CVE-2025-9565

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocksynewslettersubscribe shortcode in all versions up to, and including, 2.1.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-8153

Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, from Ver.10.10.21 to Ver.10.10.31, Ver.10.11.6 and UNIVERGE IX-R/IX-V Ver1.3.16, Ver1.3.21 allows a attacker to inject an arbitrary scripts...

CVE-2025-8394

The Productive Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's displayproductivebreadcrumb shortcode in all versions up to, and including, 1.1.23 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-10688 SourceCodester Pet Grooming Management Software paid.php sql injection

A vulnerability was determined in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/operation/paid.php. This manipulation of the argument invno/instaamt causes sql injection. The attack can be initiated remotely. The exploit has been...

IBM Watsonx.data 跨站脚本漏洞

IBM Watsonx.data is an open data lake warehouse platform from International Business Machines IBM. A cross-site scripting vulnerability exists in IBM Watsonx.data version 2.2, which stems from the application's lack of effective filtering and escaping of user-supplied data, and can be exploited b...

CVE-2025-43802

Stored cross-site scripting XSS vulnerability in a custom object’s /o/c/ API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35. allows remote attackers to inject arbitrary web...

CVE-2025-43800

Cross-site scripting XSS vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an object with a...

CVE-2025-8153

CVE-2025-8153 affects NEC Corporation UNIVERGE IX and UNIVERGE IX-R/IX-V series. The vulnerability is a Cross-site Scripting (CWE-79) issue that allows an attacker to inject arbitrary scripts, which may be executed in the user’s browser. Impact includes potential script execution in the browser a...

CVE-2025-9851

CVE-2025-9851 affects the WordPress Appointmind plugin. The vulnerability is a Stored Cross‑Site Scripting via the appointmind_calendar shortcode in all versions up to 4.1.0, caused by insufficient input sanitization and output escaping on user-supplied attributes. Authenticated attackers with co...

Liferay search widget vulnerable to Cross-site Scripting

There is a Cross-site scripting XSS vulnerability in Liferay Portal's Search widget . Versions 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 allow remote attackers to inject arbitrary web scripts or HTML via the...

NEC UNIVERGE IX 安全漏洞

NEC UNIVERGE IX is a router from Nippon Electric NEC. A security vulnerability exists in the NEC UNIVERGE IX that originates from the ability to inject arbitrary scripts, which could lead to cross-site scripting attacks. The following products and versions are affected: NEC Corporation UNIVERGE I...

PT-2025-38098

Name of the Vulnerable Software and Affected Versions: Social Media Shortcodes plugin for WordPress versions up to and including 1.3.1 Description: The Social Media Shortcodes plugin for WordPress is susceptible to Stored Cross-Site Scripting through the plugin’s twitter shortcode. Insufficient...

PT-2025-38103

Name of the Vulnerable Software and Affected Versions: Appointmind plugin for WordPress versions up to and including 4.1.0 Description: The Appointmind plugin for WordPress is susceptible to Stored Cross-Site Scripting through the appointmind calendar shortcode. Insufficient input sanitization an...

CVE-2025-58174

LDAP Account Manager LAM is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile section via the profile name field, which renders untrusted input as HTML and executes a supplied script for example a script element. An...

GHSA-VG6H-G5MR-9HGV Liferay Stored Cross-site Scripting vulnerability

Stored cross-site scripting XSS vulnerability in a custom object’s /o/c/ API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay DXP 2023.Q3.1 through 2023.Q3.4, 7.4 update 51 through update 92, and 7.3 update 33 through update 35 allows remote attackers to inject arbitrary web...

PT-2025-38092

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.3.93 through 7.4.3.111 Liferay DXP versions 2023.Q3.1 through 2023.Q3.4 Liferay DXP version 2023.Q4.0 Description: A cross-site scripting XSS vulnerability exists in the Search widget. This allows remote attackers ...

CVE-2025-43802

CVE-2025-43802 is a stored XSS vulnerability in Liferay Portal/DXP where an attacker can inject arbitrary script via the externalReferenceCode parameter on the /o/c/ API. Affected: Liferay Portal 7.4.3.51–7.4.3.109 and Liferay DXP 2023.Q3.1–2023.Q3.4, plus older 7.4/7.3 updates listed in the inta...

GHSA-JFV5-R382-XVWH Liferay Portal Cross-site Scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an object with a...

CVE-2025-43800

Cross-site scripting XSS vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an object with a...

CVE-2025-43800

Cross-site scripting XSS vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7.4 GA through update 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an object with a...