CVE-2025-53854

A reflected cross-site scripting xss vulnerability exists in the modifyHL7Route functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability...

CVE-2025-55303

creationtimestamp| type| source ---|---|--- 2026-01-20 09:24:06+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-55303.yaml 2026-01-23 21:03:04+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3md4lxprv5v2k 2026-02-13...

MedDream PACS Premium modifyHL7Route reflected cross-site scripting (XSS) vulnerability

Talos Vulnerability Report TALOS-2025-2265 MedDream PACS Premium modifyHL7Route reflected cross-site scripting XSS vulnerability January 20, 2026 CVE Number CVE-2025-53854 SUMMARY A reflected cross-site scripting xss vulnerability exists in the modifyHL7Route functionality of MedDream PACS Premiu...

CVE-2026-1177

A weakness has been identified in Yonyou KSOA 9.0. Affected by this vulnerability is an unknown functionality of the file /kmf/savefolder.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument folderid can lead to sql injection. It is possible to launch the atta...

TOTOLINK LR350 Command Injection Vulnerability

TOTOLINK LR350 is a wireless router produced by TOTOLINK Corporation. The TOTOLINK LR350 9.3.5u.6369B20220309 version has a command injection vulnerability. This vulnerability stems from incorrect handling of the parameter “ip” in the file /cgi-bin/cstecgi.cgi, which may lead to command injection...

CVE-2026-23525

CVE-2026-23525 affects 1Panel, a web-based Linux server management panel. The stored XSS vulnerability originates from insufficient sanitization in the MdEditor component (previewOnly) used to render App Store and related content, allowing malicious scripts to run in the user’s browser and potent...

CVE-2026-1119 itsourcecode Society Management System delete_activity.php sql injection

A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/deleteactivity.php. Executing a manipulation of the argument activityid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-1048 LigeroSmart index.pl cross site scripting

A weakness has been identified in LigeroSmart up to 6.1.26. Impacted is an unknown function of the file /otrs/index.pl?Action=AgentTicketZoom. This manipulation of the argument TicketID causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made availabl...

FeMiner WMS SQL injection vulnerability

FeMiner wms is a repository management system developed by FeMiner’s individual developers in China. FeMiner wms has a SQL injection vulnerability, which stems from incorrect handling of the parameter “Username” in the file /src/chkuser.php. This vulnerability may lead to SQL injection attacks...

CVE-2021-47841

CVE-2021-47841 affects SnipCommand 0.1.0. The issue is a cross-site scripting vulnerability in command snippets that allows an attacker to inject malicious payloads and execute arbitrary code by embedding JavaScript that triggers remote command execution via file or title inputs. Sources across N...

EUVD-2026-2919

Nu Html Checker validator.nu contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost services. While the validator implements hostname-based protections to block direct access to localhost and...

CVE-2026-20894

Cross-site scripting vulnerability exists in multiple Network Cameras TRIFORA 3 series provided by TOA Corporation. If an attacking administrator configures the affected product with some malicious input, an arbitrary script may be executed on the web browser of a victim administrator who accesse...

CVE-2025-14556

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Drupal Flag allows Cross-Site Scripting XSS.This issue affects Flag: from 7.X-3.0 through 7.X-3.9...

EUVD-2026-2857

LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting XSS vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacke...

CVE-2025-70890

A stored cross-site scripting XSS vulnerability exists in Cyber Cafe Management System v1.0. An authenticated attacker can inject arbitrary JavaScript code into the username parameter via the add-users.php endpoint. The injected payload is stored and executed in the victim s browser when the...

Typesetter CMS 跨站脚本漏洞

Typesetter CMS is a content management system from Typesetter open source. A cross-site scripting vulnerability exists in Typesetter CMS 5.1 and earlier versions, which stems from insufficient cleanup and escaping of the images parameter and could lead to a reflective cross-site scripting attack...

CVE-2022-50891

Owlfiles File Manager 12.0.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the path parameter in HTTP server endpoints. Attackers can craft URLs targeting the download and list endpoints with embedded script tags to execute arbitrary...

CVE-2021-41074

A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML document...

CVE-2026-0850

The CVE-2026-0850 entry applies to the Intern Membership Management System 1.0. The vulnerability affects the /admin/delete_activity.php function where manipulating the activity_id parameter can induce an SQL injection. It is described as exploitable remotely and the exploit has been publicly dis...

CVE-2025-68874

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Shahjada Visitor Stats Widget visitor-stats-widget allows Reflected XSS.This issue affects Visitor Stats Widget: from n/a through = 1.5.0...