VirtualServer.asp Command Execution

The vulnerability of the CGI script VirtualServer.asp in the D-Link DSL-3782 router microprogramming system is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

PT-2025-7371 · WordPress · Team Builder For Wpbakery Page Builder

Name of the Vulnerable Software and Affected Versions: The Team Builder For WPBakery Page Builder plugin for WordPress versions up to, and including, 1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'team-builder-vc' shortcode due to insufficient input...

Linksys E5600 PRF_Table_content Component Cross-Site Scripting Vulnerability

Linksys E5600 is a powerful, compact and reliable WiFi 5 router from Linksys USA. A cross-site scripting vulnerability exists in Linksys E5600 Ver.1.1.0.26. The vulnerability stems from the application's lack of effective filtering and escaping of user-supplied data, which can be exploited by an...

PT-2025-6558

Name of the Vulnerable Software and Affected Versions magayo Lottery Results plugin for WordPress versions up to, and including, 2.0.12 Description The issue is due to missing or incorrect nonce validation on the 'magayo-lottery-results' page, making it possible for unauthenticated attackers to...

CVE-2024-33528

A Stored Cross-site Scripting XSS vulnerability in ILIAS 7 before 7.30 and ILIAS 8 before 8.11 allows remote authenticated attackers with tutor privileges to inject arbitrary web script or HTML via XML file upload...

CVE-2024-31847

An issue was discovered in Italtel Embrace 1.6.4. A stored cross-site scripting XSS vulnerability allows authenticated and unauthenticated remote attackers to inject arbitrary web script or HTML into a GET parameter. This reflects/stores the user input without sanitization...

CVE-2024-13506

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the displayname profile parameter in all versions up to, and including, 2.8.97 due to insufficient input sanitization and output escaping. This...

CVE-2021-4365

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfmeditfiletitledesc AJAX action. This makes it possible for...

CVE-2024-25152

Stored cross-site scripting XSS vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users to inject arbitrary web...

CVE-2024-25603

Stored cross-site scripting XSS vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote authenticated users...

CVE-2024-3729

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'feaencrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulate the user processing forms, which can ...

CVE-2024-10574

The Quiz Maker Business, Developer, and Agency plugins for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ayssavegooglecredentials' function in all versions up to, and including, 8.8.0 Business, up to, and including, 21.8.0 Developer, and up...

CVE-2024-55227: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the Events/Agenda module of Dolibarr v21.0.0-beta allows attackers to execute arbitrary web scripts or HTMl via a crafted payload injected into the Title parameter...

IBM Sterling B2B Integrator Cross-Site Scripting Vulnerability (CNVD-2025-02530)

IBM Sterling B2B Integrator is a suite of software from International Business Machines IBM that integrates critical B2B processes, transactions and relationships. The software supports secure integration of complex B2B processes with diverse partner communities. IBM Sterling B2B Integrator suffe...

CVE-2024-13422: Improper Neutralization of Input During Web Page Generation

The SEO Blogger to WordPress Migration using 301 Redirection plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 0.4.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2024-13404: Improper Neutralization of Input During Web Page Generation

The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

JFinalOA security vulnerabilities

JFinalOA is an enterprise office system developed on the JFinal framework by rabbit individual developers. A security vulnerability exists in JFinalOA versions prior to v2025.01.01. An attacker exploiting this vulnerability could execute arbitrary web script or HTML via a specially crafted payloa...

CVE-2024-13334 Car Demon <= 1.8.1 - Reflected Cross-Site Scripting

The Car Demon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchcondition' parameter in all versions up to, and including, 1.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

Arcadyan Meteor 2 CPE security vulnerability

Arcadyan Meteor 2 CPE is a high-end home integrated access device from China Smart Arcadyan. A security vulnerability exists in the Arcadyan Meteor 2 CPE. An attacker can exploit the vulnerability to execute arbitrary web script or HTML by injecting a specially crafted payload...

CVE-2025-22997

The Linksys E5600 Router (Ver. 1.1.0.26) is vulnerable to a stored cross-site scripting (XSS) vulnerability in the prf_table_content component. The root cause is a lack of effective filtering and escaping of user-supplied data, allowing an attacker to inject a crafted payload into the desc parame...