CVE-2025-65858

Calibre-Web (specifically version v0.6.25 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization of the 'username' field during the user creation process. An attacker can inject malicious JavaScript into this field, which is then stored in the...

CVE-2016-9471: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Revive Adserver before 3.2.5 and 4.0.0 suffers from Special Element Injection. Usernames weren't properly sanitised when creating users on a Revive Adserver instance. Especially, control characters were not filtered, allowing apparently identical usernames to co-exist in the system, due to the fa...

CVE-2008-0940: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Plain Black WebGUI before 7.4.24 allows remote attackers to inject arbitrary web script or HTML when creating a username, a different vulnerability than CVE-2007-0407...