📄 DataEase 2.4.0 Information Disclosure

DataEase version 2.4.0 suffers from a database configuration information disclosure vulnerability. - Exploit Title: DataEase Database Creds Extractor - Shodan Dork: http.html:"dataease" - FOFA Dork: body="dataease" && title=="DataEase" - Exploit Author: ByteHunter - Email: [email protected] ...

Cross-site Scripting (XSS)

Overview Kentico.Xperience.Libraries is a package for libraries and applications that use Kentico Xperience API. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the media library file upload feature. An attacker can distribute malicious content by uploading...

CVE-2025-32187 WordPress Administrator Z plugin <= 2026.03.02 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Quý Lê 91 Administrator Z administrator-z allows DOM-Based XSS.This issue affects Administrator Z: from n/a through = 2026.03.02...

PT-2025-14924 · Unknown · Secure Copy Content Protection/Content Locking

Name of the Vulnerable Software and Affected Versions: Ays Pro Secure Copy Content Protection and Content Locking versions n/a through 4.5.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XS...

PT-2025-14965 · Unknown · Galaxy Weblinks Video Playlist For Youtube

Name of the Vulnerable Software and Affected Versions: Galaxy Weblinks Video Playlist For YouTube versions through 6.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2025-14976 · Unknown · La-Studio Element Kit For Elementor

Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor versions 1.4.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

Cross-site Scripting (XSS)

Overview pgadmin4 is a PostgreSQL Tools Affected versions of this package are vulnerable to Cross-site Scripting XSS in the measureText function, accessible via the Query Tool interface. An attacker can inject malicious scripts into the displayed output. PoC sql CREATE TABLE IF NOT EXISTS EXAMPLE...

PT-2025-14817 · Unknown · Projectworlds Online Doctor Appointment Booking System

Name of the Vulnerable Software and Affected Versions: projectworlds Online Doctor Appointment Booking System version 1.0 Description: A critical issue was discovered in the projectworlds Online Doctor Appointment Booking System, affecting an unknown function of the file...

CVE-2025-31445 WordPress Pages Order plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NotFound Pages Order allows Reflected XSS. This issue affects Pages Order: from n/a through 1.1.3...

CVE-2025-31835

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brice Capobianco WP Plugin Info Card wp-plugin-info-card allows DOM-Based XSS.This issue affects WP Plugin Info Card: from n/a through = 5.3.0...

CVE-2025-31861 WordPress Perfect Font Awesome Integration Plugin <= 2.3 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPOrbit Support Perfect Font Awesome Integration perfect-font-awesome-integration allows Stored XSS.This issue affects Perfect Font Awesome Integration: from n/a through = 2.3...

CVE-2025-31861

CVE-2025-31861 is a stored XSS in the Perfect Font Awesome Integration WordPress plugin (affected up to 2.2). It stems from improper input neutralization during web page generation. Wordfence lists the vulnerability as patched; no exploits or fixed version are detailed in the provided documents.

CVE-2025-31801

CVE-2025-31801 affects MX Time Zone Clocks (WordPress plugin). Connected data confirm a Stored XSS issue (authenticated, contributor+) due to input handling, with affected range up to 5.1.1. Publicly available exploitation details or vectors are not provided in the documents. Remediation/patch ve...

CVE-2025-30808

CVE-2025-30808 is a reflected XSS in the WordPress plugin About Author . Connected docs confirm the issue affects the plugin’s vulnerability surface up to version 1.6.2 . Root cause: Improper Neutralization of Input During Web Page Generation . Impact, as per metrics: High (CVSS 3.1 base 7.1) wit...

CVE-2025-30607 WordPress Quick Localization plugin <= 0.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Name.ly Quick Localization quick-localization allows Reflected XSS.This issue affects Quick Localization: from n/a through = 0.1.0...

Drupal Link field display mode formatter Cross-Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting XSS. This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0...

GHSA-P2WG-8H29-874V Drupal Link field display mode formatter Cross-Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Link field display mode formatter allows Cross-Site Scripting XSS. This issue affects Link field display mode formatter: from 0.0.0 before 1.6.0...

PT-2025-14142 · Dobsondev · Dobsondev Shortcodes

Name of the Vulnerable Software and Affected Versions: DobsonDev Shortcodes versions 2.1.12 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-14413 · Unknown · Notfound Delete Post Revision

Name of the Vulnerable Software and Affected Versions: NotFound Delete Post Revision versions n/a through 1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables an attacker ...

PT-2025-14228 · Unknown · Redefiningtheweb Pdf Generator Addon

Name of the Vulnerable Software and Affected Versions: RedefiningTheWeb PDF Generator Addon for Elementor Page Builder versions 1.7.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored...