CVE-2025-44024

Cross-Site Scripting XSS vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process...

CVE-2025-4126

The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's series shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes in the shortcodetitle function. This makes it possib...

CVE-2025-44024

Cross-Site Scripting XSS vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process...

Mars: [XSS] Reflected XSS via POST request in (███████)

A reflected Cross-Site Scripting XSS vulnerability was identified in the celular parameter of a POST request to the homepage of a Mars-owned website. The vulnerability was classified as medium severity with a CVSS score of 6.2. The application failed to properly sanitize user input before renderi...

CVE-2024-54780

Netgate pfSense CE prior to 2.8.0 beta release and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting...

CVE-2024-54780

Netgate pfSense CE prior to 2.8.0 beta release and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting...

CVE-2024-54780

Netgate pfSense CE prior to 2.8.0 beta release and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget due to improper sanitization of user-supplied input to the OpenVPN management interface. An authenticated attacker can exploit this vulnerability by injecting...

CVE-2025-44024

Cross-Site Scripting XSS vulnerability was discovered in the Pichome system v2.1.0 and before. The vulnerability exists due to insufficient sanitization of user input in the login form. An attacker can inject malicious JavaScript code into the username or password fields during the login process...

CVE-2025-44024

A Cross-Site Scripting (XSS) vulnerability exists in the Pichome open-source web hosting program, specifically in versions v2.1.0 and prior . The root cause is insufficient sanitization of user input within the login form. This allows an attacker to inject malicious JavaScript code into the usern...

CVE-2024-54780

Netgate pfSense CE (prior to 2.8.0 beta release) and corresponding Plus builds are vulnerable to command injection in the OpenVPN widget. The root cause is the improper sanitization of user-supplied input sent to the OpenVPN management interface. An authenticated attacker can exploit this by inje...

Remote Code Execution (RCE)

craftcms/cms is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper sanitization of user input, allowing attackers to inject malicious code if they have administrator access and the ALLOWADMINCHANGES setting is enabled...

CVE-2025-20147

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a stored cross-site scripting attack XSS on an affected system. This vulnerability is due to improper sanitization of use...

CVE-2025-20147

The CVE-2025-20147 issue affects Cisco Catalyst SD-WAN Manager (vManage) web-based management interface. The root cause is improper sanitization of user input in the management UI, enabling an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack on the affected sys...

Reflected Cross-Site Scripting (Reflected XSS)

yeswiki/yeswiki is vulnerable to reflected cross-site scripting XSS. The vulnerability is due to improper sanitization of user input in the file upload form, which allows attackers to craft malicious links that execute arbitrary scripts in the victim’s browser...

Cross-Site Scripting (XSS)

yeswiki/yeswiki is vulnerable to Reflected Cross-Site Scripting Reflected XSS. The vulnerability is due to insufficient sanitization of user-supplied input in URLs, which allows attackers to inject malicious scripts that are reflected in the server’s response...

Cisco Catalyst SD-WAN Manager Stored XSS (cisco-sa-vmanage-xss-xhN8M5jt)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD- WAN vManage, could allow an authenticated, remote attacker to conduct a stored...

PT-2025-18931 · WordPress · Xavin'S Review Ratings

Name of the Vulnerable Software and Affected Versions: Xavin's Review Ratings plugin for WordPress versions up to, and including, 1.4.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'xrr' shortcode due to insufficient input sanitization and output escaping on...

CVE-2025-3488

The CVE-2025-3488 entry concerns the WPML Multilingual CMS WordPress plugin. It describes a Stored Cross-Site Scripting (XSS) vulnerability in the wpml_language_switcher shortcode for plugin versions 3.6.0 through 4.7.3, caused by insufficient input sanitization and output escaping on user-suppli...

CVE-2025-46346

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, a stored cross-site scripting XSS vulnerability was discovered in the application’s comments feature. This issue allows a malicious actor to inject JavaScript payloads that are stored and later executed in the browser of any user...

CVE-2025-4100

CVE-2025-4100 affects Nautic Pages for WordPress. It is a Stored Cross-Site Scripting vulnerability in the np_marinetraffic_map shortcode, exploitable by authenticated users with contributor-level access and above, due to insufficient input sanitization and output escaping in versions up to 2.0. ...