CVE-2025-42973

Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associated with DQ job status reports. By intercepting requests, malicious script can be injected and subsequently executed when a user loads the...

CVE-2025-47812

In Wing FTP Server before 7.4.4. the user and admin web interfaces mishandle '\0' bytes, ultimately allowing injection of arbitrary Lua code into user session files. This can be used to execute arbitrary system commands with the privileges of the FTP service root or SYSTEM by default. This is thu...

CVE-2025-28244

Insecure Permissions vulnerability in the Local Storage in Alteryx Server 2023.1.1.460 allows remote attackers to obtain valid user session tokens from localStorage, leading to account takeover...

WordPress Uncode Core Cross-Site Scripting Vulnerability

WordPress Uncode Core is a creative multipurpose theme for the WordPress platform. WordPress Uncode Core suffers from a cross-site scripting vulnerability that stems from insufficient input cleanup and output escaping, which can be exploited by an attacker to steal user session information by...

PT-2025-29129 · Alteryx · Alteryx Server

Name of the Vulnerable Software and Affected Versions: Alteryx Server version 2023.1.1.460 Description: An insecure permissions issue in the local storage component of Alteryx Server allows remote attackers to obtain valid user session tokens from localStorage, potentially leading to account...

CVE-2025-42973 Cross-Site Scripting (XSS) vulnerability in SAP Data Services (DQ Report)

Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associated with DQ job status reports. By intercepting requests, malicious script can be injected and subsequently executed when a user loads the...

WordPress Tournament Bracket Generator Cross-Site Scripting Vulnerability

WordPress Tournament Bracket Generator is a plugin for generating fixture maps for the knockout stages of tournaments. A cross-site scripting vulnerability exists in WordPress Tournament Bracket Generator, which stems from insufficient input cleanup and escaping, and can be exploited by an attack...

WordPress web-cam cross-site scripting vulnerability

WordPress web-cam is a plugin for integrating instant photo taking feature in WordPress website, by calling user's device camera to realize real-time photo taking feature. WordPress web-cam suffers from a cross-site scripting vulnerability that stems from insufficient input cleanup and escaping,...

SAP Data Services Management Console 跨站脚本漏洞

SAP Data Services Management Console is a centralized management interface for SAP Data Services from SAP, Germany. A cross-site scripting vulnerability exists in SAP Data Services Management Console that originates from cross-site scripting and could affect user session information...

Security update for screen

This update for screen fixes the following issues: Security issues fixed: CVE-2025-46802: temporary chmod of a user's TTY to mode 0666 when attempting to attach to a multi-user session allows for TTY hijacking bsc1242269. Other issues fixed: Use TTY file descriptor passing after a suspend MSGCONT...

filebrowser allows Stored Cross-Site Scripting through the Markdown preview function

Summary The Markdown preview function of File Browser v2.32.0 is vulnerable to Stored Cross-Site-Scripting XSS. Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser Impact A user can upload a malicious Markdown file to the application which can...

CVE-2025-48700

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0 and 10.0 and 10.1. A Cross-Site Scripting XSS vulnerability in the Zimbra Classic UI allows attackers to execute arbitrary JavaScript within the user's session, potentially leading to unauthorized access to sensitive information...

Security update for screen

This update for screen fixes the following issues: Security issues fixed: CVE-2025-46802: temporary chmod of a user's TTY to mode 0666 when attempting to attach to a multi-user session allows for TTY hijacking bsc1242269. Other issues fixed: Use TTY file descriptor passing after a suspend MSGCONT...

CVE-2025-49130

Laravel Translation Manager is a package to manage Laravel translation files. Prior to version 0.6.8, the application is vulnerable to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including...

GHSA-J226-63J7-QRQH Laravel Translation Manager Vulnerable to Stored Cross-site Scripting

Impact The application is vulnerable to Cross-Site Scripting XSS attacks due to incorrect input validation and sanitization of user-input data. An attacker can inject arbitrary HTML code, including JavaScript scripts, into the page processed by the user's browser, allowing them to steal sensitive...

PT-2025-24231 · Unknown · Wpsoul Greenshift

Name of the Vulnerable Software and Affected Versions: wpsoul Greenshift versions n/a through 11.5.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows DOM-Based XSS. This means that an attacker coul...

MainWP: Reflected XSS in "Create Category" Functionality of Post Creation Module

A reflected Cross-Site Scripting XSS vulnerability was identified in the "Create Category" feature of the post creation functionality. When a user entered a malicious JavaScript payload in the Category Name field, the input was reflected and executed immediately after submission. However, this XS...

CVE-2025-0602

A stored Cross-site Scripting XSS vulnerability affecting Compare in Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session...

CVE-2025-1484

A vulnerability exists in the media upload component of the Asset Suite versions listed below. If successfully exploited an attacker could impact the confidentiality or integrity of the system. An attacker can use this vulnerability to construct a request that will cause JavaScript code supplied ...

PT-2025-23302 · Unknown · Product Manager

Name of the Vulnerable Software and Affected Versions: Product Manager versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2025x Description: A stored Cross-site Scripting XSS vulnerability in Product Manager allows an attacker to execute arbitrary script code in a user's browser session. This...