2025-62528
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for a project member to put JavaScript in name or description fields which would run on project load. This issue has been patched in version 1.5.0...
CVE-2025-61255
Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting XSS vulnerability via the /search parameter, where unsanitized input allows arbitrary HTML and JavaScript injection, potentially resulting in information disclosure and user redirection...
CVE-2025-62249
A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,...
CVE-2025-62249
A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,...
CVE-2025-61255
Bank Locker Management System by PHPGurukul is affected by a Cross-Site Scripting XSS vulnerability via the /search parameter, where unsanitized input allows arbitrary HTML and JavaScript injection, potentially resulting in information disclosure and user redirection...
PT-2025-42904
Name of the Vulnerable Software and Affected Versions Bang Resto version 1.0 Description A Cross-Site Scripting XSS issue exists in Bang Resto version 1.0. This is due to inadequate input sanitization or output encoding, which allows an attacker to inject malicious JavaScript code into the...
CVE-2025-61255
The Bank Locker Management System by PHPGurukul is susceptible to a Cross-Site Scripting (XSS) vulnerability via the /search parameter. The root cause is the lack of effective filtering and escaping of user-supplied data, which allows an attacker to inject arbitrary HTML and JavaScript . This cou...
Taguette 跨站脚本漏洞
Taguette is a qualitative research tool by the individual developer Remi Rampin. A cross-site scripting vulnerability exists in Taguette versions prior to 1.5.0, which stems from a project member being able to insert JavaScript code into a name or description field, potentially leading to a...
PT-2025-42806
Name of the Vulnerable Software and Affected Versions Taguette versions prior to 1.5.0 Description A flaw exists in Taguette that allows a project member to inject JavaScript code into the name or description fields. This code could then execute when the project is loaded. There is no information...
CVE-2025-11925
Incorrect Content-Type header in one of the APIs text/html instead of application/json replies may potentially allow injection of HTML/JavaScript into reply.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
CVE-2025-11925: Improper Check for Unusual or Exceptional Conditions
Incorrect Content-Type header in one of the APIs text/html instead of application/json replies may potentially allow injection of HTML/JavaScript into reply.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...
CVE-2025-11183
Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page...
CVE-2025-60374
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Perfex CRM chatbot module in versions prior to 3.3.1 . The flaw stems from insufficient input validation of the chatbot message parameter and a lack of output encoding when rendering stored messages. Attackers can inject arbitrary HT...
CVE-2025-60374
Stored Cross-Site Scripting XSS in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The payload is executed in the browsers of users viewing the chat, resulting in client-side code execution, potential session token theft, and other malicious actions. A...
GHSA-GXP8-M5RQ-3M38 QGIS QWC2 Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page...
CVE-2025-11184
Cross-site scripting vulnerability in QGIS QWC2 Registration GUI =v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript code in the page...
CVE-2025-11184 Cross-Site Scripting Vulnerability in QWC2 Registration GUI
Cross-site scripting vulnerability in QGIS QWC2 Registration GUI =v2025.03.31 allows an authorized attacker to plant arbitrary JavaScript code in the page...