PT-2025-43420

🟠 Liferay Portal, Reflected Cross-Site Scripting, CVE-2025-52932 Moderate https://t.co/6pJMNw6oRb...

CVE-2025-59006: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themebon Easy Woocommerce Customizer easy-woocommerce-customizer allows Reflected XSS.This issue affects Easy Woocommerce Customizer: from n/a through = 1.0.2...

CVE-2025-58971: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in AmentoTech Doctreat doctreat allows Reflected XSS.This issue affects Doctreat: from n/a through = 1.6.7...

CVE-2025-39534: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Somonator Terms Dictionary terms-dictionary allows Reflected XSS.This issue affects Terms Dictionary: from n/a through = 1.5.1...

GHSA-RX48-GQC2-4W47 Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,...

CVE-2025-62598 WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action'

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting XSS vulnerability was identified in the editarinfopessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject...

CVE-2025-10612

CVE-2025-10612 concerns giSoft Information Technologies City Guide. Connected sources confirm a reflected XSS flaw caused by improper input neutralization during web page generation, affecting City Guide versions prior to 1.4.45. The vulnerability permits injection that is reflected back in the r...

CVE-2025-10612 XSS in GiSoft's City Guide

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in giSoft Information Technologies City Guide allows Reflected XSS. This issue affects City Guide: before 1.4.45...

CVE-2025-10612

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in giSoft Information Technologies City Guide allows Reflected XSS. This issue affects City Guide: before 1.4.45...

CVE-2025-10612: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in giSoft Information Technologies City Guide allows Reflected XSS. This issue affects City Guide: before 1.4.45...

PT-2025-42907

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.5.1 Description WeGIA, a web manager for institutions, contains a reflected cross-site scripting XSS issue. An attacker can inject malicious scripts through the action parameter in the GET request to the...

CVE-2025-62597: Improper Neutralization of Input During Web Page Generation

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting XSS vulnerability was identified in the editarinfopessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject...

PT-2025-42868

Name of the Vulnerable Software and Affected Versions giSoft Information Technologies City Guide versions prior to 1.4.45 Description The software contains a flaw related to improper input handling during web page generation, which could lead to Reflected Cross-site Scripting XSS. This allows an...

CVE-2025-62598: Improper Neutralization of Input During Web Page Generation

WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Prior to version 3.5.1, a reflected cross-site scripting XSS vulnerability was identified in the editarinfopessoal.php endpoint of the WeGIA application. This vulnerability allows attackers to inject...

CVE-2025-62249: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13,...

PT-2025-42906

Name of the Vulnerable Software and Affected Versions WeGIA versions prior to 3.5.1 Description WeGIA, a web manager for institutions, contains a reflected cross-site scripting XSS issue. An attacker can inject malicious scripts through the sql parameter in the GET request to the...

PT-2025-42922

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.0 through 7.4.3.132 Liferay DXP versions 2023.Q4.0 through 2023.Q4.10 Liferay DXP versions 2024.Q1.1 through 2024.Q1.20 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.1 through...

PT-2025-42766

Name of the Vulnerable Software and Affected Versions Bhabishya-123 E-commerce version 1.0 Description A Cross-Site Scripting XSS issue exists in the software, specifically within the index endpoint. Unsanitized input in the /index parameter is directly reflected back into the response HTML,...

📄 Ilevia EVE X1 Server 4.7.18.0.eden Cross Site Scripting

Ilevia EVE X1 Server versions 4.7.18.0.eden and below suffer from a reflective cross site scripting vulnerability. Ilevia EVE X1 Server 4.7.18.0.eden Unauthenticated Reflected XSS Vendor: Ilevia Srl. Product web page: https://www.ilevia.com Affected version: =4.7.18.0.eden Summary: EVE is a smart...

CVE-2025-34512

Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain a reflected cross-site scripting XSS vulnerability in index.php that allows an unauthenticated attacker to execute arbitrary code. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 t...