33552 matches found
CVE-2025-6174
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user...
CVE-2025-6174 WordPress Qwizcards <= 3.9.4 - Reflected XSS
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user...
CVE-2025-6174
The WordPress Qwizcards plugin (versions up to 3.9.4) is affected by a Reflected XSS due to insufficient sanitisation/escaping of the stylesheet parameter(s) when reflected back in the page. Specifically, the vulnerability is described as affecting the _stylesheet parameter (per CVE description) ...
CVE-2025-6174 WordPress Qwizcards <= 3.9.4 - Reflected XSS
The Qwizcards | online quizzes and flashcards WordPress plugin through 3.9.4 does not sanitise and escape the "stylesheet" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin or any other user...
CVE-2025-43484
A potential reflected cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website does not validate or sanitize the user input before rendering it in the response. HP has addressed the issue in the latest software update...
DJ-Extensions DJ-Reviews 跨站脚本漏洞
DJ-Extensions DJ-Reviews is a rating and review extension from DJ-Extensions. A cross-site scripting vulnerability exists in DJ-Extensions DJ-Reviews versions 1.0-1.3.6, which stems from a reflected cross-site scripting vulnerability...
📄 Invision Community 5.0.7 Cross Site Scripting
Invision Community versions 5.0.7 and below have an issue where user input passed through the state POST parameter to the /oauth/callback/index.php script is not properly sanitized before being used to generate HTML output. This can be exploited by attackers to perform reflected cross site...
PT-2025-30544 · WordPress · Qwizcards
Name of the Vulnerable Software and Affected Versions: Qwizcards | online quizzes and flashcards WordPress plugin versions through 3.9.4 Description: The WordPress plugin does not properly sanitize and escape the stylesheet parameter before outputting it, leading to a Reflected Cross-Site Scripti...
CVE-2025-51864
A reflected cross-site scripting XSS vulnerability exists in AIBOX LLM chat chat.aibox365.cn through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tokens...
CVE-2025-34141
A reflected cross-site scripting XSS vulnerability exists in ETQ Reliance CG legacy platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The...
CVE-2025-34141 ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`
A reflected cross-site scripting XSS vulnerability exists in ETQ Reliance CG legacy platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The...
CVE-2025-34141 ETQ Reliance CG < SE.2025.1 Reflected XSS in `SQLConverterServlet`
A reflected cross-site scripting XSS vulnerability exists in ETQ Reliance CG legacy platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The...
USN-7664-1: Sinatra vulnerabilities
It was discovered that Sinatra incorrectly handled serving static files. An attacker could possibly use this issue to perform local file inclusion, obtaining sensitive information. CVE-2022-29970 It was discovered that Sinatra incorrectly handled special characters in the Content-Disposition HTTP...
CVE-2025-4284 Reflected XSS in Rolantis Information Technologies' Agentis
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Rolantis Information Technologies Agentis allows Reflected XSS, DOM-Based XSS. This issue affects Agentis: before 4.32...
CVE-2025-4284
CVE-2025-4284 affects Rolantis Information Technologies’ Agentis (pre-4.32). The issue is an Improper Neutralization of Input During Web Page Generation that enables Reflected XSS and DOM-Based XSS. Per the sources, the vulnerability impacts Agentis versions before 4.32, with CVSSv3.1 base metric...
CVE-2025-4284 Reflected XSS in Rolantis Information Technologies' Agentis
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Rolantis Information Technologies Agentis allows Reflected XSS, DOM-Based XSS. This issue affects Agentis: before 4.32...
CVE-2025-4284
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Rolantis Information Technologies Agentis allows Reflected XSS, DOM-Based XSS. This issue affects Agentis: before 4.32...
VulnCheck KEV: CVE-2022-23397
The Cedar Gate EZ-NET portal 6.5.5 6.8.0 Internet portal has a call to display messages to users which does not properly sanitize data sent in through a URL parameter. This leads to a Reflected Cross-Site Scripting vulnerability. NOTE: the vendor disputes this because the ado.im reference has "no...
PT-2025-30502 · Poly · Poly Clariti Manager
Name of the Vulnerable Software and Affected Versions: Poly Clariti Manager versions prior to 10.12.1 Description: A reflected cross-site scripting issue exists in the Poly Clariti Manager. The website does not validate or sanitize user input before rendering it in the response. Recommendations:...