CVE-2025-21621 GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scripting XSS vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute arbitrary JavaScript code in a victim's...

CVE-2025-21621 GeoServer Reflected Cross-Site Scripting (XSS) vulnerability in WMS GetFeatureInfo HTML format

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scripting XSS vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute arbitrary JavaScript code in a victim's...

CVE-2025-64984

Kaspersky has fixed a security issue in Kaspersky Endpoint Security for Linux any version with anti-virus databases prior to 18.11.2025, Kaspersky Industrial CyberSecurity for Linux Nodes any version with anti-virus databases prior to 18.11.2025, and Kaspersky Endpoint Security for Mac 12.0.0.325...

CVE-2025-0248

HCL iNotes is susceptible to a Reflected Cross-site Scripting XSS vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or...

CVE-2025-0248

CVE-2025-0248 concerns HCL iNotes and is described across Red Hat, ENISA EUVD, NVD, and CVE lists as a Reflected Cross-site Scripting (XSS) vulnerability due to improper validation of user-supplied input. The attack requires no authentication and can be triggered by a specially crafted URL, enabl...

CVE-2025-0248 HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability,

HCL iNotes is susceptible to a Reflected Cross-site Scripting XSS vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or...

CVE-2025-0248 HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability,

HCL iNotes is susceptible to a Reflected Cross-site Scripting XSS vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or...

CVE-2025-12629

The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2025-48088

Name of the Vulnerable Software and Affected Versions Ruckus Unleashed version 200.13.6.1.319 Description A reflected Cross Site Scripting XSS issue exists in Ruckus Unleashed. The issue is located in the captive-portal endpoint ''selfguestpass/guestAccessSubmit.jsp'' and is triggered through...

CommScope Ruckus Unleashed security vulnerabilities

CommScope Ruckus Unleashed is a wireless router from CommScope USA. A security vulnerability exists in CommScope Ruckus Unleashed version 200.13.6.1.319, which stems from improper handling of the parameter name in the captive-portal endpoint selfguestpass/guestAccessSubmit.jsp, which could lead t...

PT-2025-48035

Name of the Vulnerable Software and Affected Versions HCL iNotes affected versions not specified Description HCL iNotes is affected by a Reflected Cross-site Scripting XSS issue due to insufficient validation of user-provided input. An unauthenticated attacker can create a malicious URL that, whe...

CVE-2025-0248: Improper Input Validation

HCL iNotes is susceptible to a Reflected Cross-site Scripting XSS vulnerability caused by improper validation of user-supplied input. A remote, unauthenticated attacker can specially craft a URL to execute script in a victim's Web browser within the security context of the hosting Web site and/or...

CVE-2025-63735: Improper Neutralization of Input During Web Page Generation

A reflected Cross site scripting XSS vulnerability in Ruckus Unleashed 200.13.6.1.319 via the name parameter to the the captive-portal endpoint selfguestpass/guestAccessSubmit.jsp...

CVE-2025-21621: Improper Neutralization of Input During Web Page Generation

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scripting XSS vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute arbitrary JavaScript code in a victim's...

EUVD-2025-198895

A reflected cross-site scripting XSS vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the color parameter...

EUVD-2024-55100

The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-14015

The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-12629

The Broken Link Manager WordPress plugin, in versions 0.6.5 and earlier , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape a parameter before outputting it back into the page. This security weakness can be leveraged to target hi...

CVE-2024-14015 Studiocart <= 2.9.0 - Reflected XSS

The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-14015

The Studiocart (eCommerce Plugin) for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 2.9.0 . The root cause is insufficient input sanitization and output escaping of a parameter before it is displayed on a page. Unauthenticated attackers can exploi...