CVE-2025-34398 MailEnable < 10.54 Reflected XSS in AddressesBcc Parameter of AddressBook.aspx

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the AddressesBcc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The AddressesBcc value is not properly sanitized when processed via a GET request and is reflected within a block in the JavaScrip...

CVE-2025-34399

MailEnable versions prior to 10.54 are affected by a reflected XSS in the AddressesCc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The AddressesCc value is not properly sanitized for GET requests and is echoed inside a [removed] block in the JavaScript variable sAddrCc, enabling an attack...

CVE-2025-34399 MailEnable < 10.54 Reflected XSS in AddressesCc Parameter of AddressBook.aspx

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the AddressesCc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The AddressesCc value is not properly sanitized when processed via a GET request and is reflected within a block in the JavaScript...

CVE-2025-34401 MailEnable < 10.54 Reflected XSS in FieldBcc Parameter of AddressBook.aspx

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the FieldBcc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The FieldBcc value is not properly sanitized when processed via a GET request and is reflected inside a block in the JavaScript variab...

EUVD-2025-202192

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the FieldCc parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The FieldCc value is not properly sanitized when processed via a GET request and is reflected inside a block in the JavaScript variable...

CVE-2025-34403 MailEnable < 10.54 Reflected XSS in FieldTo Parameter of AddressBook.aspx

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the FieldTo parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The FieldTo value is not properly sanitized when processed via a GET request and is reflected inside a block in the JavaScript variable...

CVE-2025-34403 MailEnable < 10.54 Reflected XSS in FieldTo Parameter of AddressBook.aspx

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the FieldTo parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The FieldTo value is not properly sanitized when processed via a GET request and is reflected inside a block in the JavaScript variable...

CVE-2025-6923

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Talent Software UNIS allows Reflected XSS. This issue affects UNIS: before 42957...

CVE-2025-6923 Reflected XSS in Talent Software's UNIS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Talent Software UNIS allows Reflected XSS. This issue affects UNIS: before 42957...

CVE-2025-6924 Reflected XSS in Talent Software's e-BAP

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Talent Software e-BAP Automation allows Reflected XSS. This issue affects e-BAP Automation: before 42957...

CVE-2025-6924

CVE-2025-6924 affects TalentSoft e-BAP Automation. The issue is a Reflected XSS caused by improper input neutralization during web page generation in versions prior to 42957. Impact is reflected XSS in user-supplied input handled during page rendering. Remediation: upgrade to TalentSoft e-BAP Aut...

CVE-2025-6924

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Talent Software e-BAP Automation allows Reflected XSS. This issue affects e-BAP Automation: before 42957...

CVE-2025-12956

A reflected Cross-site Scripting XSS vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session...

CVE-2025-41695 Reflected XSS vulnerability in dyn_conn.php

An XSS vulnerability in dynconn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

CVE-2025-41695 Reflected XSS vulnerability in dyn_conn.php

An XSS vulnerability in dynconn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

CVE-2025-41695

CVE-2025-41695 is a reflected XSS vulnerability in dyn_conn.php. An unauthenticated remote attacker can trick an authenticated user into submitting a manipulated POST request to the device, altering configuration parameters exposed by the web-based management (WBM). The issue does not grant acces...

CVE-2025-41745 Reflected XSS vulnerability in pxc_portCntr2.php

An XSS vulnerability in pxcportCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-leve...

CVE-2025-41746 Reflected XSS vulnerability in pxc_portSecCfg.php

An XSS vulnerability in pxcportSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-lev...

CVE-2025-41749 Reflected XSS vulnerability in port_util.php

An XSS vulnerability in portutil.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

CVE-2025-41751

CVE-2025-41751 describes a reflected XSS in pxc_portCntr.php that permits an unauthenticated remote attacker to trick an authenticated user into clicking a link to modify device configuration through the web-based management interface. The vulnerability affects parameters exposed in the WBM conte...