HCL MyXalytics 安全漏洞

HCL MyXalytics is an analytics software product from HCL India. It is used to perform data analysis and other related tasks. A security vulnerability exists in HCL MyXalytics version 6.6, which stems from allowing HTML injection and could lead to cross-site scripting attacks...

CVE-2025-59767

Cross-site scripting XSS vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and...

CVE-2025-59767

CVE-2025-59767 : AndSoft e-TMS is vulnerable to a reflected XSS in v25.03. The issue arises from lack of proper input filtering/escaping in parameters l, demo, demo2, TNTLOGIN, UO, and SuppConn in the endpoint /clt/LOGINFRM_LVE.ASP. An attacker can lure a user to a malicious URL to execute JavaSc...

CVE-2025-59760 Multiple vulnerabilities in AndSoft's e-TMS

Cross-site scripting XSS vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and...

CVE-2025-40990

Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/projectbug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to...

AndSoft e-TMS SQL注入漏洞

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from an SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the SessionID cookie parameter in file /inc/connect/CONNECTION.ASP. An attacker can us...

AndSoft e-TMS 跨站脚本漏洞

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameters l, demo, demo2, TNTLOGIN, UO, and SuppConn in the file...

AndSoft e-TMS 跨站脚本漏洞

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameters l, demo, demo2, TNTLOGIN, UO, and SuppConn in the file...

AndSoft e-TMS 跨站脚本漏洞

AndSoft e-TMS is a logistics management software from AndSoft Spain. AndSoft e-TMS suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameters l, demo, demo2, TNTLOGIN, UO, and SuppConn in the file...

CVE-2025-20368 Stored Cross-Site Scripting (XSS) through missing field warning messages in Saved Search and Job Inspector on Splunk Enterprise

In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through the error messages and job inspection...

CVE-2025-11147 Reflected Cross-site scripting (XSS) vulnerability in Apt-Cacher-NG

Reflected cross-site scripting XSS in Apt-Cacher-NG v3.2.1. The vulnerability allows malicious scripts XSS to be executed in “/html/.html”...

Exploit for CVE-2025-56807

CVE-2025-56807 Description A Stored Cross Site Scripting XS...

CVE-2025-60146

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Amit Verma Map Categories to Pages map-categories-to-pages allows Stored XSS.This issue affects Map Categories to Pages: from n/a through = 1.3.2...

CVE-2025-11051 SourceCodester Pet Grooming Management Software cross-site request forgery

A vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely...

PT-2025-39743

CVE-2025-56714 Cloud-Classroom-PHP-1.0 CVE-2025-56713 Poc 2 - POST /classrooms/loginlin... https://t.co/Dx3zpMS4OH Vulnerability Notification: https://t.co/xhLrNnfyrO...

CVE-2025-11035

A vulnerability was determined in Jinher OA 2.0. The impacted element is an unknown function of the file /c6/Jhsoft.Web.module/ToolBar/ManageWord.aspx/?text=GetUrl&style=1. This manipulation causes xml external entity reference. The attack can be initiated remotely. The exploit has been publicly...

CVE-2025-11030 Tutorials-Website Employee Management System HTTP Request all-applied-leave.php improper authorization

A vulnerability was detected in Tutorials-Website Employee Management System up to 611887d8f8375271ce8abc704507d46340837a60. Impacted is an unknown function of the file /admin/all-applied-leave.php of the component HTTP Request Handler. The manipulation results in improper authorization. The atta...

CVE-2025-27006

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themeplugs Authorsy authorsy allows Stored XSS.This issue affects Authorsy: from n/a through = 1.0.5...

CVE-2025-60100

CVE-2025-60100 is linked to 8theme XStore for WordPress. The connected documents indicate an unauthenticated, arbitrary shortcode execution vulnerability in XStore versions up to 9.5.3, caused by improper neutralization of script-related HTML tags in a web page (basic XSS). The Wordfence entry li...

CVE-2025-10964

A weakness has been identified in Wavlink NU516U1. Affected by this vulnerability is the function sub401B30 of the file /cgi-bin/firewall.cgi. This manipulation of the argument remoteManagementEnabled causes command injection. The attack can be initiated remotely. The exploit has been made...