CWE-79 · Cross-site Scripting (page 100)
Page 100 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32932 | Medium | 6.5 | 2025-08-12 | An Improper neutralization of input during web page generation ('cross-site scripting') vulnerability [CWE-79] in FortiSOAR version 7.6.1 and below, version 7… |
CVE-2025-49745 | Medium | 5.4 | 2025-08-12 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to… |
CVE-2025-49557 | High | 8.7 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulne… |
CVE-2025-55166 | | 2025-08-12 | savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute… | |
CVE-2025-54800 | Medium | 6.1 | 2025-08-12 | Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the… |
CVE-2025-43735 | Medium | 6.1 | 2025-08-12 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 thro… |
CVE-2025-8874 | Medium | 6.4 | 2025-08-12 | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross… |
CVE-2025-8314 | Medium | 6.4 | 2025-08-12 | The Software Issue Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg parameter in all versions up to, and includi… |
CVE-2025-8690 | Medium | 6.4 | 2025-08-12 | The Simple Responsive Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0 due to insufficient in… |
CVE-2025-8688 | Medium | 6.4 | 2025-08-12 | The Inline Stock Quotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's stock shortcode in all versions up to, and including… |
CVE-2025-8685 | Medium | 6.4 | 2025-08-12 | The Wp chart generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpchart shortcode in all versions up to, and includin… |
CVE-2025-8568 | Medium | 6.4 | 2025-08-12 | The GMap Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘h’ parameter in all versions up to, and including, 1.1 due to ins… |
CVE-2025-8462 | Medium | 6.4 | 2025-08-12 | The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the social URL parameter in all versi… |
CVE-2025-42975 | Medium | 6.1 | 2025-08-12 | SAP NetWeaver Application Server ABAP (BIC Document) allows an unauthenticated attacker to craft a URL link which, when accessed on the BIC Document applicatio… |
CVE-2025-42948 | Medium | 6.1 | 2025-08-12 | Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publi… |
CVE-2025-42942 | Medium | 6.1 | 2025-08-12 | SAP NetWeaver Application Server for ABAP has cross-site scripting vulnerability. Due to this, an unauthenticated attacker could craft a URL embedded with mali… |
CVE-2025-8847 | Low | 3.5 | 2025-08-11 | A vulnerability was found in yangzongzhuan RuoYi up to 4.8.1. Affected by this vulnerability is the function Edit of the file /system/notice/edit. The manipula… |
CVE-2025-8661 | Medium | 6.1 | 2025-08-11 | A stored Cross-Site Scripting vulnerability (XSS) occurs when the server does not properly validate or encode the data entered by the user. |
CVE-2025-8834 | Low | 2.4 | 2025-08-11 | A vulnerability has been found in JCG Link-net LW-N915R 17s.20.001.908. Affected is an unknown function of the file /wireless/basic.asp of the component Wirele… |
CVE-2025-8812 | Low | 2.4 | 2025-08-10 | A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /api/settings of the compo… |
CVE-2025-8798 | High | 7.3 | 2025-08-10 | A vulnerability was found in oitcode samarium up to 0.9.6. It has been classified as critical. Affected is an unknown function of the file /dashboard/product o… |
CVE-2025-8788 | Low | 3.5 | 2025-08-10 | A vulnerability was found in Portabilis i-Diario up to 1.5.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /p… |
CVE-2025-8787 | Low | 3.5 | 2025-08-10 | A vulnerability has been found in Portabilis i-Diario up to 1.5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-8786 | Low | 3.5 | 2025-08-10 | A vulnerability, which was classified as problematic, was found in Portabilis i-Diario up to 1.5.0. Affected is an unknown function of the file /registros-de-c… |
CVE-2025-8785 | Low | 3.5 | 2025-08-10 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar up to 2.9. This issue affects some unknown processing of the file /… |
CVE-2025-8784 | Low | 3.5 | 2025-08-09 | A vulnerability classified as problematic was found in Portabilis i-Educar up to 2.9. This vulnerability affects unknown code of the file /intranet/funcionario… |
CVE-2025-8765 | Low | 3.5 | 2025-08-09 | A vulnerability classified as problematic was found in Datacom DM955 5GT 1200 825.8010.00. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2025-7726 | Medium | 6.4 | 2025-08-09 | The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to i… |
