CVE-2025-57204

Stocky POS with Inventory Management & HRM ui-lib version 5.0 is affected by a Stored Cross-Site Scripting XSS vulnerability within the Products module available to authenticated users. The vulnerability resides in the product name parameter submitted to the product-creation endpoint via a standa...

CVE-2025-57205

iNiLabs School Express (SMS Express) version 6.2 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw within its content-management features. The issue stems from insufficient input sanitization and output encoding of POSTed editor parameters submitted to the /posts/edit/{id} endpoint, as we...