CVE-2025-25062

CVE-2025-25062 is an XSS vulnerability in Backdrop CMS (CKEditor 5 module) affecting 1.28.x prior to 1.28.5 and 1.29.x prior to 1.29.3. The issue arises from insufficient isolation of long text content, enabling crafted HTML/JS to execute when an administrator edits content. Exploitation prospect...

PT-2025-4953

Name of the Vulnerable Software and Affected Versions Haider Ali Bulk Categories Assign versions n/a through 1.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-5391

Name of the Vulnerable Software and Affected Versions Emili Castells DK White Label versions n/a through 1.0 Description The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker...

Script Injection

Nuxt is vulnerable to Script injection. The vulnerability is due to the lack of same-origin policy enforcement for script requests, allows attackers to inject malicious scripts into a victim's site via a script tag, bypassing security measures intended to prevent such cross-origin interactions...

VMware Aria Operations for Logs 安全漏洞

VMware Aria Operations for Logs is a centralized log management solution from VMware. The product supports features such as log organization and log analysis. A security vulnerability exists in VMware Aria Operations for Logs. An attacker can exploit this vulnerability to inject malicious scripts...

Cross-Site Scripting (XSS)

PhpSpreadsheet is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization or escaping of user input when converting XLSX files into HTML, allows malicious scripts to be embedded in the file content and executed in the context of the user's browser...

Cross-Site Scripting (XSS)

mathlive is vulnerable to Cross-site scripting XSS. The vulnerability is due to the lack of proper escaping of HTML content when using commands like \htmlData, which allows the injection and execution of malicious scripts...

Stored Cross-site Scripting (XSS)

librenms/librenms is vulnerable to Stored Cross-site Scripting XSS. The vulnerability is due to insufficient input sanitization of the descr parameter in /ajaxform.php, allows malicious scripts to be injected and stored in the system...

Stored Cross-site Scripting (XSS)

librenms/librenms is vulnerable to Stored cross-site scripting XSS. The vulnerability is due to insufficient input sanitization of the display parameter in the /device/$DEVICEID/edit endpoint, allowing attackers to inject and store malicious scripts on the server...

PT-2025-4971

Name of the Vulnerable Software and Affected Versions CAMOO SMS versions prior to 3.0.1 Description The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This means that an attacker can inject malicious scripts into t...

PT-2025-4612

Name of the Vulnerable Software and Affected Versions vcita.com Online Payments – Get Paid with PayPal, Square & Stripe versions 3.20.0 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. Th...

CVE-2024-12385

The CVE-2024-12385 entry concerns the WP Abstracts WordPress plugin. The connected Red Hat entry confirms a Cross-Site Request Forgery flaw in WP Abstracts up to version 2.7.2, caused by missing nonce validation in wpabstracts_load_status() and wpabstracts_delete_abstracts(). This could allow una...

Cross-site Scripting (XSS)

github.com/rancher/rancher is vulnerable to Cross-site Scripting XSS. The vulnerability is due to a Stored XSS attack, which occurs when a malicious actor can inject and store malicious scripts via the cluster description field, leading to potential execution of unauthorized code within the UI...

CVE-2025-23200 Stored XSS-LibreNMS-Misc Section in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: ajaxform.php - param: state. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page...

CVE-2025-23200

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: "ajaxform.php" - param: state. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page...

CVE-2025-23200 Stored XSS-LibreNMS-Misc Section in librenms

librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: ajaxform.php - param: state. Librenms versions up to 24.10.1 allow remote attackers to inject malicious scripts. When a user views or interacts with the page...

GHSA-G84X-G96G-RCJC Librenms has a reflected XSS on error alert

XSS on the parameters:/addhost - param: community of Librenms versions 24.10.1 https://github.com/librenms/librenms allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potentia...

Librenms has a reflected XSS on error alert

XSS on the parameters:/addhost - param: community of Librenms versions 24.10.1 https://github.com/librenms/librenms allows remote attackers to inject malicious scripts. When a user views or interacts with the page displaying the data, the malicious script executes immediately, leading to potentia...

LibreNMS Ports Stored Cross-site Scripting vulnerability

StoredXSS-LibreNMS-Ports Description: Stored XSS on the parameter: /ajaxform.php - param: descr Request: http POST /ajaxform.php HTTP/1.1 Host: X-Requested-With: XMLHttpRequest X-CSRF-TOKEN: Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Cookie:...

GHSA-PM8J-3V64-92CQ LibreNMS Display Name Stored Cross-site Scripting vulnerability

Description: XSS on the parameters Replace $DEVICEID with your specific $DEVICEID value:/device/$DEVICEID/edit - param: display of Librenms versions 24.9.0, 24.10.0, and 24.10.1 https://github.com/librenms/librenms allows remote attackers to inject malicious scripts. When a user views or interact...