CVE-2025-55056

Multiple CWE-79 Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting'...

PT-2025-47196

Name of the Vulnerable Software and Affected Versions PHPGurukul Complaint Management System version 2.0 Description The software is susceptible to a Cross Site Scripting XSS issue. This flaw is located in the between-date-userreport.php script and affects the fromdate and todate parameters...

PT-2025-47186

Name of the Vulnerable Software and Affected Versions Dependency-Track versions prior to 4.13.6 Description Dependency-Track, an open source Component Analysis platform, contains a weakness in its frontend application. Specifically, versions before 4.13.6 do not properly sanitize HTML when...

PT-2025-47200

Name of the Vulnerable Software and Affected Versions PHPGurukul Online Shopping Portal version 2.0 Description The PHPGurukul Online Shopping Portal version 2.0 is susceptible to SQL Injection. This issue affects the name, summary, review, quality, price, and value parameters within the...

PT-2025-47189

Name of the Vulnerable Software and Affected Versions PHPGurukul Complaint Management System version 2.0 Description The PHPGurukul Complaint Management System is affected by a Cross Site Scripting XSS issue. This issue occurs through the search parameter in the 'user-search.php' file. Successful...

HSEC-2025-0004 Broken Path Sanitization in spacecookie Library

Broken Path Sanitization in spacecookie Library The spacecookie library exposes the functions sanitizePath and sanitizeIfNotUrl intended to remove .. components from paths which can be used to prevent path traversal attacks. Due to erroneous comparison code, this elimination is not actually...

PT-2025-46969

Name of the Vulnerable Software and Affected Versions PHPGurukul Student Record System version 3.2.0 Description The software contains a SQL Injection flaw through the sub1, sub2, sub3, sub4, and course-short parameters in the 'add-subject.php' file. This allows for potential unauthorized databas...

PT-2025-46968

Name of the Vulnerable Software and Affected Versions PHPGurukul Student Record System version 3.20 Description The Student Record System contains multiple parameters in the ‘register.php’ file that are susceptible to SQL injection. The following parameters are affected: c-full, fname, mname,...

PT-2025-46988

Name of the Vulnerable Software and Affected Versions SVX Portal version 2.7A Description A Reflected Cross-Site Scripting XSS issue exists in SVX Portal version 2.7A. The issue is located in the Recivers.php file, specifically through the id parameter. An attacker can exploit this to inject...

PT-2025-46990

Name of the Vulnerable Software and Affected Versions CodeAstro Gym Management System version 1.0 Description A security flaw exists in CodeAstro Gym Management System version 1.0. The issue involves a SQL injection impacting an unknown function within the /admin/view-member-report.php file...

PT-2025-47011

Name of the Vulnerable Software and Affected Versions Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution versions prior to 4.1 Description A flaw exists in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution. Manipulation of the Search argument in an unknown...

Astro development server error page is vulnerable to reflected Cross-site Scripting

Summary A Reflected Cross-Site Scripting XSS vulnerability exists in Astro's development server error pages when the trailingSlash configuration option is used. An attacker can inject arbitrary JavaScript code that executes in the victim's browser context by crafting a malicious URL. While this...

CVE-2025-11560

The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins...

EUVD-2021-34715

Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. The 'fileName' parameter is not properly sanitized, allowing attackers to craft traversal sequences and access sensitive files outside the...

PT-2025-46825

Name of the Vulnerable Software and Affected Versions xCally Omnichannel version 3.30.1 Description A cross-site scripting XSS issue exists in xCally's Omnichannel version 3.30.1. The issue allows an attacker to execute JavaScript code in a victim’s browser. This is achieved by sending a maliciou...

Siemens SIMATIC S7-1500 Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-2022-0391)

A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator URL strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an...

CVE-2025-11994 Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting

The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2025-11560

CVE-2025-11560 — Concrete details exist for the WordPress plugin. The affected software is the Team Members Showcase WordPress plugin (versions before 3.5.0; e.g., ≤3.4.0). The root cause is a lack of sanitization/escaping of a parameter before outputting it on the page, causing a reflected cross...

CVE-2025-12590

The YSlider plugin for WordPress is vulnerable to Cross-Site Request Forgery to Stored Cross-Site Scripting in all versions up to, and including, 1.1. This is due to missing nonce verification on the content configuration page and insufficient input sanitization and output escaping. This makes it...

CVE-2025-12662

The Coon Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'map' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...