CVE-2025-0833

A stored Cross-site Scripting XSS vulnerability affecting Route Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session...

Code-Projects Online Exam Mastering System 安全漏洞

Code-Projects Online Exam Mastering System is a Code-Projects open source online exam system. A security vulnerability exists in Code-Projects Online Exam Mastering System v1.0, which stems from an incorrect manipulation of the parameter fid that can lead to SQL injection...

CVE-2024-26006

An improper neutralization of input during web page Generation vulnerability CWE-79 in FortiOS version 7.4.3 and below, version 7.2.7 and below, version 7.0.13 and below and FortiProxy version 7.4.3 and below, version 7.2.9 and below, version 7.0.16 and below web SSL VPN UI may allow a remote...

CVE-2024-26006

Fortinet FortiOS/FortiProxy vulnerability CVE-2024-26006 is an improper neutralization of input during web page generation (CWE-79) that enables a remote unauthenticated attacker to perform Cross-Site Scripting via a malicious Samba server. Affected: FortiOS <= 7.4.3, <= 7.2.7, <= 7.0.13...

Online Class and Exam Scheduling System profile.php file cross-site scripting vulnerability

Online Class and Exam Scheduling System is an online class and exam scheduling system. Online Class and Exam Scheduling System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter username in the file...

Zimbra Collaboration Server 安全漏洞

Zimbra Collaboration Server ZCS is an email and collaboration solution from Zimbra. The solution provides email, contacts, calendaring, file sharing, social networking, and other features. A security vulnerability exists in Zimbra Collaboration Server versions 9.0, 10.0, and 10.1, which stems fro...

CVE-2025-2210

A vulnerability has been found in aitangbao springboot-manager 3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /sysJob/add. The manipulation of the argument name leads to cross site scripting. The attack can be launched remotely. The explo...

MRCMS 代码注入漏洞

MRCMS is a content management system. A cross-site scripting vulnerability exists in MRCMS, which stems from insufficient filtering of operations on parameter names/paths, allowing an attacker to inject malicious scripts. The vulnerability can be exploited to inject malicious scripts, which will ...

Celk Sistemas Celk Saude 跨站脚本漏洞

Celk Sistemas Celk Saude is a health sector management software from Celk Sistemas, Brazil. A cross-site scripting vulnerability exists in Celk Sistemas Celk Saude version v.3.1.252.1, which originates from stored cross-site scripting and could lead to a remote attacker storing JavaScript code in...

Unauthorized Account Takeover

oxidized-web is vulnerable to Unauthorized Account takeover. The vulnerability is due to missing authentication in the RANCID migration page, allowing an unauthenticated user to gain control over the Linux user account running oxidized-web...

The vulnerability of the ArcGIS Server server, related to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks.

The vulnerability of ArcGIS Server is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CZS CMS 1.3.0 Cross Site Request Forgery

CZS CMS version 1.3.0 suffers from a cross site request forgery vulnerability. Exploit Title: CZS CMS 1.3.0 - Cross Site Request Forgery CSRF Add Admin Date: 2024-05-03 Exploit Author: Ahmet Ümit BAYRAM Vendor Homepage: https://www.cszcms.com Software Link:...

Vasion Print 跨站脚本漏洞

Vasion Print is a SaaS-based, cloud-hosted application from Vasion for managing and deploying printers. A security vulnerability exists in Vasion Print. An attacker could execute a cross-site scripting attack by exploiting the vulnerability...

Esri ArcGIS Server 跨站脚本漏洞

Esri ArcGIS Server is Esri's Web-oriented enterprise software platform for providing geolocation services. A cross-site scripting vulnerability exists in Esri ArcGIS Server versions 10.9.1 through 11.3, which can be exploited by an attacker to create a specially crafted link that, when clicked, m...

TRENDnet TEW-929DRU 安全漏洞

The TRENDnet TEW-929DRU is a wireless router from TRENDnet. The TRENDnet TEW-929DRU version 1.0.0.10 suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the rname variable within the havesamename function on...

CVE-2025-27304

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themelogger Contact Form 7 Star Rating with font Awesome contact-form-7-star-rating-with-font-awersome allows Stored XSS.This issue affects Contact Form 7 Star Rating with font Awesome: from n/a...

SeaCMS 安全漏洞

SeaCMS is a free, open source web content management system written in PHP by SeaCMS, Inc. The system is primarily designed to manage video-on-demand resources. A security vulnerability exists in SeaCMS v13.3, which stems from a Remote Code Execution RCE issue in the component admintemplate.php...

PT-2025-7834 · Unknown · Bplugins Sticky Content

Name of the Vulnerable Software and Affected Versions: bPlugins Sticky Content versions n/a through 1.0.1 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it is a Stored XSS...

CVE-2025-0545

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-Site Scripting XSS. This issue affects T-Soft E-Commerce: before v5...

PT-2025-9194

Name of the Vulnerable Software and Affected Versions TOTOLINK X18 version 9.1.0cu.2024 B20220329 Description A critical issue exists in the setMtknatCfg function within the /cgi-bin/cstecgi.cgi file of the TOTOLINK X18 device. Manipulation of the mtkhnatEnable argument can lead to operating syst...