CVE-2025-8751 | Low | 3.1 | 2025-08-09 | A vulnerability was found in Protected Total WebShield Extension up to 3.2.0 on Chrome. It has been classified as problematic. This affects an unknown part of… |
CVE-2025-8750 | Low | 2.4 | 2025-08-09 | A vulnerability has been found in macrozheng mall up to 1.0.3 and classified as problematic. Affected by this vulnerability is the function Upload of the file… |
CVE-2025-8743 | Low | 3.5 | 2025-08-08 | A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. This affects an unknown part of the file /data_source_edit.shtm of the com… |
CVE-2025-8740 | Low | 2.4 | 2025-08-08 | A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0. It has been classified as problematic. Affected is an unknown function of the file /admin/categori… |
CVE-2025-50927 | Medium | 6.3 | 2025-08-08 | A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to execute arbitrary J… |
CVE-2025-4576 | Medium | 6.1 | 2025-08-08 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 thro… |
CVE-2020-9322 | High | 8.8 | 2025-08-08 | The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScri… |
CVE-2025-51629 | High | 8.8 | 2025-08-07 | A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or H… |
CVE-2023-41529 | Medium | 6.1 | 2025-08-07 | Hospital Management System v4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities in func2.php via the fname and lname parameters. |
CVE-2023-41519 | Medium | 6.1 | 2025-08-07 | Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter at createSessionTerm… |
CVE-2025-54395 | Medium | 6.1 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication configuration data. |
CVE-2025-54392 | Medium | 6.1 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data, a different vulnerability than CVE… |
CVE-2025-55134 | Medium | 6.4 | 2025-08-07 | In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js. |
CVE-2025-55133 | Medium | 6.4 | 2025-08-07 | In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js. |
CVE-2024-52680 | Medium | 6.1 | 2025-08-07 | EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. |
CVE-2025-8581 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-8580 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-8579 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-8577 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-54784 | Medium | 6.1 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability i… |
CVE-2025-54783 | Medium | 6.1 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site… |
CVE-2025-51053 | Medium | 6.1 | 2025-08-06 | A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and… |
CVE-2025-50740 | Medium | 6.1 | 2025-08-06 | AutoConnect 1.4.2, an Arduino library, is vulnerable to a cross site scripting (xss) vulnerability. The AutoConnect web interface /_ac/config allows HTML/JS co… |
CVE-2025-51624 | High | 7.6 | 2025-08-06 | Cross-site scripting (XSS) vulnerability in Zone Bitaqati thru 3.4.0. |
CVE-2025-51531 | Medium | 6.1 | 2025-08-06 | A reflected cross-site scripting (XSS) vulnerability in Sage DPW 2024_12_004 and earlier allows attackers to execute arbitrary JavaScript in the context of a v… |
CVE-2025-7727 | Medium | 6.4 | 2025-08-06 | The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and… |
CVE-2025-8100 | Medium | 5.4 | 2025-08-06 | The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in version… |
CVE-2025-7498 | Medium | 6.4 | 2025-08-06 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all versions up to, and includ… |
CVE-2025-7399 | Medium | 6.4 | 2025-08-06 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due… |
CVE-2025-7502 | Medium | 6.4 | 2025-08-06 | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all versions up to, and inc… |
CVE-2025-6690 | Medium | 6.4 | 2025-08-06 | The WP Tournament Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘field’ parameter in all versions up to, and including… |
CVE-2025-6259 | Medium | 6.4 | 2025-08-06 | The esri-map-view plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's esri-map-view shortcode in all versions up to, and includi… |
CVE-2025-6256 | Medium | 6.4 | 2025-08-06 | The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including… |
CVE-2025-54571 | Medium | 6.1 | 2025-08-06 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can ov… |
CVE-2025-32430 | Medium | 6.1 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-… |
CVE-2025-8573 | Medium | 4.8 | 2025-08-05 | Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could… |
