CVE-2025-29602

CVE-2025-29602 - Stored cross site scriptingXSS vulnerabilities in the FlatPress CMS 1.3.1 Description A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS 1.3.1. An attacker with admin privileges can inject a malicious JavaScript payload into the...

CVE-2022-29359

School Club Application System Issue: Unauthenticated Stored Cross-Site Scripting to HTML injection to RCE Author: Zak Clifford Date: 12.04.2022 Vendor: https://www.sourcecodester.com/php/15266/school-club-application-system-phpoop-free-source-code.html Software:...

CVE-2022-46087

CVE-2022-46087 CloudSchool v3.0.1 is vulnerable to Cross Site Scripting XSS. A normal user can steal session cookies of the admin users through notification received by the admin user. Reffer to: https://github.com/G37SYS73M/AdvisoryG37SYS73M/blob/main/CVE-2022-46087/poc.md...

CVE-2023-31853

CVE-2023-31853 Reflected cross-site scripting XSS attack exists in web-based management interface of Cudy LT400. The page /cgi-bin/luci/admin/network/bandwidth has reflected XSS via the icon parameter. The methods of exploitation would involve sending a specially crafted request to the victim tha...

Bludit CMS <= 3.20.0 - Cross-Site Scripting

Bludit CMS contains a reflected XSS caused by improper sanitization in the search plugin, letting unauthenticated attackers inject arbitrary JavaScript, exploit requires crafted malicious search query. id: CVE-2026-41456 info: name: Bludit CMS = 3.20.0 - Cross-Site Scripting author: 0xAkoko...

CVE-2023-33732

CVE-2023-33732 — Reflected Cross-Site Scripting in eScan Management Console -orange Overview CVE-2023-33732 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console , version 14.0.1400.2281. The flaw exists in the New Policy assignme...

CVE-2023-34838

CVE-2023-34838 — eScan Management Console Stored XSS Overview Microworld Technologies eScan Management Console version 14.0.1400.2281 is vulnerable to a Stored Cross-Site Scripting XSS attack. An authenticated attacker with access to the role management feature can inject a malicious script into...

CVE-2025-63441

CVE-2025-63441 Title: Reflected XSS via arbitrarily supplied URL parameter param at endpoint u/administrator/friends Summary: A Reflected Cross-Site Scripting XSS vulnerability was identified in the u/administrator/friends endpoint of the OSSN application. This vulnerability allows attackers to...

CVE-2025-63708

CVE-2025-63708 CVE ID: CVE-2025-63708 Assigned: 11-12-2025 Problem Type: CWE-79 Cross-Site Scripting Affected Product: “AI Font Matcher” posted 2025-10-10, nid=18425 Product page: https://www.sourcecodester.com/javascript/18425/ai-font-matcher-using-html-css-and-javascript-source-code.html...

CVE-2021-40906

CVE-2021-40906 - Reflected XSS in an unauthenticated zone Application: CheckMK Management Web Console Software Revision: From 1.5.0 to 1.5.0p25 Author: Edgar Augusto Loyola Torres. Attack type: Reflected XSS Solution: Update to Software Revision 1.6.0p26 or later Summary: CheckMK Raw Edition...

CVE-2024-34452

CVE-2024-34452 - Cross-Site Scripting XSS Vulnerability in CMSimpleXH Overview A cross-site scripting XSS vulnerability has been identified in CMSimpleXH version 1.7.6. This vulnerability allows authorized users to upload SVG files containing malicious JavaScript code. The issue stems from...

CVE-2020-15051

CVE-2020-15051 : Artica Proxy before 4.28.030418 Community Edition allows Stored Cross Site Scripting. Product Description: Artica Tech offers a powerful but simple-to-use solution, usually the preserve of Large and Multinational companies. With a starting price of just 99€ and more than 62 000...

CVE-2025-66850

Finding Within the ‘LibreNMS’ application, we discovered a reflected Cross-Site Scripting vulnerability; this vulnerability exists in the routing module’s protocol parameter, allowing an attacker to render malicious JavaScript in a victim’s browser. This vulnerability affects all versions from...

CVE-2023-29489

CVE-2023-29489 The security vulnerability is recorded in the Common Vulnerabilities and Exposures CVE system. Specifically, this vulnerability is related to cPanel, a popular hosting management software. This flaw allows for cross-site scripting XSS attacks through specially crafted requests."...

CVE-2025-65300

CVE-2025-65300 Description CVE-2025-65300: Stored Cross-Site Scripting XSS Vulnerability in Coohom SaaS Platform Disclosure Date: 2025-10-28 Last Updated: 2025-10-28 Reporter: Phisit Pupiw Vendor: Coohom CWE: CWE-79 – Cross-Site Scripting Summary A stored Cross-Site Scripting XSS vulnerability wa...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Note: XXS Also works when these URLs are used in Referer Header. The...

CVE-2025-5777

Exploit for CVE-2025-5777: Citrix NetScaler Memory Disclosure CitrixBleed 2 T1606 Disclaimer Intented for authorized use only. It is your responsibility to verify authorization before use. I am not responsible for any legal or criminal proceedings filed against you for using this. Description...

CVE-2023-45542

CVE-2023-45542 A reflected cross-site scripting XSS vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: q Exploit - Proof of Concept POC Reflect...

adaPwn

adaPwn - CVE-2019-14912 PoC adAS OPENSSO module doesn't correctly verify the domain to redirect, making possible to redirect the user to an attacker controlled website, stealing his adAS session cookie. Usage usage: adaPwn.py -h --interface INTERFACE --httpPort HTTPPORT --dnsPort DNSPORT ipToSpoo...

CVE-2023-44813

CVE-2023-44813 A reflected cross-site scripting XSS vulnerability in the mode parameter on Invite Friend function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Vulerable Parameter: mode Exploit - Proof of Concept POC...