PT-2025-16603 · Wpcasa · Wpcasa

Name of the Vulnerable Software and Affected Versions: WPCasa versions through 1.3.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. Recommendations: For versions through 1.3.2, update t...

CVE-2024-40069

Sourcecodester Online ID Generator System 1.0 is affected by a Stored Cross-Site Scripting (XSS) flaw in id_generator/classes/Users.php?f=save, triggered by the POST parameters firstname and lastname. Root cause is unescaped user input leading to script execution in the context of authenticated/u...

CVE-2024-42200 HCL BigFix Web Reports is potentially susceptible to a Stored Cross-Site Scripting (XSS) attack

HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting XSS attack, due to a potentially weak validation of user input...

CVE-2024-42200

CVE-2024-42200 affects HCL BigFix Web Reports, where stored XSS can arise from weak input validation of user-supplied data. The consolidated sources describe the issue as a Stored Cross-Site Scripting vulnerability in the Web Reports component of HCL BigFix, with no detailed exploit path or confi...

CVE-2025-3573

Versions of the package jquery-validation before 1.20.0 are vulnerable to Cross-site Scripting XSS in the showLabel function, which may take input from a user-controlled placeholder value. This value will populate a message via $.validator.messages in a user localizable dictionary...

PT-2025-16313 · WordPress · Advance Wp Query Search Filter

Name of the Vulnerable Software and Affected Versions: Advance WP Query Search Filter versions 1.0.10 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS in the Advance WP Query...

PT-2025-16514 · Jetengine · Jetengine

Name of the Vulnerable Software and Affected Versions: JetEngine versions 3.6.4.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based Cross-site Scripting XSS. This means that an attacker could potentially inject...

PT-2025-16302 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns unvalidated user input in the Apache HTTP Server. No specific details about the number of potentially affected devices or real-world incidents are provided...

PT-2025-16327 · Fs Poster · Fs Poster

Name of the Vulnerable Software and Affected Versions: FS Poster versions n/a through 6.5.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables potential attackers to inject...

RHEL 7 : redhat-access-plugin-openstack (RHSA-2015:0645)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2015:0645 advisory. The Red Hat Support plug-in for Red Hat OpenStack is a Technology Preview feature which offers seamless integrated access to Red Hat subscription...

CVE-2024-13896

The WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a regular expression via the wpgeshifilterreplacecode function, which could lead to Regular Expression Denial of Service ReDoS issue...

Adobe ColdFusion Input Validation Error Vulnerability

Adobe ColdFusion is the United States Odo than Adobe company's set of rapid application development platform. The platform includes an integrated development environment and scripting language. An input validation error vulnerability exists in Adobe ColdFusion that stems from a failure to...

PT-2025-16059 · Vimeo & Youtube · Workbox Video

Name of the Vulnerable Software and Affected Versions: Workbox Video from Vimeo & Youtube versions 3.2.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for reflected Cross-site Scripting XSS. This enables attackers to...

CVE-2025-30013

SAP ERP BW Business Content is vulnerable to OS Command Injection through certain function modules. These function modules, when executed with elevated privileges, improperly handle user input, allowing attacker to inject arbitrary OS commands. This vulnerability allows the execution of unintende...

CVE-2024-13896

The WP-GeSHi-Highlight — rock-solid syntax highlighting for 259 languages WordPress plugin through 1.4.3 processes user-supplied input as a regular expression via the wpgeshifilterreplacecode function, which could lead to Regular Expression Denial of Service ReDoS issue...

Cross-Site Scripting (XSS)

drupal/core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper neutralization of user-supplied input during web page generation, which allows malicious scripts to be executed in the context of a user's browser...

CVE-2024-13896

CVE-2024-13896 affects WP-GeSHi-Highlight for WordPress up to version 1.4.3. The plugin processes user-supplied input as a regular expression in wp_geshi_filter_replace_code(), which could trigger a Regular Expression Denial of Service (ReDoS). This is described in multiple connected records (inc...

CVE-2025-31138

tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs for element dimensions width and height were not properly validated. This allowed an attacker with direct access to the site's source code...

PT-2025-15938 · Vcita · Contact Form Builder

Name of the Vulnerable Software and Affected Versions: Contact Form Builder by vcita versions n/a through 4.10.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for potentially malicious scripts to b...

Centron 19.04 - Remote Code Execution (RCE)

Exploit Title : Centron 19.04 - Remote Code Execution RCE Tested on Centreon API 19.04.0 Centreon 19.04 - Login Password Bruteforcer Written on 6 Nov 2019 Referencing API Authentication of the Centreon API document Author: st4rry centbruteon.py Centreon Download Link:...