CVE-2025-66850

Finding Within the ‘LibreNMS’ application, we discovered a reflected Cross-Site Scripting vulnerability; this vulnerability exists in the routing module’s protocol parameter, allowing an attacker to render malicious JavaScript in a victim’s browser. This vulnerability affects all versions from...

CVE-2025-64027

Product Info Snipe-IT is a free and open-source IT asset management system FOSS built on Laravel. It provides hardware asset tracking, software license management, accessories, and consumables inventory features for IT operations teams. It is actively maintained and updated frequently. Summary A...

FuguHub-8.1-Reflected-SVG-XSS-CVE-2025-65790

CVE-2025-65790 - FuguHub 8.1 Reflected SVG XSS Reflected Cross-Site Scripting XSS via SVG Rendering in FuguHub https://vulners.com/cve/CVE-2025-65790 This repository documents a Reflected Cross-Site Scripting XSS vulnerability in FuguHub 8.1 , where SVG files containing inline JavaScript are...

WordPress LearnPress plugin 4.2.6.4-4.4.6 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin LearnPress versions 4.2.6.4-4.4.6...

CVE-2026-91014

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into...

CVE-2025-15697

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...

CVE-2026-91014

Realtyna Organic IDX plugin + WPL Real Estate (WordPress) before 5.4.2 is vulnerable to reflected XSS via the Location Selector Endpoint , where certain parameters are not sanitised or escaped before being reflected in the page output. An unauthenticated attacker can exploit this by crafting a ma...

CVE-2026-91014 Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into...

EUVD-2026-81355

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into...

EUVD-2025-210927

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...

CVE-2025-15697

CVE-2025-15697 affects the Dictionary WordPress plugin through version 1.0 , which fails to escape user input before reflecting it in the responses of several directly accessible scripts. This allows unauthenticated attackers to perform Reflected Cross-Site Scripting (XSS) against users who are i...

CVE-2025-15697 Dictionary <= 1.0 - Reflected XSS via Multiple Parameters

The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone they can induce to submit a crafted request...

CVE-2025-0133

CVE-2025-0133 CVE-2025-0133 Exploit CVE-2025-0133 is a reflected cross-site scripting XSS vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software. An authenticated user with access to the Captive Portal can be tricked into clicking a specially crafte...

CVE-2026-29971

CVE-2026-29971 An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking or privilege escalation. CVE-2026-29971 Vulnerability Reflected Cross-Site Scripting XSS Affected Product WebFileSys Affected Version 2.31.1 Description A reflected...

CVE-2026-17532-lab

CVE-2026-17532 实验室 - Seraphinite Accelerator：未认证 XSS → 一键 RCE 一个针对 CVE-2026-17532 的 Docker 实验室，该漏洞是 WordPress 插件 Seraphinite Accelerator 中的一个未认证反射型 XSS，当登录的管理员打开一个精心构造的链接时，可链式利用实现远程代码执行。 完整文章 ：博客 环境要求 安装了 Compose 插件的 Docker 宿主机上的 python3 或 php（仅用于构建漏洞利用 URL - exploit.sh 会使用其中任意一个） 运行 root@kitploi...

CVE-2026-37272

CVE-2026-37272 CVE-2026-37272 描述 /dashboard/settings.php 中的 Bank Management System in Web 1.0 存在反射型跨站脚本（XSS）漏洞。该漏洞是由于对 msg GET 参数中用户提供的输入未进行适当的清理所致。攻击者可以构造包含 JavaScript 代码的恶意 URL，当页面加载时，该代码会在受害者的浏览器中执行。 附加信息 该漏洞的产生是因为应用程序将 msg 参数直接反射到 HTML 响应中，而没有进行适当的输出编码。通过在该参数中注入 HTML 或 JavaScript...

cve-2026-64638-banner-poc

CVE-2026-64638 — 通用横幅 PoC 一个单文件、无依赖的 PoC 生成器，针对 WordPress CVE-2026-64638 在 wp-login.php 上的反射型 HTML 注入（striptags 与 KSES 解析器 差异）。它生成一个自动提交的触发页面：当受害者打开该文件时，页面会静默 POST 注入载荷， 受害者将直接落在目标登录页面上并渲染出横幅——无需交互，目标端无需 JavaScript。 仅限授权的安全测试。 仅可针对您拥有或明确获授权测试的系统使用。 受影响版本（经验证） 版本| 状态 ---|--- 6.4.0 – 7.0.2|...

CVE-2025-61454

🛡️ CVE 披露：CVE-2025-61454 — 电子商务项目中的反射型 XSS 披露日期： 2025 年 10 月 14 日 CVE ID： CVE-2025-61454 严重性： 中危（CVSS 6.1） 🧩 摘要 E-commerce Project v1.0 中存在一个反射型跨站脚本（XSS）漏洞，具体位于 search.php 端点。search 参数中的未净化输入被直接反射回响应 HTML 中，攻击者可在访问恶意链接或提交精心构造请求的用户浏览器中执行任意 JavaScript。 该问题已被分配标识符 CVE-2025-61454 。在披露时，供应商尚未发布任何补丁 。 📦...

iVANTI-CVE-2021-38560

iVANTI-CVE-2021-38560 Ivanti Service Manager 2021.1 存在反射型 XSS 漏洞，该漏洞通过与 ConfigDB 调用关联的 appName 参数触发，例如在 RelocateAttachments.aspx 中。 漏洞类型： 跨站脚本（XSS） 产品供应商： IVANTI 受影响产品版本： Service Manager - = 载荷：...

CVE-2026-37750

CVE-2026-37750 — 学校管理系统 1.0 - 反射型 XSS 详细信息 字段| 信息 ---|--- CVE ID| CVE-2026-37750 类型| 反射型跨站脚本（XSS） 严重性| 中危（CVSSv3：6.1） 厂商| mahmoudai1 产品| 学校管理系统 版本| 1.0 发现者| Varad AP Mene 日期| 2026-04-16 CWE| CWE-79 描述 mahmoudai1 开发的学校管理系统 1.0 中存在一个反射型跨站脚本（XSS）漏洞，允许未经身份验证的远程攻击者通过 register.php 中未经过滤的 type...