14510 matches found
Cross-Site Scripting (XSS)
getgrav/grav is vulnerable to cross-site scripting XSS. The vulnerability is due to improper handling of user input, which allows attackers to execute arbitrary web scripts or HTML via a crafted payload...
CVE-2024-12527
The Perfect Portal Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'perfectportalintakeform' shortcode in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...
CVE-2024-12519
CVE-2024-12519 affects the WordPress plugin TCBD Auto Refresher. The vulnerability is a Stored Cross-Site Scripting (XSS) via the plugin’s tcbd_auto_refresh shortcode in all versions up to 2.0, caused by insufficient input sanitization and output escaping for user-supplied attributes. Exploitatio...
CVE-2024-11758
The CVE-2024-11758 entry affects the WP SPID Italia WordPress plugin. Impact: Stored Cross-Site Scripting via the plugin shortcode allows an authenticated attacker (contributor level or higher) to inject web scripts that execute when visitors access the affected page. Technical details: all versi...
CVE-2023-28120
There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input...
CVE-2025-22145
Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are a...
CVE-2025-22145 Carbon has an arbitrary file include via unvalidated input passed to Carbon::setLocale
Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are a...
CVE-2025-20166
A vulnerability in the web-based management interface of Cisco Common Services Platform Collector CSPC could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied...
CVE-2025-20123
Multiple vulnerabilities in the web-based management interface of Cisco Crosswork Network Controller could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against users of the interface of an affected system. These vulnerabilities exist because the web-based...
CVE-2025-20123
Cisco Crosswork Network Controller exposes stored Cross-Site Scripting (XSS) vulnerabilities in its web-based management interface. The flaws arise from improper validation of user-supplied input, enabling an authenticated, remote attacker to inject malicious scripts via data fields in the interf...
CVE-2024-11830 Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
The PDF Flipbook, 3D Flipbook—DearFlip plugin for WordPress is vulnerable to Stored Cross-Site Scripting via outline settings in all versions up to 2.3.52 due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for authenticated attackers with...
CVE-2025-22145: Improper Control of Filename for Include/Require Statement in PHP Program
Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are a...
PT-2025-1023 · Cisco · Cisco Common Services Platform Collector
Name of the Vulnerable Software and Affected Versions: Cisco Common Services Platform Collector CSPC affected versions not specified Description: The issue is related to insufficient validation of user-supplied input by the web-based management interface of an affected system, allowing an...
LangChain < 0.2.5 Arbitrary File Write
The version of LangChain installed on the remote host is prior to 0.2.5. It is, therefore, affected by a path traversal vulnerability which exists in the getFullPath method. This vulnerability allows attackers to save files anywhere in the filesystem, overwrite existing text files, read .txt file...
Nucleus signer-package Processor Code Execution
The vulnerability of the signer-package processor in Nuclei scanners exists because measures to neutralize special elements are not taken. Exploiting this vulnerability allows an attacker to execute arbitrary code by running a specially crafted template with user input...
PT-2025-1024 · Cisco · Cisco Common Services Platform Collector
Name of the Vulnerable Software and Affected Versions: Cisco Common Services Platform Collector CSPC affected versions not specified Description: The issue is related to insufficient validation of user-supplied input by the web-based management interface of an affected system, allowing an...
CVE-2024-11826
The Quill Forms | The Best Typeform Alternative | Create Conversational Multi Step Form, Survey, Quiz, Cost Estimation or Donation Form on WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'quillforms-popup' shortcode in all versions up to, and including...
CVE-2024-11764
CVE-2024-11764 refers to the Solar Wizard Lite WordPress plugin. Connected data confirms a Stored Cross-Site Scripting flaw in the plugin’s solar_wizard shortcode, affecting all versions up to 1.2.4. The vulnerability arises from insufficient input sanitization and output escaping on user-supplie...
CVE-2024-12624 Sina Extension for Elementor <= 3.5.91 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Sina Image Differ
The Sina Extension for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Image Differ widget in all versions up to, and including, 3.5.91 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...