CVE-2025-8571 | Medium | 4.8 | 2025-08-05 | Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitiz… |
CVE-2025-51541 | Medium | 6.1 | 2025-08-05 | A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The c_database_… |
CVE-2025-50592 | Medium | 5.4 | 2025-08-05 | Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player. |
CVE-2012-10032 | | 2025-08-05 | Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page. The browser’s trusted zone improperly h… | |
CVE-2025-51857 | Medium | 6.1 | 2025-08-05 | The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks. |
CVE-2025-46958 | Medium | 5.4 | 2025-08-05 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-8555 | Low | 3.5 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. Affected is an unknown function of the file /search. The manipulati… |
CVE-2025-8554 | Low | 2.4 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0. This issue affects some unknown processing of the file /admin/… |
CVE-2025-8553 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0. This vulnerability affects unknown code of the file /admin/sensitive_word/list… |
CVE-2025-8552 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic has been found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /admin/tag/list. The manipulation… |
CVE-2025-8551 | Low | 3.5 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin… |
CVE-2025-8295 | Medium | 6.4 | 2025-08-05 | The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including… |
CVE-2025-8294 | Medium | 6.4 | 2025-08-05 | The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due t… |
CVE-2025-8550 | Low | 2.4 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-8315 | Medium | 6.4 | 2025-08-05 | The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4… |
CVE-2025-8313 | Medium | 6.4 | 2025-08-05 | The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1… |
CVE-2025-7050 | High | 7.2 | 2025-08-05 | The Use-your-Drive | Google Drive plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in file meta… |
CVE-2025-8545 | Low | 2.4 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the f… |
CVE-2025-8544 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic was found in Portabilis i-Educar 2.10. Affected by this vulnerability is an unknown functionality of the file /module… |
CVE-2025-8543 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php… |
CVE-2025-8542 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empre… |
CVE-2025-8541 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/publi… |
CVE-2025-8540 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municip… |
CVE-2025-8539 | Low | 2.4 | 2025-08-05 | A weakness has been identified in Portabilis i-Educar 2.10. This affects an unknown function of the file /intranet/public_distrito_cad.php. This manipulation o… |
CVE-2025-8538 | Low | 2.4 | 2025-08-05 | A security flaw has been discovered in Portabilis i-Educar 2.10. The impacted element is an unknown function of the file /usuarios/tipos/novo. The manipulation… |
CVE-2025-8535 | Low | 3.5 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in cronoh NanoVault up to 1.2.1. This issue affects the function executeJavaScript of the… |
CVE-2025-4604 | Medium | 6.1 | 2025-08-04 | The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through… |
CVE-2025-4599 | Medium | 6.1 | 2025-08-04 | The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 202… |
CVE-2025-50754 | Critical | 9.6 | 2025-08-04 | Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality. A malicious script submitted by an attacker i… |
CVE-2025-8521 | Low | 2.4 | 2025-08-04 | A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5. This issue affects some unknown processing of the file /vadmi… |
CVE-2025-51534 | High | 8.1 | 2025-08-04 | A cross-site scripting (XSS) vulnerability in Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2025-26065 | High | 7.3 | 2025-08-04 | A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injectin… |
CVE-2025-36605 | Medium | 6.1 | 2025-08-04 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the C… |
CVE-2025-8511 | Low | 3.5 | 2025-08-03 | A vulnerability classified as problematic was found in Portabilis i-Diario 1.5.0. This vulnerability affects unknown code of the file /diario-de-observacoes/ o… |
CVE-2025-8510 | Low | 3.5 | 2025-08-03 | A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matri… |
CVE-2025-8509 | Low | 3.5 | 2025-08-03 | A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intra… |