CVE-2024-57160

07FLYCMS v1.3.9 is associated with CVE-2024-57160 due to a Cross‑Site Request Forgery (CSRF) via the endpoint /erp.07fly.net:80/oa/OaTask/edit.html. The connected sources corroborate a CSRF issue affecting this specific version; no exploitable details or active exploit status are provided in the ...

CVE-2025-22759

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Stored XSS.This issue affects Post and Page Builder by BoldGrid: from n/a through = 1.27.5...

CVE-2024-53563

A stored cross-site scripting XSS vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload...

CVE-2024-52967

Fortinet FortiPortal versions 6.0.0–6.0.14 are affected by CVE-2024-52967 due to improper neutralization of script-related HTML tags, enabling HTML injection and basic cross-site scripting that can allow an attacker to run unauthorized code or commands. The issue stems from a script-related HTML ...

CVE-2025-22337 WordPress Order Audit Log for WooCommerce plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in infosoftplugin Order Audit Log for WooCommerce order-audit-log-for-woocommerce allows Reflected XSS.This issue affects Order Audit Log for WooCommerce: from n/a through = 2.0...

Cross-Site Scripting (XSS)

phpoffice/phpspreadsheet is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to a lack of sanitization in the /vendor/phpoffice/phpspreadsheet/samples/Engineering/Convert-Online.php file, allowing an attacker to inject malicious scripts into web pages viewed by other...

CVE-2024-13292 Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Tooltip allows Cross-Site Scripting XSS.This issue affects Tooltip: from 0.0.0 before 1.1.2...

CVE-2024-13287

Summary (CVE-2024-13287): Drupal Views SVG Animation contains an XSS vulnerability due to improper neutralization of input during web page generation. Affected versions are 0.0.0 through 1.0.0; fixed in 1.0.1 and later. The issue is documented in multiple sources (SA-CONTRIB-2024-051, DRUPAL-SA-C...

CVE-2024-13247

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Drupal Coffee allows Cross-Site Scripting XSS.This issue affects Coffee: from 0.0.0 before 1.4.0...

CVE-2025-22539 WordPress Custom DataBase Tables Plugin <= 2.1.34 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ka2 Custom DataBase Tables allows Reflected XSS.This issue affects Custom DataBase Tables: from n/a through 2.1.34...

CVE-2025-22808 WordPress Surbma | Premium WP plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Surbma Surbma | Premium WP allows DOM-Based XSS.This issue affects Surbma | Premium WP: from n/a through 9.0...

WordPress plugin VR Views 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Cross-site Scripting (XSS)

Koji is vulnerable to cross-site scripting XSS. The vulnerability is due to unsanitized input due to malicious JavaScript code from a crafted link being reflected in the resulting web page, although XSS protections prevent actions or changes in Koji...

SUSE CVE-2025-21620

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Deno'sfetch redirect handling creates a follow-up redirect request that keeps the original...

CVE-2025-22354 WordPress Digi Store theme <= 1.1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Code Themes Digi Store digi-store allows DOM-Based XSS.This issue affects Digi Store: from n/a through = 1.1.4...

CVE-2025-22308

CVE-2025-22308 is a stored XSS vulnerability in WordPress plugin Smart Custom Fields (aka Smart Custom Fields by Takashi Kitajima). The issue affects Smart Custom Fields versions up to 5.0.0 and is tied to improper input neutralization during web page generation (stored XSS). The vulnerability is...

Cross-site Scripting (XSS)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper user input sanitization passed through the generateMeta parameter of the class...

PhpSpreadsheet 跨站脚本漏洞

PhpSpreadsheet is an open source PHP library from PHPOffice for reading and writing spreadsheet files. PhpSpreadsheet suffers from a cross-site scripting vulnerability that originates from HTML pages formed without cleaning up the hyperlink library, resulting in a cross-site scripting XSS...

CVE-2024-56242 WordPress Arconix Shortcodes plugin <= 2.1.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Stored XSS.This issue affects Arconix Shortcodes: from n/a through = 2.1.14...

CVE-2024-56022 WordPress Preloader by WordPress Monsters plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WordPress Monsters Preloader by WordPress Monsters allows Reflected XSS.This issue affects Preloader by WordPress Monsters: from n/a through 1.2.3...