CVE-2025-53201: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through = 4.7.8...

CVE-2025-53195: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through = 3.7.0...

CVE-2025-48162: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Reflected XSS.This issue affects Simple Business Directory Pro: from n/a through = 15.5.1...

CVE-2025-48152: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in dimafreund Rentsyst rentsyst allows Reflected XSS.This issue affects Rentsyst: from n/a through = 2.0.100...

CVE-2025-49410: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Imran Emu TC Testimonials allows Stored XSS. This issue affects TC Testimonials: from n/a through 1.1.1...

CVE-2025-48297: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Reflected XSS.This issue affects Simple Link Directory: from n/a through 14.8.1...

CVE-2025-48168: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player lbg-audio5-html5-shoutcast-sticky allows Reflected XSS.This issue affects Apollo - Sticky Full Width HTML5 Audio Player: from n/a through ...

PT-2025-33914 · Rentsyst · Rentsyst

Name of the Vulnerable Software and Affected Versions: Rentsyst versions through 2.0.100 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, leading to Reflected Cross-site Scripting XSS. Recommendations: Update Rentsyst to a version later than...

PT-2025-33965 · WordPress · Crocoblock Jetengine

Name of the Vulnerable Software and Affected Versions: Crocoblock JetEngine versions through 3.7.0 Description: Improper neutralization of special elements used in a template engine in Crocoblock JetEngine allows code injection. Recommendations: Update Crocoblock JetEngine to a version later than...

PT-2025-34018 · Lambertgroup · Lambertgroup Responsive Html5 Audio Player Pro With Playlist

Name of the Vulnerable Software and Affected Versions: LambertGroup Responsive HTML5 Audio Player PRO With Playlist versions through 3.5.8 Description: The software contains an Improper Neutralization of Input During Web Page Generation issue, which allows for Reflected Cross-site Scripting XSS...

PT-2025-33954 · WordPress · Laposta Woocommerce

Name of the Vulnerable Software and Affected Versions: Laposta WooCommerce versions through 1.9.1 Description: This issue involves improper neutralization of input during web page generation, leading to a Stored Cross-Site Scripting XSS condition. Successful exploitation could allow an attacker t...

WordPress plugin Elizaibots has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-49412: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in numixtech Page Transition page-transition allows Stored XSS.This issue affects Page Transition: from n/a through = 1.3...

WordPress plugin Jobmonster has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2025-9094

A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to t...

CVE-2025-53192: Improper Neutralization of Expression/Command Delimiters

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commons OGNL: all versions. When using the API Ognl.getValue​, the OGNL engine parses and evaluates the provided expression with powerful capabilities...

FortiIsolator GUI Arbitrary Command Execution

The vulnerability of the graphical user interface of the FortiIsolator browser platform relates to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a perpetrator to execute arbitrary commands...

CVE-2025-9094

CVE-2025-9094 affects ThingsBoard 4.1 in the Add Gateway Handler component, where improper neutralization of special elements in a template engine enables remote exploitation. Publicly disclosed exploit; vendor notes a fix in upcoming release (v4.2) with maintenance/LTS updates starting from 4.0....

CVE-2025-9094

A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be initiated remotely. The exploit has been disclosed to t...

CVE-2025-8362

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal GoogleTag Manager allows Cross-Site Scripting XSS.This issue affects GoogleTag Manager: from 0.0.0 before 1.10.0...