PT-2025-54324

Name of the Vulnerable Software and Affected Versions zookatron MyBookTable Bookstore versions through 3.5.5 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a potential Cross-site Scripting XSS issue. Specifically, this...

CVE-2025-68868

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in codeaffairs Wp Text Slider Widget wp-text-slider-widget allows Stored XSS.This issue affects Wp Text Slider Widget: from n/a through = 1.0...

CVE-2025-69088

CVE-2025-69088 affects the Combo Offers WooCommerce plugin (

CVE-2025-15219 SohuTV CacheCloud MachineManageController.java doPodList cross site scripting

A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doMachineList/doPodList of the file src/main/java/com/sohu/cache/web/controller/MachineManageController.java. The manipulation leads to cross site scripting. The attack may be...

CVE-2025-15211

A flaw has been found in code-projects Refugee Food Management System 1.0. Impacted is an unknown function of the file /home/refugee.php. Executing manipulation of the argument refNo/Fname/Lname/sex/age/contact/nationalitynid can lead to sql injection. The attack can be executed remotely. The...

CVE-2025-23554

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jakub Glos Off Page SEO off-page-seo allows Reflected XSS.This issue affects Off Page SEO: from n/a through = 3.0.3...

PT-2025-54196

CVE-2025-66094 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Yada Wiki yada-wiki allows Stored XSS.This issue affects Yada Wi… https://t.co/T4HkGF9Afd...

CacheCloud 代码注入漏洞

CacheCloud is a Redis cloud management platform open-sourced by SohuTV. A code injection vulnerability exists in CacheCloud 3.2.0 and earlier versions, which stems from an incorrect operation of the function index in the file...

CVE-2025-55060 Priority - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

CWE-601 URL Redirection to Untrusted Site 'Open Redirect'...

CVE-2025-15144

A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. The impacted element is the function drshowerror/drexitmsg of the file /dayrui/Fcms/Init.php of the component JSONP Callback Handler. This manipulation of the argument callback causes cross site scripting. The attack can be initiated...

EUVD-2025-205583

Reflected Cross site scripting xss in machsol machpanel 8.0.32 allows attackers to execute arbitrary web scripts or HTML via a crafted PDF file...

CVE-2025-69200 phpMyFAQ has unauthenticated config backup download via /api/setup/backup

phpMyFAQ is an open source FAQ web application. In versions prior to 4.0.16, an unauthenticated remote attacker can trigger generation of a configuration backup ZIP via POST /api/setup/backup and then download the generated ZIP from a web-accessible location. The ZIP contains sensitive...

Security Bulletin: Vulnerability in validator.js affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.

Summary Potential vulnerability in validator.js has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...

CVE-2025-15228 WELLTEND TECHNOLOGY｜ BPMFlowWebkit - Arbitrary File Upload

BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server...

CVE-2025-15169

A weakness has been identified in BiggiDroid Simple PHP CMS 1.0. Affected by this issue is some unknown functionality of the file /admin/editsite.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made availabl...

The vulnerability of the HTTP request handler in the microprogramming-based router software Tenda WH450 allows for the execution of arbitrary code.

The vulnerability of the HTTP request handler in the microprogramming-based router software Tenda WH450 lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted GET request...

The vulnerability of the Reports module of the monitoring, analysis, and reporting software ManageEngine Exchange Reporter Plus allows a perpetrator to perform cross-site scripting attacks.

The vulnerability of the Reports module in the ManageEngine Exchange Reporter Plus software monitoring, analysis, and reporting tool exists due to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...

ROS-20251226-7303

A vulnerability in the twisted.web.util.redirectTo function of the Twisted networking framework is related to the failure to take measures to protect the structure of a web page. Exploitation of the vulnerability could allow a remote attacker to gain access to sensitive data and compromise its...

CVE-2025-68506

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Nawawi Jamili Docket Cache docket-cache allows PHP Local File Inclusion.This issue affects Docket Cache: from n/a through = 24.07.03...

Student File Management System Cross-Site Scripting Vulnerability

Student File Management System is a student file management system. Student File Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the file /admin/updatestudent.php, which can be exploited by a...