ChurchCRM v4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in the FundRaiserEditor.php component of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. id: CVE-2023-31548 info: name: ChurchCRM v4.5.3 - Cross-Site Scripting author: Harsh severity: medium...

Microweber <1.2.12 - Stored Cross-Site Scripting

Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,. id: CVE-2022-0963 info: name: Microweber 1.2.12 - Stored Cross-Site Scripting author: amit-jd severity: medium description: | Microweber prior to 1.2.12 contains a stored...

Yamcs <=5.8.6 - Cross-Site Scripting

Yamcs 5.9.4 contains a stored XSS caused by inadequate HTML escaping of attacker-controlled redirecturi parameter in authorization template, letting attackers execute JavaScript to steal authentication data, exploit requires user to open crafted URL. id: CVE-2026-55549 info: name: Yamcs =5.8.6 -...

Payara Server - Cross-Site Scripting

Payara Server versions 4.1.2.191.54, 5.83.0, 6.34.0, and 7.2026.1 contain a stored XSS vulnerability caused by improper input sanitization in the REST Management Interface. This allows attackers to mislead administrators into changing the admin password via a URL payload; however, the exploit...

Site Reviews < 7.2.5 - Unauthenticated Stored XSS

Site Reviews WordPress plugin before 7.2.5 contains a stored cross-site scripting caused by improper sanitization and escaping of review fields, letting unauthenticated users execute malicious scripts, exploit requires no authentication. id: CVE-2025-1232 info: name: Site Reviews 7.2.5 -...

CVE-2023-2859

CVE-2023-2859: Stored HTML injection in folderName affecting Admin in TeamPass 3.0.9 - M Nadeem Qazi Hi, I have found a major vulnerability in the nilsteampassnet/teampass application that involves stored HTML injection in the FolderName field. By inserting malicious HTML code into the FolderName...

CVE-2024-41503

CVE-2024-41503 CVE: CVE-2024-41503 Software: Jetimob Plataforma Imobiliaria CRM/ERP/CMS Version: 20240627-0 Vulnerability: Stored Cross-Site Scripting XSS Description: The "Busca" search function used throughout the application contains a filter option that can be saved - when saving it, there is...

CVE-2021-39287-Stored-XSS

CVE-2021-39287-Stored-XSS CVE-2021-39287 Stored XSS in TastyIgniter v3.0.7 Restaurtant CMS A stored Cross Site Scripting XSS vulnerability exists within TastyIgniter v3.0.7 Restaurant CMS. The description input field, located in /admin/locations/settings is not properly sanitized, and allows...

CVE-2024-41502

CVE-2024-41502 CVE: CVE-2024-41502 Software: Jetimob Plataforma Imobiliaria CRM/ERP/CMS Version: 20240627-0 Vulnerability: Stored Cross-Site Scripting XSS Description: Stored XSS via the form field "Observações" in the "Pessoas" section when creating or editing either a legal or a natural person...

Stored-xss

Stored-xss CVE-2023-41575 - Stored XSS...

CVE-2025-57520-Stored-XSS-in-Decap-CMS-3.8.3-

CVE-2025-57520 – Stored XSS in Decap CMS Steps 1. Login as Contributor/Editor low privilege...

CVE-2025-51403

Exploit Title: LiveHelperChat =4.61 - Stored Cross Site Scripting XSS via Department Assignment Alias Nick Field Date: 09/06/2025 Exploit Author: Manojkumar J TheWhiteEvil Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Vendor Homepage: https://github.com/LiveHelperChat/livehelperch...

Typecho-Multiple-Vulnerabilities

Typecho Multiple Vulnerabilities This repository contains the exploits of the following vulnerabilities: CVE-2024-35538: In Typecho v1.3.0 there is a Client IP Spoofing vulnerability, which allows malicious actors to falsify their IP addresses by specifying an arbitrary IP as value of...

CVE-2025-51401

Exploit Title: LiveHelperChat =4.61 - Stored Cross Site Scripting XSS via Operator Chat Name Field Triggers on Chat Owner Transfer Date: 09/06/2025 Exploit Author: Manojkumar J TheWhiteEvil Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Vendor Homepage:...

CVE-2024-39031

CVE-2024-39031 : Silverpeas Core Stored XSS in in Mes agendas Information Description: In Mes Agendas, a user can create new events and add them to their calendar. Additionally, users can invite others from the same domain, including administrators, to these events. A standard user can inject an...

CVE-2023-4220-exploit

CVE-2023-4220-exploit Unrestricted file upload in the large file upload functionality at /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS versions = 1.11.24 allows unauthenticated attackers to perform stored Cross-Site Scripting attacks and achieve remote code execution by...

CVE-2023-44766_ConcreteCMS-Stored-XSS---SEO

ConcreteCMS Stored XSS v.9.2.1 Author: Sergio Description: Cross Site Scripting vulnerability in ConcreteCMS v.9.2.1 allows a local attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. Attack Vectors: Scripting A vulnerability in the sanitization of the...

CVE-2025-0924-different

Other Vulnerabilities Discovered During CVE-2025-0924 Analysis 01. Overview of Stored XSS and WordPress, WP Activity Log 1 Overview of Stored XSS and WordPress, WP Activity Log Stored XSS is a type of vulnerability where a malicious script is stored on the server and later automatically executed...

CVE-2022-1051

CVE-2022-1051 WPQA 5.2 - Subscriber+ Stored Cross-Site Scripting via Profile fields Description The plugin, used as a companion plugin for the Discy and Himer themes, does not sanitise and escape the city, phone or profile credentials fields when outputting it in the profile page, allowing any...

CVE-2022-40348_Intern-Record-System-Cross-site-Scripting-V1.0-Vulnerability-Unauthenticated

CVE-2022-40348: Intern Record System - 'name' and 'email' Cross-site Scripting Unauthenticated XSS Exploit Title: Intern Record System - 'name' and 'email' Cross-site Scripting Unauthenticated XSS Date: 2022-06-09 Exploit Author: Hamdi Sevben Vendor Homepage:...