CWE-79 · Cross-site Scripting (page 70)
Page 70 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59982 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59981 | Medium | 6.1 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to inj… |
CVE-2025-59978 | Critical | 9.0 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Juniper Networks Junos Space allows an attacker to sto… |
CVE-2025-61532 | Medium | 6.1 | 2025-10-09 | Cross Site Scripting vulnerability in SVX Portal v.2.7A to execute arbitrary code via the TG parameter on last_heard_page.php component |
CVE-2025-60302 | Medium | 6.1 | 2025-10-09 | code-projects Client Details System 1.0 is vulnerable to Cross Site Scripting (XSS). When adding customer information, the client details system fills in malic… |
CVE-2025-59974 | High | 8.4 | 2025-10-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Junos Space Security Director allows an attacker to in… |
CVE-2025-56683 | Critical | 9.6 | 2025-10-09 | A cross-site scripting (XSS) vulnerability in the component /app/marketplace.html of Logseq v0.10.9 allows attackers to execute arbitrary code via injecting ar… |
CVE-2025-10240 | High | 8.8 | 2025-10-09 | A vulnerability exists in the Progress Flowmon web application prior to version 12.5.5, whereby a user who clicks a malicious link provided by an attacker may… |
CVE-2025-9371 | Medium | 6.4 | 2025-10-09 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_title’ parameter in all versions up to, and including, 28.1.6 due to… |
CVE-2025-11512 | Medium | 4.3 | 2025-10-09 | A vulnerability was found in code-projects Voting System 1.0. Affected by this issue is some unknown functionality of the file /admin/voters_add.php. The manip… |
CVE-2025-61788 | Medium | 5.4 | 2025-10-08 | Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, the paella would in… |
CVE-2025-11485 | Low | 2.4 | 2025-10-08 | A vulnerability was determined in SourceCodester Student Grades Management System 1.0. Affected is the function add_user of the file /admin.php of the componen… |
CVE-2025-60318 | Medium | 6.1 | 2025-10-08 | SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the fname (First Name) and lname (Las… |
CVE-2025-60313 | Medium | 6.1 | 2025-10-08 | Sourcecodester Link Status Checker 1.0 is vulnerable to a Cross-Site Scripting (XSS) in the Enter URLs to check input field. This allows a remote attacker to e… |
CVE-2025-43771 | Medium | 5.4 | 2025-10-08 | Multiple cross-site scripting (XSS) vulnerabilities in the Notifications widget in Liferay Portal 7.4.3.102 through 7.4.3.111, and Liferay DXP 2023.Q4.0 throug… |
CVE-2025-61183 | Medium | 6.1 | 2025-10-08 | Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php |
CVE-2025-60314 | Medium | 5.4 | 2025-10-08 | Configuroweb Sistema Web de Inventario 1.0 is vulnerable to a Stored Cross-Site Scripting (XSS) due to the lack of input sanitization on the product name param… |
CVE-2025-43830 | Medium | 6.1 | 2025-10-08 | Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 thro… |
CVE-2025-43829 | Medium | 5.4 | 2025-10-08 | Stored cross-site scripting (XSS) vulnerability in diagram type products in Commerce in Liferay Portal 7.4.3.18 through 7.4.3.111, and Liferay DXP 2023.Q4.0 th… |
CVE-2025-60299 | Medium | 5.4 | 2025-10-08 | Novel-Plus with 5.2.0 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /book/addCommentReply endpoint. An authenticated user… |
CVE-2025-60298 | Medium | 5.4 | 2025-10-08 | Novel-Plus up to 5.2.4 was discovered to contain a Stored Cross-Site Scripting (XSS) vulnerability via the /author/updateIndexName endpoint. This vulnerability… |
CVE-2025-43821 | Medium | 5.4 | 2025-10-08 | Cross-site scripting (XSS) vulnerability in the Commerce Product Comparison Table widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0 t… |
CVE-2025-11437 | Low | 2.4 | 2025-10-08 | A flaw has been found in JhumanJ OpnForm up to 1.9.3. This affects an unknown part of the file /api/open/forms/ of the component Form Editor. This manipulation… |
CVE-2025-11435 | Medium | 4.3 | 2025-10-08 | A security vulnerability has been detected in JhumanJ OpnForm up to 1.9.3. Affected by this vulnerability is an unknown functionality of the file /show/submiss… |
CVE-2025-11433 | Low | 3.5 | 2025-10-08 | A security flaw has been discovered in itsourcecode Leave Management System 1.0. This impacts the function redirect of the file /module/employee/controller.php… |
CVE-2025-11425 | Low | 2.4 | 2025-10-08 | A vulnerability was identified in projectworlds Advanced Library Management System 1.0. Affected is an unknown function of the file /edit_admin.php. The manipu… |
CVE-2025-11421 | Low | 3.5 | 2025-10-08 | A flaw has been found in code-projects Voting System 1.0. The affected element is an unknown function of the file /admin/candidates_edit.php. This manipulation… |
