33556 matches found
Prototype Pollution
Overview org.webjars.npm:linkifyjs is a Find URLs, email addresses, hashtags and @mentions in plain-text strings, then convert them into HTML links. Affected versions of this package are vulnerable to Prototype Pollution via the internal assign helper due to improper filtering of the proto...
CVE-2025-54295
A Reflected XSS vulnerability in DJ-Reviews component 1.0-1.3.6 for Joomla was discovered...
CVE-2025-7022
The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2025-7022 My Reservation System <= 2.3 - Reflected XSS
The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2025-7022 My Reservation System <= 2.3 - Reflected XSS
The My Reservation System WordPress plugin through 2.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2025-7022
The CVE-2025-7022 entry concerns the WordPress plugin My Reservation System (versions ≤ 2.3). The connected data specifies that the plugin does not sanitize/escape a user-supplied parameter before echoing it back to the page, resulting in a Reflected Cross-Site Scripting (XSS) vulnerability that ...
SonicWall Secure Mobile Access < 10.2.2.1-90sv (SNWLID-2025-0012)
The version of SonicWall Secure Mobile Access installed on the remote host is prior to 10.2.2.1-90sv. It is, therefore, affected by multiple vulnerabilities as referenced in the SNWLID-2025-0012 advisory: - A Reflected cross-site scripting XSS vulnerability exists in the SMA100 series web...
Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Sinatra vulnerabilities (USN-7664-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7664-1 advisory. It was discovered that Sinatra incorrectly handled serving static files. An attacker could possibly use this issue to...
CVE-2025-51411
A reflected cross-site scripting XSS vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postquerypublic endpoint. The application fails to properly sanitize user input before reflecting it in the HTML response. This allows unauthenticated attackers to injec...
CVE-2025-43484
A potential reflected cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website does not validate or sanitize the user input before rendering it in the response. HP has addressed the issue in the latest software update...
CVE-2025-4284
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Rolantis Information Technologies Agentis allows Reflected XSS, DOM-Based XSS. This issue affects Agentis: before 4.32...
CVE-2025-6588
The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-5084
The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘argsArray'readmoretext'’ parameter in all versions up to, and including, 3.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2025-5084
The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘argsArray'readmoretext'’ parameter in all versions up to, and including, 3.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2025-6588 FunnelCockpit <= 1.4.3 - Reflected Cross-Site Scripting via `error` Parameter
The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-6588 FunnelCockpit <= 1.4.3 - Reflected Cross-Site Scripting via `error` Parameter
The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-6588
CVE-2025-6588 is a reflected Cross-Site Scripting vulnerability in the WordPress FunnelCockpit plugin (versions up to and including 1.4.2). The issue arises from insufficient input sanitization and output escaping in the vulnerable plugin, enabling unauthenticated attackers to inject scripts into...
CVE-2025-5084
CVE-2025-5084 affects the WordPress plugin Post Grid Master (versions up to 3.4.13). The issue is a Reflected Cross-Site Scripting vulnerability via the argsArray['read_more_text'] parameter caused by insufficient input sanitization and output escaping, enabling unauthenticated attackers to injec...
PT-2025-30644 · WordPress · Post Grid Master
Name of the Vulnerable Software and Affected Versions: Post Grid Master versions prior to 3.4.14 Description: The Post Grid Master plugin for WordPress is susceptible to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attacker...