CVE-2025-40727 Reflected Cross-Site Scripting (XSS) in Phoenix CMS

A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...

CVE-2025-40727 Reflected Cross-Site Scripting (XSS) in Phoenix CMS

A Reflected Cross Site Scripting XSS vulnerability was found in '/search' in Phoenix Site CMS from Phoenix, which allows remote attackers to execute arbitrary code via 's' GET parameter...

TencentOS Server 4: python-django (TSSA-2024:0715)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0715 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities...

PT-2025-25532 · Nosto · Nosto

Name of the Vulnerable Software and Affected Versions: Nosto affected versions not specified Description: A Reflected Cross-Site Scripting XSS issue exists in the /pages/search-results-page endpoint of Nosto. This allows remote attackers to execute arbitrary code via the q GET request parameter...

PT-2025-25534 · Unknown · Customer Support System

Name of the Vulnerable Software and Affected Versions: Customer Support System version 1.0 Description: The issue is related to a Reflected Cross-Site Scripting XSS in the /customer support/index.php endpoint, which allows remote attackers to execute arbitrary code via the page parameter. This...

PT-2025-25529 · Unknown · Phoenix Site Cms

Name of the Vulnerable Software and Affected Versions: Phoenix Site CMS versions affected versions not specified Description: A Reflected Cross Site Scripting XSS issue was found in the "/search" endpoint, allowing remote attackers to execute arbitrary code via the s GET parameter. Recommendation...

TencentOS Server 3: pcs (TSSA-2023:0189)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2023:0189 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2025-5301

ONLYOFFICE Docs DocumentServer in versions equal and below 8.3.1 are affected by a reflected cross-site scripting XSS issue when opening files via the WOPI protocol. Attackers could inject malicious scripts via crafted HTTP POST requests, which are then reflected in the server's HTML response...

Exploit for CVE-2025-46181

CVE-2025-46181 - Reflected XSS in an Online Appointment Bookin...

Spring Framework vulnerable to a reflected file download (RFD)

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input...

GHSA-6R3C-XF4W-JXJM Spring Framework vulnerable to a reflected file download (RFD)

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input...

ManageEngine OpManager Reflected XSS (CVE-2025-41437)

The version of ManageEngine OpManager running on the remote web server is earlier than 128463, between 128509 and 128541 inclusive, between 128551 and 128554 inclusive, or exactly 128565. It is, therefore, affected by a reflected XSS vulnerability on the login page. Note that Nessus has not teste...

PT-2025-29175 · Advantech · Advantech Iview

Name of the Vulnerable Software and Affected Versions: Advantech iView versions prior to 5.7.05 build 7057 Description: A reflected cross-site scripting XSS issue exists. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially...

B&R Systems Diagnostics Manager Improper Neutralization of Input During Web Page Generation (CVE-2022-4286)

A reflected cross-site scripting XSS vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions =3.00 and =3.00 and =C4.93 that enables a remote attacker to execute arbitrary JavaScript in the context of the users browser session. This plugin only works with Tenable.ot...

VMware Spring Framework 6.0.5 - 6.0.28, 6.1.0 - 6.1.20, 6.2.0 - 6.2.7 RFD Vulnerability - Windows

The VMware Spring Framework is prone to a reflected file download RFD vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2025-47094

Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browse...

CVE-2025-46857

Adobe Experience Manager versions 6.5.22 and earlier are affected by a reflected Cross-Site Scripting XSS vulnerability. If a low privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the...

CVE-2025-41234

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input...

UBUNTU-CVE-2025-41234

Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download RFD attack when it sets a “Content-Disposition” header with a non-ASCII charset, where the filename attribute is derived from user-supplied input...

CVE-2025-41234

CVE-2025-41234 : In Spring Framework, versions 6.0.x up to 6.0.28, 6.1.x up to 6.1.20, and 6.2.x up to 6.2.7 are vulnerable to a reflected file download (RFD) attack when a response header uses non-ASCII charset in the filename derived from user input via ContentDisposition.Builder#filename(Strin...