PT-2025-7834 · Unknown · Bplugins Sticky Content

Name of the Vulnerable Software and Affected Versions: bPlugins Sticky Content versions n/a through 1.0.1 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it is a Stored XSS...

CVE-2025-0545

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-Site Scripting XSS. This issue affects T-Soft E-Commerce: before v5...

PT-2025-9194

Name of the Vulnerable Software and Affected Versions TOTOLINK X18 version 9.1.0cu.2024 B20220329 Description A critical issue exists in the setMtknatCfg function within the /cgi-bin/cstecgi.cgi file of the TOTOLINK X18 device. Manipulation of the mtkhnatEnable argument can lead to operating syst...

S3Proxy 跨站脚本漏洞

S3Proxy is an S3 API from the individual developer Andrew Gaul. A cross-site scripting vulnerability exists in S3Proxy, which stems from the presence of a reflective cross-site scripting vulnerability that can lead to malicious URL injection scripts hijacking sessions...

Online Shopping Portal /shopping/track-orders.php SQL Injection Vulnerability

Online Shopping Portal is an online store. Online Shopping Portal suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in /shopping/track-orders.php. No details of the vulnerability are available at this time...

CVE-2025-23840

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in webjema WP-NOTCAPTCHA wp-notcaptcha allows Reflected XSS.This issue affects WP-NOTCAPTCHA: from n/a through = 1.3.1...

Wazifa System search_resualts.php file cross-site scripting vulnerability

Wazifa System is a content management system. Wazifa System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the firstname/lastname parameter of the searchresualts.php file, which can be exploited to execute...

CVE-2025-23650

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in razvypp Tidy.ro tidyro allows Reflected XSS.This issue affects Tidy.ro: from n/a through = 1.3...

WordPress DX-auto-publish plugin <= 1.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin DX-auto-publish versions = 1.2...

Cross-site Scripting (XSS)

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS. An attacker can bypass security measures and gain unauthorized access by exploiting this vulnerability. Details Cross-site scripting or XSS is a...

Adobe Commerce 跨站脚本漏洞

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A cross-site scripting vulnerability exists in Adobe Commerce, which can be exploited by an attacker to inject malicious script into vulnerable form...

Adobe Commerce 跨站脚本漏洞

Adobe Commerce is the United States of America Odobie Adobe company's a business and brand-oriented global leader in digital commerce solutions. A cross-site scripting vulnerability exists in Adobe Commerce, which can be exploited by an attacker to inject malicious script into vulnerable form...

cool-admin-java 跨站脚本漏洞

cool-admin-java is a backend privilege management framework for COOL individual developers. A cross-site scripting vulnerability exists in cool-admin-java v1.0. An attacker can exploit this vulnerability to execute arbitrary web script or HTML by injecting a specially crafted payload into the...

CVE-2021-4170

calibre-web is vulnerable to Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2021-4171

calibre-web is vulnerable to Business Logic Errors...

CVE-2022-41958

super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit 4d0d5966 and will be...

CVE-2022-0939

Server-Side Request Forgery SSRF in GitHub repository janeczku/calibre-web prior to 0.6.18...

CVE-2024-25597

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Etoile Web Design Ultimate Reviews allows Stored XSS.This issue affects Ultimate Reviews: from n/a through 3.2.8...

CVE-2024-54436

Cross-Site Request Forgery CSRF vulnerability in milordk Jet Footer Code jet-footer-code allows Stored XSS.This issue affects Jet Footer Code: from n/a through = 1.4...

CVE-2024-51700

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in eutrue NAVER Analytics naver-analytics allows Stored XSS.This issue affects NAVER Analytics: from n/a through = 0.9...