CVE-2025-61999 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to upload JavaScript or other content embedded in an SVG image used as a logo. Injected conten… |
CVE-2025-61998 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content as a URL within the Technical Support Hyperlink Manager… |
CVE-2025-61997 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Enterprise Banner image upload… |
CVE-2025-61996 | Medium | 4.3 | 2025-10-08 | OPEXUS FOIAXpress before 11.13.3.0 allows an administrative user to inject JavaScript or other content within the Annual Report Template. Injected content is e… |
CVE-2025-43822 | Medium | 5.4 | 2025-10-07 | Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.15 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1… |
CVE-2025-43823 | Medium | 5.4 | 2025-10-07 | Cross-site scripting (XSS) vulnerability in the Commerce Search Result widget in Liferay Portal 7.4.0 through 7.4.3.111, and Liferay DXP 2023.Q4 before patch 6… |
CVE-2025-3448 | Medium | 6.1 | 2025-10-07 | Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enables a rem… |
CVE-2025-1826 | Medium | 5.4 | 2025-10-07 | IBM Engineering Requirements Management DOORS Next (IBM Jazz Foundation 7.0.2 to 7.0.2 iFix034, 7.0.3 to 7.0.3 iFix016, and 7.1.0 to 7.1.0 iFix004) is vulnerab… |
CVE-2025-56243 | Medium | 6.1 | 2025-10-07 | A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the event_id GET parameter i… |
CVE-2025-60312 | Medium | 6.1 | 2025-10-07 | Sourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting (XSS) in the "Markdown Input" field, allowing a remote attacker to injec… |
CVE-2025-25009 | High | 8.7 | 2025-10-07 | Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload. |
CVE-2021-22291 | High | 8.0 | 2025-10-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ABB EIBPORT V3 KNX, ABB EIBPORT V3 KNX GSM.This is… |
CVE-2025-40649 | | 2025-10-07 | Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infrastructure (BBMRI-ERIC), consisting of a… | |
CVE-2025-11390 | Medium | 4.3 | 2025-10-07 | A weakness has been identified in PHPGurukul Cyber Cafe Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /search.p… |
CVE-2025-11360 | Medium | 4.3 | 2025-10-07 | A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component AP… |
CVE-2025-7400 | Medium | 6.4 | 2025-10-07 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions… |
CVE-2025-43824 | Medium | 5.4 | 2025-10-06 | The Profile widget in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 20… |
CVE-2025-56382 | Medium | 6.1 | 2025-10-06 | A stored Cross-site scripting (XSS) vulnerability exists in the Customer Management Module of LionCoders SalePro POS 5.4.8. An authenticated attacker can injec… |
CVE-2025-61769 | Medium | 6.1 | 2025-10-06 | Emlog is an open source website building system. A cross-site scripting (XSS) vulnerability in emlog up to and including version 2.5.22 allows authenticated re… |
CVE-2025-60967 | High | 7.3 | 2025-10-06 | Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensit… |
CVE-2025-60961 | Medium | 6.1 | 2025-10-06 | Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensit… |
CVE-2025-60958 | High | 7.3 | 2025-10-06 | Cross Site Scripting (XSS) vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0071-000 Ver 4.00 allows attackers to gain sensit… |
CVE-2025-61224 | Medium | 6.5 | 2025-10-06 | Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q parameter |
CVE-2025-61198 | Medium | 5.4 | 2025-10-06 | A stored cross-site scripting (XSS) vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod version 1.0.0.33 -… |
CVE-2025-11333 | Low | 2.4 | 2025-10-06 | A vulnerability was identified in langleyfcu Online Banking System up to 57437e6400ce0ae240e692c24e6346b8d0c17d7a. This impacts an unknown function of the file… |
CVE-2025-11332 | Low | 3.5 | 2025-10-06 | A vulnerability was determined in CmsEasy up to 7.7.7. This affects an unknown function in the library lib/inc/view.php of the component URL Handler. Executing… |
CVE-2025-0609 | Medium | 4.7 | 2025-10-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Logo Software Inc. Logo Cloud allows Cross-Site Sc… |
CVE-2025-9913 | Medium | 4.5 | 2025-10-06 | JavaScript can be ran inside the address bar via the dashboard "Open in new Tab" Button, making the application vulnerable to session hijacking. |
CVE-2025-50538 | High | 8.2 | 2025-10-06 | Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log. |
CVE-2025-29192 | High | 8.2 | 2025-10-06 | Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log. |
CVE-2025-11308 | Low | 3.5 | 2025-10-05 | A vulnerability was identified in Vanderlande Baggage 360 7.0.0. This issue affects some unknown processing of the file /api-addons/v1/messages. Such manipulat… |
CVE-2025-11306 | Medium | 4.3 | 2025-10-05 | A vulnerability was found in qianfox FoxCMS up to 1.2. This affects an unknown part of the file /index.php/Search of the component Search Page. The manipulatio… |
