CVE-2024-57772

A cross-site scripting (XSS) vulnerability exists in JFinalOA versions prior to v2025.01.01 . The flaw is located in the /bumph/getDraftListPage?type interface, where a crafted payload can allow attackers to execute arbitrary web scripts or HTML. To remediate this, users should update to version ...

CVE-2024-57771

A cross-site scripting XSS vulnerability in the common/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-57776

A cross-site scripting XSS vulnerability in the /apply/getEditPage?view interface of JFinalOA before v2025.01.01 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-12423

CVE-2024-12423 affects the Contact Form 7 Redirect & Thank You Page WordPress plugin. Connected sources confirm a Reflected XSS via the post parameter in all versions up to 1.0.7 due to insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject scripts on pa...

CVE-2024-41453

A cross-site scripting XSS vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter...

CVE-2024-12423: Improper Neutralization of Input During Web Page Generation

The Contact Form 7 Redirect & Thank You Page plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post' parameter in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

PT-2025-2606

Name of the Vulnerable Software and Affected Versions Process Maker pm4core-docker version 4.1.21-RC7 Description A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter. This issue enables attackers...

CVE-2025-22997: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the prftablecontent component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter...

CVE-2024-12240

The Page Builder by SiteOrigin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the row label parameter in all versions up to, and including, 2.31.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2025-22997

A stored cross-site scripting XSS vulnerability in the prftablecontent component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter...

CVE-2025-22996

A stored cross-site scripting XSS vulnerability in the spftablecontent component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter...

CVE-2025-22997

A stored cross-site scripting XSS vulnerability in the prftablecontent component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the desc parameter...

CVE-2024-53563

A stored cross-site scripting XSS vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

PT-2025-2969

Name of the Vulnerable Software and Affected Versions Arcadyan Meteor 2 CPE FG360 Firmware version ETV2.10 Description A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload. This enables the execution of malicious scripts...

PT-2025-2034

Name of the Vulnerable Software and Affected Versions HTML5 Video Player – mp4 Video Player Plugin and Block plugin for WordPress versions up to, and including, 2.5.35 Description The issue is related to DOM-Based Stored Cross-Site Scripting via the heading parameter due to insufficient input...

Linksys E5600 安全漏洞

Linksys E5600 is a powerful, compact and reliable WiFi 5 router from Linksys USA. A security vulnerability exists in Linksys E5600 Ver.1.1.0.26. An attacker can exploit the vulnerability to execute arbitrary web script or HTML by injecting a specially crafted payload with the desc parameter...

Cross-Site Scripting (XSS)

getgrav/grav is vulnerable to cross-site scripting XSS. The vulnerability is due to improper handling of user input, which allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

CVE-2024-11892

The Accordion Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'accordionslider' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-12407 Push Notification for Post and BuddyPress <= 2.07 - Reflected Cross-Site Scripting

The Push Notification for Post and BuddyPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pushnotificationid' parameter in all versions up to, and including, 2.07 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2024-12304

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via button block link in all versions up to, and including, 3.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...