CVE-2025-71453

The software vtenext before version 25.02.2 is vulnerable to a reflected cross-site scripting (XSS) flaw in the modules/Home/HomeWidgetBlockList.php component. The root cause is the application echoing unsanitized widgetId keys from the widgetInfoList JSON parameter. An attacker can trick a logge...

EUVD-2025-211251

vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys,...

PT-2026-137119

vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to submit a crafted POST request with HTML in widgetId keys,...