CVE-2025-66845

A reflected Cross-Site Scripting XSS vulnerability has been identified in TechStore version 1.0. The username endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser...

PT-2025-52753

Name of the Vulnerable Software and Affected Versions TechStore version 1.0 Description A reflected Cross-Site Scripting XSS issue exists. The /user name API endpoint reflects the id query parameter directly into the HTML response without proper output encoding or sanitization. This allows for th...

CVE-2025-66845

A reflected Cross-Site Scripting XSS vulnerability has been identified in TechStore version 1.0. The username endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser...

CVE-2025-66845: Improper Neutralization of Input During Web Page Generation

A reflected Cross-Site Scripting XSS vulnerability has been identified in TechStore version 1.0. The username endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser...

CVE-2025-65270

Reflected cross-site scripting XSS vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's browser...

CVE-2025-65790: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FuguHub does not sanitize or restrict script execution inside SVG content. When a victim opens a crafted SVG containing an inline...

CVE-2024-35321: Improper Neutralization of Input During Web Page Generation

MyNET up to v26.08 was discovered to contain a Reflected cross-site scripting XSS vulnerability via the msgtipo parameter...

CVE-2024-25814: Improper Neutralization of Input During Web Page Generation

MyNET up to v26.05 was discovered to contain a reflected cross-site scripting XSS vulnerability via the msg parameter...

CVE-2025-65790

A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 due to the lack of sanitization or script filtering when serving SVG files through the /fs/ file manager interface. The software treats SVG files as active XML content, allowing the browser to execute inline [removed] elem...

CVE-2024-35321

The MyNET online management system (by AIRC Portugal ) versions up to v26.08 are vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The vulnerability is triggered via the msgtipo parameter, which fails to properly neutralize input during web page generation. A successful exploit could all...

CVE-2024-25812: Improper Neutralization of Input During Web Page Generation

MyNET up to v26.05 was discovered to contain a reflected cross-site scripting XSS vulnerability via the src parameter...

CVE-2024-25814

MyNET up to v26.05 was discovered to contain a reflected cross-site scripting XSS vulnerability via the msg parameter...

CVE-2025-65270: Improper Neutralization of Input During Web Page Generation

Reflected cross-site scripting XSS vulnerability in ClinCapture EDC 3.0 and 2.2.3, allowing an unauthenticated remote attacker to execute JavaScript code in the context of the victim's browser...

EUVD-2025-204626

The Overstock Affiliate Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2025-12581: Improper Neutralization of Input During Web Page Generation

The Attachments Handler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

CVE-2025-13624: Improper Neutralization of Input During Web Page Generation

The Overstock Affiliate Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' parameter in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

CVE-2025-64191

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 8theme XStore xstore allows Reflected XSS.This issue affects XStore: from n/a through 9.6.1...

JetBrains TeamCity < 2025.11.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2025.11.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token...

CVE-2024-58319 Kentico Xperience <= 13.0.160 Pages Dashboard Widget Reflected XSS

A reflected cross-site scripting vulnerability in Kentico Xperience allows attackers to inject malicious scripts via the Pages dashboard widget configuration dialog. Attackers can exploit this vulnerability to execute malicious scripts in administrative users' browsers...

CVE-2023-53736 Kentico Xperience <= 13.0.120 Administration Interface Reflected XSS

A reflected cross-site scripting vulnerability in Kentico Xperience allows authenticated users to inject malicious scripts in the administration interface. Attackers can exploit this vulnerability to execute arbitrary scripts within the administrative context...