CVE-2025-62418

Bagisto v2.3.7 contains an XSS vulnerability in TinyMCE image upload: uploading a crafted SVG with embedded JavaScript is possible by an admin or other privileged user, leading to code execution in the context of the viewer’s browser. The issue arises from SVGs being accepted without sanitization...

CVE-2025-59269

A stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2025-55072

Stored cross-site scripting XSS vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser...

CVE-2025-54859

Stored cross-site scripting XSS vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser...

CVE-2025-55072

Stored cross-site scripting XSS vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser...

CVE-2025-52583

Reflected cross-site scripting XSS vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser...

EUVD-2025-34749

Reflected cross-site scripting XSS vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser...

CVE-2025-24833

CVE-2025-24833 is a stored XSS vulnerability in desknet’s NEO, affecting version range V4.0R1.0–V9.0R2.0. The issue allows execution of arbitrary JavaScript in a user’s browser via a stored payload. The connected Red Hat (RH:CVE-2025-24833) and other feeds confirm the same description. No exploit...

EUVD-2025-34750

Stored cross-site scripting XSS vulnerability in desknet's NEO versions V4.0R1.0–V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser...

NEOJAPAN desknets Web Server 跨站脚本漏洞

NEOJAPAN desknets Web Server is a back-end service for a large network group collaboration software from NEOJAPAN Japan. A cross-site scripting vulnerability exists in NEOJAPAN desknets Web Server, which stems from susceptibility to reflective cross-site scripting attacks that could lead to the...

NEOJAPAN desknets NEO 跨站脚本漏洞

NEOJAPAN desknets NEO is a large network group collaboration software from NEOJAPAN Japan. A cross-site scripting vulnerability exists in NEOJAPAN desknets NEO versions V2.0R1.0 through V9.0R2.0 that originates from stored cross-site scripting and could lead to the execution of arbitrary JavaScri...

PT-2025-42455

Name of the Vulnerable Software and Affected Versions desknet NEO versions 9.0R2.0 and earlier Description A stored cross-site scripting issue exists in desknet NEO. This allows the execution of arbitrary JavaScript code within a user's web browser. Recommendations Update desknet NEO to a version...

CVE-2025-55072: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser...

CVE-2025-54859: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser...

CVE-2025-54760: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting XSS vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser...

CVE-2025-52583: Improper Neutralization of Input During Web Page Generation

Reflected cross-site scripting XSS vulnerability in desknet's Web Server allows execution of arbitrary JavaScript in a user’s web browser...

CVE-2025-62411: Improper Neutralization of Input During Web Page Generation

LibreNMS is a community-based GPL-licensed network monitoring system. LibreNMS = 25.8.0 contains a Stored Cross-Site Scripting XSS vulnerability in the Alert Transports management functionality. When an administrator creates a new Alert Transport, the value of the Transport name field is stored a...

PT-2025-42537

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.8 Bagisto version 2.3.7 Description The TinyMCE image upload functionality allows an attacker with sufficient privileges to upload a crafted SVG file containing embedded JavaScript. When viewed, the malicious code...

PT-2025-42534

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.3.8 Description The TinyMCE image upload functionality in Bagisto allows an attacker with sufficient privileges to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes ...

Desknets Neo 跨站脚本漏洞

Desknets Neo is a remote office support software from Desknets Japan. A cross-site scripting vulnerability exists in Desknets Neo V9.0R2.0 and earlier versions, which originates from stored cross-site scripting and could lead to the execution of arbitrary JavaScript...