4033 matches found
CVE-2025-34406
MailEnable versions prior to 10.54 contain a reflected cross-site scripting XSS vulnerability in the Id parameter of /Mobile/ContactDetails.aspx. The Id value is not properly sanitized when processed via a GET request and is reflected within a block in the response. By supplying a crafted payload...
CVE-2025-34400
Summary: CVE-2025-34400 affects MailEnable versions prior to 10.54, exposing a reflected XSS in the AddressesTo parameter of /Mondo/lang/sys/Forms/AddressBook.aspx. The vulnerability stems from inadequate sanitization when the parameter is processed via GET, with the value reflected inside a [rem...
CVE-2025-63737
Cross-site scripting XSS vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbitrary web script or HTML via the m parameter to the task.php endpoint...
CVE-2025-63066
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in p-themes Porto Theme - Functionality porto-functionality allows Stored XSS.This issue affects Porto Theme - Functionality: from n/a through 3.7.3...
CVE-2025-63062 WordPress UDesign Core plugin <= 4.14.0 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AndonDesign UDesign Core u-design-core allows PHP Local File Inclusion.This issue affects UDesign Core: from n/a through = 4.14.0...
CVE-2025-67552
CVE-2025-67552 : DOM-based XSS in Walker Core (walker-core) due to improper input neutralization during web page generation. Affected version range:
CVE-2025-67529
CVE-2025-67529 is a confirmed vulnerability in the WordPress Fashion theme (Fashion2) where an improper filename check in PHP allows Remote File Inclusion, effectively enabling Local File Inclusion. Public details indicate the affected range is Fashion: from n/a through
PT-2025-50068
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in sevenspark Contact Form 7 Dynamic Text Extension contact-form-7-dynamic-text-extension allows Code Injection.This issue affects Contact Form 7 Dynamic Text Extension: from n/a through = 5.0.3...
The vulnerability of the monitoring panel of the Nagios Log Server software allows a hacker to perform cross-site scripting attacks (XSS).
The vulnerability of the monitoring panel for Nagios Log Server exists because no measures have been taken to protect the structure of the web page when viewing log records. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...
CVE-2025-14259
The CVE-2025-14259 issue affects Jihai Jshop MiniProgram Mall System 2.9.0, specifically a SQL injection in /index.php/api.html through manipulation of the cat_id parameter. The vulnerability can be exploited remotely and a public exploit exists. Several connected sources corroborate the existenc...
CVE-2025-14219
A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. The impacted element is an unknown function of the file /admin/adminrunning.php. Executing a manipulation of the argument productimage can lead to unrestricted upload. It is possible to launch the attack remotely...
The vulnerability of the usersProfiles.shtm file in the multi-platform web solution for creating Scada systems, Scada-LTS, allows a attacker to perform cross-site scripting (XSS) attacks.
The vulnerability of the usersProfiles.shtm file in the multi-platform web solution for creating Scada systems is related to the lack of protection for the website structure when processing the Username parameter. Exploiting this vulnerability allows a malicious actor to perform cross-site...
EUVD-2025-201610
A vulnerability was found in alokjaiswal Hotel-Management-services-using-MYSQL-and-php up to 5f8b60a7aa6c06a5632de569d4e3f6a8cd82f76f. Affected by this vulnerability is an unknown functionality of the file /dishsub.php. The manipulation of the argument item.name results in cross site scripting. I...
EUVD-2025-201434
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting XSS vulnerability in the /rmm/v1/devices/name/agentid endpoint. When an authenticated user renames a device, the newname value is stored and later rendered in device listings or detail views without proper...
PT-2025-49283
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting XSS vulnerability in the /rmm/v1/devices/name/agent id endpoint. When an authenticated user renames a device, the new name value is stored and later rendered in device listings or detail views without prope...
EUVD-2025-201283
Alinto Sogo 5.12.3 is vulnerable to Cross Site Scripting XSS via the theme parameter...
CVE-2025-29846
A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages...
Mini site - Moderately critical - Cross-Site Scripting - SA-CONTRIB-2025-117
This module allows uploading a zip file and extracting its content in the public file directory to serve this content from a Drupal website. These zip files may contain arbitrary HTML or SVG content that could allow cross-site scripting vulnerabilities. While this is an expected feature, the modu...
Cross-site Scripting (XSS)
Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the admin/edit endpoint. An attacker can execute arbitrary scripts in the context of the admin interface by...