CVE-2025-41751 Reflected XSS vulnerability in pxc_portCntr.php

An XSS vulnerability in pxcportCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

CVE-2025-41751 Reflected XSS vulnerability in pxc_portCntr.php

An XSS vulnerability in pxcportCntr.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

CVE-2025-41751

CVE-2025-41751 describes a reflected XSS in pxc_portCntr.php that permits an unauthenticated remote attacker to trick an authenticated user into clicking a link to modify device configuration through the web-based management interface. The vulnerability affects parameters exposed in the WBM conte...

CVE-2025-41752 Reflected XSS vulnerability in pxc_portSfp.php

An XSS vulnerability in pxcportSfp.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

CVE-2025-41752

CVE-2025-41752 describes a reflected XSS in pxc_portSfp.php that can be exploited by an unauthenticated attacker to entice an authenticated user to click a malicious link and modify device configuration via web-based management. The vulnerability is reported as affecting PHOENIX CONTACT FL SWITCH...

CVE-2025-13071

The Custom Admin Menu WordPress plugin, affecting versions through 1.0.0 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the insufficient sanitization and escaping of a parameter before it is outputted back to the page. This flaw allows for the injection of malicious s...

CVE-2025-13071 Custom Admin Menu <= 1.0.0 - Reflected XSS

The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-13071 Custom Admin Menu <= 1.0.0 - Reflected XSS

The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-66470 NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactiveimage component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or...

EUVD-2025-201813

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are subject to a XSS vulnerability through the ui.interactiveimage component of NiceGUI. The component renders SVG content using Vue's v-html directive without any sanitization. This allows attackers to inject malicious HTML or...

PT-2025-49974

Name of the Vulnerable Software and Affected Versions TalentSoft UNIS versions prior to 42957 Description The software contains a Reflected Cross-Site Scripting XSS issue due to improper neutralization of input during web page generation. This allows for the injection of malicious scripts into we...

PT-2025-50143

Name of the Vulnerable Software and Affected Versions MailEnable versions prior to 10.54 Description The software contains a reflected cross-site scripting XSS issue in the InstanceScope parameter of the ''/Mondo/lang/sys/Forms/CAL/compose.aspx'' endpoint. The InstanceScope value is not properly...

CVE-2025-66469: Improper Neutralization of Input During Web Page Generation

NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to Reflected XSS through its ui.addcss, ui.addscss, and ui.addsass functions. The functions lack proper sanitization or encoding for the JavaScript context they generate. An attacker can break out of the intended or ,...

CVE-2025-6923: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Talent Software UNIS allows Reflected XSS. This issue affects UNIS: before 42957...

CVE-2025-6924: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Talent Software e-BAP Automation allows Reflected XSS. This issue affects e-BAP Automation: before 42957...

PT-2025-49861

Name of the Vulnerable Software and Affected Versions TalentSoft e-BAP Automation versions prior to 42957 Description An Improper Neutralization of Input During Web Page Generation issue, specifically a Reflected Cross-site Scripting XSS condition, exists in TalentSoft e-BAP Automation. This allo...

CVE-2025-13071: Improper Neutralization of Input During Web Page Generation

The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-34408: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the Added parameter of /Mondo/lang/sys/Forms/MAI/AddRecipientsResult.aspx. The Added value is not properly sanitized when processed via a GET request and is reflected in the response, allowing an...

CVE-2025-34425: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the WindowContext parameter of /Mondo/lang/sys/Forms/MAI/compose.aspx. The WindowContext value is not properly sanitized when processed via a GET request and is reflected within a...

CVE-2025-34406: Improper Neutralization of Input During Web Page Generation

MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the Id parameter of /Mobile/ContactDetails.aspx. The Id value is not properly sanitized when processed via a GET request and is reflected within a...