CVE-2025-51403

Exploit-Titel: LiveHelperChat =4.61 - Gespeicherte Cross-Site-Scripting XSS über Department Assignment Alias Nick Feld Datum: 09/06/2025 Exploit-Autor: Manojkumar J TheWhiteEvil Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Hersteller-Webseite:...

PT-2026-81446

Name of the Vulnerable Software and Affected Versions Reachy Mini versions prior to 1.8.2 Description The Reachy Mini daemon exposes the '/api/media/sounds/upload' endpoint, implemented by the upload sound function, without authentication, file-extension checks, content validation, or size...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature of GazellePW (GazellePosterWall) (commit 86c4bedf) allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=staff_tool. The vulnerable sinks are located in users.class.p...

CVE-2026-38472

GazellePW (GazellePosterWall) contains a Stored XSS vulnerability in its forum reward comments feature, identified at commit 86c4bedf727691b5a97af42a4864869d18446449 . Remote attackers can inject arbitrary JavaScript through the c parameter in /forums.php?action=ajax_get_jf. The injected payload ...

CVE-2026-38466

CVE-2026-38466 is a Stored XSS vulnerability in GazellePW (GazellePosterWall) , specifically in the torrent remaster custom title feature. The remaster_custom_title parameter is stored unsanitized during torrent upload or edit and later rendered in the torrent title output, allowing remote authen...

CVE-2026-38473

CVE-2026-38473 is a Stored XSS vulnerability in GazellePW (GazellePosterWall), a PHP-based application, specifically in the subtitle deletion flow at commit 86c4bedf. A remote authenticated user can inject arbitrary JavaScript by uploading a subtitle with a crafted filename. The malicious payload...

JetBrains TeamCity < 2021.2.1 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2021.2.1. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible. CVE-2022-24330 - In JetBrains TeamCity before 2021.2.1, the Agent...

PT-2026-81188

The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'mf form id' Widget Setting in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-81248

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-38465

GazellePW (GazellePosterWall), a PHP-based poster wall application, is affected by a Stored XSS in the donor avatar mouse-over text feature. The avatar_mouse_over_text parameter is stored and subsequently rendered in an avatar tooltip without sufficient output encoding, allowing remote authentica...

Ekushey Project Manager CRM 5.0 Cross Site Scripting

A persistent cross site scripting vulnerability was identified in Ekushey Project Manager CRM version 5.0. The issue was found in the application settings, specifically the Name field. CVE-2026-26211 — Stored XSS in Ekushey Project Manager CRM Product: Ekushey Project Manager CRM Version: 5.0...

CVE-2026-36214

CVE-2026-36214 – Gespeichertes Cross-Site-Scripting XSS in osTicket über anfällige Bootstrap-Tooltip-Komponente Beschreibung Enhancesoft osTicket-Versionen von 1.10 bis 1.17.7 und von 1.18.0 bis 1.18.3 werden mit der bekannten anfälligen Bootstrap-Tooltip-3.3.4-Komponente CVE-2019-8331...

CVE-2022-1051

CVE-2022-1051 WPQA 5.2 - Cross-Site Scripting Stored Subscriber+ tramite i campi del profilo Descrizione Il plugin, utilizzato come plugin complementare per i temi Discy e Himer, non sanitizza e non esegue l'escape dei campi città, telefono o credenziali del profilo quando li restituisce nella...

CVE-2023-44765_ConcreteCMS-Stored-XSS---Associations

ConcreteCMS XSS v2.2.18 Autor: Sergio Beschreibung: Eine Cross-Site-Scripting-Schwachstelle in ConcreteCMS v.9.2.1 ermöglicht es einem lokalen Angreifer, beliebigen Code über ein manipuliertes Skript im Plural Handle der Data Objects unter System & Settings auszuführen. Angriffsvektoren: Skriptin...

Vehicle-Service-Management-System-User-List-Stored-Cross-Site-Scripting-XSS

CVE-2021-46073 Exploit-Titel: Vehicle Service Management System - 'User List' Stored Cross Site Scripting XSS Exploit-Autor: SANU P.L CVE: CVE-2021-46073 CVSS: 4.8 MEDIUM Referenzen: https://www.plsanu.com/vehicle-service-management-system-user-list-stored-cross-site-scripting-xss...

Vehicle-Service-Management-System-Settings-Stored-Cross-Site-Scripting-XSS

CVE-2021-46074 Exploit-Titel: Vehicle Service Management System - 'Einstellungen' Stored Cross Site Scripting XSS Exploit-Autor: SANU P.L CVE: CVE-2021-46074 CVSS: 4.8 MITTEL Referenzen: https://www.plsanu.com/vehicle-service-management-system-settings-stored-cross-site-scripting-xss...

Vehicle-Service-Management-System-Service-Requests-Stored-Cross-Site-Scripting-XSS

CVE-2021-46070 Titolo dell'exploit: Vehicle Service Management System - 'Service Requests' Stored Cross Site Scripting XSS Autore dell'exploit: SANU P.L CVE: CVE-2021-46070 CVSS: 4.8 MEDIUM Riferimenti:...

Vehicle-Service-Management-System-MyAccount-Stored-Cross-Site-Scripting-XSS

CVE-2021-46068 Exploit Title: Vehicle Service Management System - 'MyAccount' Stored Cross Site Scripting XSS Exploit-Autor: SANU P.L CVE: CVE-2021-46068 CVSS: 4.8 MEDIUM Referenzen: https://www.plsanu.com/vehicle-service-management-system-myaccount-stored-cross-site-scripting-xss...

Appsmith-1.98-Stored-XSS-Exploit

CVE-2026-7299 - Appsmith 1.98 XSS Memorizzato Sink innerHTML di Autocompletamento SQL Exploit automatico per una vulnerabilità di cross-site scripting memorizzato nell'editor di query SQL di Appsmith. Uno sviluppatore del workspace può iniettare JavaScript arbitrario tramite nomi di tabelle del...

CVE-2024-39031

CVE-2024-39031 : Silverpeas Core Stored XSS in in Mes agendas Informazioni Descrizione: In Mes Agendas, un utente può creare nuovi eventi e aggiungerli al proprio calendario. Inoltre, gli utenti possono invitare altri dello stesso dominio, inclusi gli amministratori, a questi eventi. Un utente...