CVE-2024-41503

The Jetimob Plataforma Imobiliaria real estate platform (version 20240627-0 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists in the "Ttulo" (title) field within the filter Save option of the "Busca" (search) function. This allows an attacker to inject and stor...

CVE-2024-41503

Jetimob Plataforma Imobiliaria 20240627-0 is vulnerable to Cross Site Scripting XSS in the field "Ttulo" title inside the filter Save option in the "Busca" search function...

PT-2025-24924

Name of the Vulnerable Software and Affected Versions Jetimob Plataforma Imobiliaria version 20240627-0 Description The issue concerns a Cross Site Scripting XSS vulnerability in the "Ttulo" title field inside the filter Save option in the "Busca" search function. This allows for potential...

CVE-2024-37395: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the Public Survey function of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Survey Title' and 'Survey Instructions' fields. This vulnerability could be exploited by...

CVE-2024-37394: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the Project Dashboards of REDCap 13.1.9 allows authenticated users to execute arbitrary web script or HTML by injecting a crafted payload into the 'Dashboard title' and 'Dashboard content' text boxes. This can lead to the execution of malicious...

CVE-2025-48062 Discourse vulnerable to HTML injection when inviting to topic via email

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML...

CVE-2025-48062

Technical details about CVE-2025-48062 are not publicly disclosed in the provided documents. Monitor for updates from official sources.

CVE-2025-48062: Improper Encoding or Escaping of Output

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch, certain invites via email may result in HTML injection in the email body if the topic title includes HTML...

CVE-2025-5727

A vulnerability classified as problematic has been found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /script/academic/announcement of the component Announcement Page. The manipulation of the argument Title leads to cross site scripting. It is...

SourceCodester Student Result Management System 安全漏洞

SourceCodester Student Result Management System is a SourceCodester open source student result management system. A security vulnerability exists in SourceCodester Student Result Management System version 1.0, which results from cross-site scripting due to incorrect manipulation of the file...

CVE-2025-5727: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in SourceCodester Student Result Management System 1.0. This affects an unknown part of the file /script/academic/announcement of the component Announcement Page. The manipulation of the argument Title leads to cross site scripting. It is...

thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links

No description is available for this CVE...

CVE-2025-3662: Improper Neutralization of Input During Web Page Generation

The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields. The issue was received as a Contributor+ Stored XSS, however one of our researcher Marc Montpas escalated it to an Unauthenticated Stored XSS...

thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links

No description is available for this CVE...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the title parameter in the URL /admin.php?m=config&n=edit&o=core&p=title. An attacker can inject malicious scripts from the admin interface by crafting a malicious title value. Note:...

PT-2025-23531 · Unknown · Cotonti Siena

Name of the Vulnerable Software and Affected Versions: Cotonti Siena version 0.9.25 Description: A vulnerability has been found in Cotonti Siena. The issue affects the file "/admin.php?m=config&n=edit&o=core&p=title". The manipulation of the value of title leads to cross-site scripting...

Cotonti Siena 跨站脚本漏洞

Cotonti Siena is a powerful open source web development framework and content manager from Cotonti Open Source. A security vulnerability exists in Cotonti Siena version v0.9.25, which stems from cross-site scripting due to incorrect manipulation of the parameter title in the file /admin.php...

CVE-2025-44115: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config&n=edit&o=core&p=title. The manipulation of the value of title leads to cross-site scripting...

WordPress plugin Borderless – Elementor Addons and Templates 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

CVE-2025-5290: Improper Neutralization of Input During Web Page Generation

The Borderless – Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...