272 matches found
PT-2025-35436
Name of the Vulnerable Software and Affected Versions Khanakag-17 Library Management System affected versions not specified Description A cross-site scripting issue exists in Khanakag-17 Library Management System. The vulnerability is related to the manipulation of the msg argument of the...
PT-2025-34257 · Wegia · Wegia
Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.7 Description: WeGIA is a Web manager for charitable institutions. A Reflected Cross-Site Scripting XSS vulnerability exists in the pre cadastro adotante.php endpoint. Attackers can inject malicious scripts through...
Chat System send_message.php File SQL Injection Vulnerability
Chat System is a chat system. Chat System suffers from an SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter msg in the file /user/sendmessage.php. An attacker can exploit this vulnerability to execute illegal SQL commands...
CVE-2025-53824
CVE-2025-53824 concerns WeGIA, an open source web manager. A Reflected XSS exists in the editar_permissoes.php endpoint (pre-3.4.4) via the msg_c parameter. The flaw could allow injection of script code when a user is reflected, with the official fix in version 3.4.4. No exploitation details are ...
CVE-2025-7408
A vulnerability has been found in SourceCodester Zoo Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/templates/animalformtemplate.php. The manipulation of the argument msg leads to cross site scripting. The attack can be initiated...
SourceCodester Zoo Management System Code Injection Vulnerability
SourceCodester Zoo Management System is a SourceCodester open source zoo management system. A code injection vulnerability exists in SourceCodester Zoo Management System version 1.0, which originates from a cross-site script that can be caused by manipulation of the parameter msg in file...
CVE-2025-2479: Improper Neutralization of Input During Web Page Generation
The Easy Custom Admin Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
PT-2025-11597
Name of the Vulnerable Software and Affected Versions Easy Custom Admin Bar plugin for WordPress version 1.0 and earlier Description The issue is related to Reflected Cross-Site Scripting via the msg parameter due to insufficient input sanitization and output escaping. This allows unauthenticated...
CVE-2025-2077
The Simple Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'msg' parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
CVE-2025-2077: Improper Neutralization of Input During Web Page Generation
The Simple Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'msg' parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
Quorum onQ security vulnerabilities
Quorum onQ is a backup solution from Quorum. A security vulnerability exists in Quorum onQ version v.6.0.0.5.2064, which originates from a cross-site scripting vulnerability that allows remote attackers to obtain sensitive information via the msg parameter in the Login page...
CVE-2024-44449: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting vulnerability in Quorum onQ OS v.6.0.0.5.2064 allows a remote attacker to obtain sensitive information via the msg parameter in the Login page...
PT-2025-3433 · Unknown · Informationpush
Name of the Vulnerable Software and Affected Versions: InformationPush master version Description: The issue allows a remote attacker to obtain sensitive information via the title, time, and msg parameters. This is a Cross Site Scripting vulnerability. Recommendations: For InformationPush master...
CVE-2024-57372
The InformationPush master version is susceptible to a Cross-Site Scripting (XSS) vulnerability (CWE-79). This flaw allows a remote attacker to obtain sensitive information by leveraging the title , time , and msg parameters. As a temporary workaround, it is recommended to restrict access to thes...
PT-2025-4780 · Wegia · Wegia
Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.2.6 Description: A Reflected Cross-Site Scripting XSS issue was identified in the tags.php endpoint of the WeGIA application. This issue allows attackers to inject malicious scripts in the msg e parameter due to the...
emlog code injection vulnerability
emlog is a PHP and MySQL based CMS for personal developers of emlog. A code injection vulnerability exists in emlog 2.4.1 and earlier versions, which stems from a cross-site scripting attack caused by manipulation of the msg parameter in the /include/lib/common.php library...
PT-2024-19583 · Unknown · Boyiddha Automated-Mess-Management-System
Name of the Vulnerable Software and Affected Versions: boyiddha Automated-Mess-Management-System version 1.0 Description: A problematic vulnerability was found in the Chat Book component of the boyiddha Automated-Mess-Management-System, specifically in the file /member/chat.php. The manipulation ...
CVE-2024-25435
A cross-site scripting XSS vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Msg parameter...
