CVE-2025-49346

Cross-Site Request Forgery CSRF vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple Archive Generator: from n/a through = 5.2...

WordPress FunnelKit plugin <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via wfopphone Shortcode vulnerability discovered by zaim in WordPress Plugin Funnel Builder by FunnelKit versions = 3.13.1.2...

WordPress Ultimate Blocks plugin <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via content Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin Ultimate Blocks versions = 3.2.7...

PT-2025-54446

Name of the Vulnerable Software and Affected Versions Themefy Bloggie versions through 2.0.8 Description A Cross-Site Request Forgery CSRF issue exists in Themefy Bloggie, which also allows Reflected Cross-Site Scripting XSS. The vulnerability allows an attacker to potentially perform actions on...

PT-2025-54447

Name of the Vulnerable Software and Affected Versions ZoomSounds versions through 6.91 Description A flaw exists in ZoomSounds that allows for Reflected Cross-Site Scripting XSS. This issue occurs due to improper neutralization of input during web page generation. The vulnerability could...

CVE-2025-65442

DOM-based Cross-Site Scripting XSS vulnerability in 201206030 novel V3.5.0 allows remote attackers to execute arbitrary JavaScript code or disclose sensitive information e.g., user session cookies via a crafted "wvstest" parameter in the URL or malicious script injection into window.localStorage...

WordPress Real 3D FlipBook plugin cross-site scripting vulnerability

WordPress Real 3D FlipBook plugin is a plugin for WordPress website, which uses WebGL technology to convert PDF files or images into flipbook animations with realistic 3D effects, simulating the page turning experience of a real book, including page bending, light and shadow and shadow effects...

PT-2025-53766

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description The software is susceptible to a cross-site scripting XSS issue due to improper input neutralization during web page generation. This allows for the injection o...

Cross-site Scripting (XSS)

Overview FluentCMS.Web.UI is a FluentCMS Web UI Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Add Page process. An attacker can execute arbitrary JavaScript code in the context of an administrator's session by injecting malicious script tags into the section...

CVE-2025-65885

An issue was discovered in the Delight Custom Firmware CFW for Nokia Symbian Belle devices on Nokia 808 Delight v1.8, Nokia N8 Delight v6.7, Nokia E7 Delight v1.3, Nokia C7 Delight v6.7, Nokia 700 Delight v1.2, Nokia 701 Delight v1.1, Nokia 603 Delight v1.0, Nokia 500 Delight v1.2, Nokia E6 Delig...

Delight Custom Firmware 安全漏洞

Delight Custom Firmware is an unofficial custom firmware from Delight open source. A security vulnerability exists in Delight Custom Firmware, which originated from allowing the injection of boot scripts via a specially crafted .txt file, affecting several Nokia Symbian Belle devices...

EUVD-2025-205436

A cross-site scripting XSS vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the section, allowing remote attackers to inject arbitrary script tags...

CVE-2025-65885

An issue was discovered in the Delight Custom Firmware CFW for Nokia Symbian Belle devices on Nokia 808 Delight v1.8, Nokia N8 Delight v6.7, Nokia E7 Delight v1.3, Nokia C7 Delight v6.7, Nokia 700 Delight v1.2, Nokia 701 Delight v1.1, Nokia 603 Delight v1.0, Nokia 500 Delight v1.2, Nokia E6 Delig...

CVE-2025-65885

Delight Custom Firmware (CFW) for Nokia Symbian Belle devices (Nokia 808, N8, E7, C7, 700, 701, 603, 500, E6, Oro, Vertu Constellation T) is affected by a local vulnerability where crafted .txt files placed in the :\Data directory can inject startup scripts. Root cause and details indicate a loca...

CVE-2025-67349

A cross-site scripting XSS vulnerability was identified in FluentCMS 1.2.3. After logging in as an admin and navigating to the "Add Page" function, the application fails to properly sanitize input in the section, allowing remote attackers to inject arbitrary script tags...

PT-2025-53591

Name of the Vulnerable Software and Affected Versions FluentCMS version 1.2.3 Description The application does not properly sanitize input in the section, which can allow remote attackers to inject arbitrary script tags. This issue was identified after logging in as an administrator and navigatin...

FluentCMS 安全漏洞

FluentCMS is a content management system from FluentCMS open source. A security vulnerability exists in FluentCMS version 1.2.3, which stems from improper input cleanup in the head portion of the Add Page feature, which could lead to a remote attacker injecting arbitrary script tags...

PT-2025-53590

Name of the Vulnerable Software and Affected Versions Delight Custom Firmware versions 1.0 through 1.8 Description A flaw exists in Delight Custom Firmware for Nokia Symbian Belle devices that allows local attackers to inject startup scripts. This is achieved by placing crafted .txt files into th...

EUVD-2025-205437

An issue was discovered in the Delight Custom Firmware CFW for Nokia Symbian Belle devices on Nokia 808 Delight v1.8, Nokia N8 Delight v6.7, Nokia E7 Delight v1.3, Nokia C7 Delight v6.7, Nokia 700 Delight v1.2, Nokia 701 Delight v1.1, Nokia 603 Delight v1.0, Nokia 500 Delight v1.2, Nokia E6 Delig...

ChurchCRM Cross-Site Scripting Vulnerability

ChurchCRM is an open source church management system. ChurchCRM suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data on the View Active People, View Inactive People, and View All People pages, which can be exploited b...