D-Link DIR-816 Code Injection Vulnerability

The D-Link DIR-816 is a wireless router from China's AUO D-Link. A code injection vulnerability exists in the D-Link DIR-816 version 1.01TO, which stems from the fact that incorrect operation of the parameter SSID can lead to cross-site scripting attacks. The vulnerability can be exploited by an...

CVE-2024-54958

Nagios XI version 2024R1.2.2 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability located in the Tools page . This flaw arises from a lack of protective measures for the website structure, allowing an attacker to inject malicious scripts into the Tools interface. Once stored, these...

CVE-2024-53974

Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

CVE-2024-53974 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager versions 6.5.21 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

CVE-2024-53974

CVE-2024-53974 affects Adobe Experience Manager (AEM) 6.5.21 and earlier, with a stored XSS vulnerability in vulnerable form fields that could be exploited by a low-privileged attacker (requires user interaction) to inject malicious scripts executed in a victim’s browser. Connected sources confir...

CVE-2024-13522

The magayo Lottery Results plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.12. This is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page. This makes it possible for unauthenticated attackers to update...

PT-2025-6954

Name of the Vulnerable Software and Affected Versions: Smartarget versions prior to 1.4 Description: The issue is related to improper neutralization of input during web page generation, which allows stored Cross-site Scripting XSS. This enables attackers to inject malicious scripts into the...

Cross-Site Scripting (XSS)

org.apache.atlas, apache-atlas is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient input sanitization, allowing an authenticated user to inject malicious scripts...

CVE-2025-0924 WP Activity Log <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

Adobe Commerce Cross-Site Scripting Vulnerability (CNVD-2025-05695)

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A cross-site scripting vulnerability exists in Adobe Commerce, which can be exploited by an attacker to inject malicious script into vulnerable form...

PT-2025-7016

Name of the Vulnerable Software and Affected Versions: Essential WP Real Estate versions 1.1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers...

PT-2025-7031

Name of the Vulnerable Software and Affected Versions: Better WishList API versions 1.1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to inje...

PT-2025-7003

Name of the Vulnerable Software and Affected Versions: devbunchuk Custom Widget Creator versions 1.0.0 through 1.0.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2025-7002

Name of the Vulnerable Software and Affected Versions: Singsys -Awesome Gallery versions 1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers t...

PT-2025-6994

Name of the Vulnerable Software and Affected Versions: Tidy.ro versions 1.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means an attacker can inject malicious...

PT-2025-6983

Name of the Vulnerable Software and Affected Versions: Mike Martel Live Dashboard versions 0.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attacke...

PT-2025-7011

Name of the Vulnerable Software and Affected Versions: wassereimer Easy Code Placement versions through 18.11 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2025-7007

Name of the Vulnerable Software and Affected Versions: DuoGeek Email to Download versions n/a through 3.1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attacker...

CVE-2025-24428

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed...

CVE-2025-24415

Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed...