PT-2025-29839 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions prior to 3.4.5 Description: WeGIA is an open source web manager. A Stored Cross-Site Scripting XSS vulnerability exists in the adicionar cor.php endpoint, allowing attackers to inject malicious scripts into the cor parameter...

CVE-2025-28245

Cross-site scripting XSS vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body...

CVE-2024-7650 Remote code execution vulnerability discovered in OpenText™ Directory Services CE 23.4

Improper Control of Generation of Code 'Code Injection' vulnerability in OpenText™ Directory Services allows Remote Code Inclusion. The vulnerability could allow access to the system via script injection.This issue affects Directory Services: 23.4...

CVE-2025-7387

The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2025-42969

SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The victim, when tricked into clicking on this crafted URL unknowingly executes the malicious payload in their browser. On successful exploitatio...

PT-2025-29130 · Alteryx · Alteryx Server

Name of the Vulnerable Software and Affected Versions: Alteryx Server version 2023.1.1.460 Description: A cross-site scripting XSS issue exists in Alteryx Server. This allows remote attackers to inject arbitrary web script or HTML through the notification body. Recommendations: Update Alteryx...

CVE-2025-28245

Cross-site scripting XSS vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification body...

Alteryx Server 跨站脚本漏洞

Alteryx Server is a cloud-hosted or self-hosted application from Alteryx, Inc. for publishing, sharing and executing workflows. A security vulnerability exists in Alteryx Server version 2023.1.1.460, which originates in the body of the notification and could allow a remote attacker to inject...

CVE-2025-49547

Adobe Experience Manager versions FP11.4 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they brow...

CVE-2025-49540

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2025-49540 ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they...

CVE-2025-40719

Reflected Cross-site Scripting XSS vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL trhough the idconcesion parameter in /FacturaE/VerFacturaPDF...

Cross-Site Scripting (XSS)

cockpit-hq/cockpit is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of user-supplied input in the "name" or "email" arguments within the /system/users/save endpoint, which allows an attacker to inject malicious scripts that execute in the context of the...

CVE-2025-42969

SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The victim, when tricked into clicking on this crafted URL unknowingly executes the malicious payload in their browser. On successful exploitatio...

CVE-2025-42973 Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report)

Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associated with DQ job status reports. By intercepting requests, malicious script can be injected and subsequently executed when a user loads the...

CVE-2025-42969

CVE-2025-42969 describes a cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform. An unauthenticated attacker can inject a malicious script into a dynamically crafted URL, which, when a user follows, executes in the browser and may access or modify se...

PT-2025-28750 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a high-privileged attacker to inject malicious scripts into vulnerable form fields...

PT-2025-28281 · Sap · Sap Business Warehouse

Name of the Vulnerable Software and Affected Versions: SAP Business Warehouse Business Explorer Web affected versions not specified Description: The issue allows an attacker to create a malicious link. If an authenticated user clicks on this link, the injected script gets executed within the scop...

PT-2025-28747 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a high-privileged attacker to inject malicious scripts into vulnerable form fields...

PT-2025-28288 · Sap · Sap Netweaver Application Server Abap +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP and ABAP Platform affected versions not specified Description: The issue allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. When a victim clicks on this crafte...