CVE-2025-11291 | Medium | 4.3 | 2025-10-05 | A security flaw has been discovered in ixmaps website2017 up to 0c71cffa0162186bc057a76766bc97e9f5a3a2d0. This impacts an unknown function of the file /map.php… |
CVE-2025-11289 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. The impacted element is the function Save of the file src/… |
CVE-2025-11283 | Low | 2.4 | 2025-10-05 | A vulnerability was determined in Frappe LMS 2.35.0. This affects an unknown function of the component Course Handler. Executing manipulation of the argument D… |
CVE-2025-11282 | Low | 2.4 | 2025-10-05 | A vulnerability was found in Frappe LMS 2.34.x/2.35.0. The impacted element is an unknown function of the component Incomplete Fix CVE-2025-55006. Performing a… |
CVE-2025-11278 | Medium | 4.3 | 2025-10-05 | A security vulnerability has been detected in AllStarLink Supermon up to 6.2. This vulnerability affects unknown code of the component AllMon2. The manipulatio… |
CVE-2025-11276 | Low | 3.5 | 2025-10-05 | A security flaw has been discovered in Rebuild up to 4.1.3. Affected by this issue is some unknown functionality of the component Comment/Guestbook. Performing… |
CVE-2025-9952 | Medium | 6.1 | 2025-10-04 | The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '… |
CVE-2025-10383 | Medium | 6.4 | 2025-10-04 | The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field para… |
CVE-2025-9030 | Medium | 5.4 | 2025-10-04 | The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_label' and 'after_label' parameters in versio… |
CVE-2025-8726 | Medium | 5.4 | 2025-10-04 | The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input s… |
CVE-2025-61681 | Medium | 5.4 | 2025-10-03 | KUNO CMS is a fully deployable full-stack blog application. Versions 1.3.13 and below contain validation flaws in its file upload functionality that can be exp… |
CVE-2025-53354 | Medium | 6.1 | 2025-10-03 | NiceGUI is a Python-based UI framework. Versions 2.24.2 and below are at risk for Cross-Site Scripting (XSS) when developers render unescaped user input into t… |
CVE-2025-52653 | High | 7.6 | 2025-10-03 | HCL MyXalytics product is affected by Cross Site Scripting vulnerability in the web application. This can allow the execution of unauthorized scripts, potentia… |
CVE-2021-42193 | Medium | 6.1 | 2025-10-03 | nopCommerce 4.40.3 is vulnerable to XSS in the Product Name at /Admin/Product/Edit/[id]. Each time a user views the product in the shop, the XSS payload fires. |
CVE-2025-60454 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the image management module, spec… |
CVE-2025-60453 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the column management module, spe… |
CVE-2025-60452 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists in the download management module, s… |
CVE-2025-60451 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and s… |
CVE-2025-60450 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and s… |
CVE-2025-60448 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file… |
CVE-2025-60447 | Medium | 5.9 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists in the email template configuration compone… |
CVE-2025-60445 | Medium | 6.1 | 2025-10-03 | A stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1. The vulnerability exists due to insufficient validation of SV… |
CVE-2025-9876 | Medium | 6.4 | 2025-10-03 | The Ird Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irdslider' shortcode in all versions up to, and including, 1… |
CVE-2025-9875 | Medium | 6.4 | 2025-10-03 | The Event Tickets, RSVPs, Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ticket_spot' shortcode in all versions u… |
CVE-2025-9859 | Medium | 6.4 | 2025-10-03 | The Fintelligence Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fintelligence-calculator' shortcode in all ver… |
CVE-2025-9858 | Medium | 6.4 | 2025-10-03 | The Auto Bulb Finder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'abf_vehicle' shortcode in all versions u… |
CVE-2025-9854 | Medium | 6.4 | 2025-10-03 | The A Simple Multilanguage Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'asmp-switcher' shortcode in all versions… |
CVE-2025-9372 | Medium | 5.5 | 2025-10-03 | The Ultimate Multi Design Video Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.4 due to ins… |
CVE-2025-9333 | Medium | 5.5 | 2025-10-03 | The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insuffic… |
CVE-2025-9332 | Medium | 5.5 | 2025-10-03 | The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up… |
CVE-2025-9206 | Medium | 6.4 | 2025-10-03 | The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This… |
CVE-2025-9204 | Medium | 6.4 | 2025-10-03 | The X Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Youtube Video ID field in all versions up to, and includin… |
CVE-2025-9130 | Medium | 6.4 | 2025-10-03 | The Unify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's unify_checkout shortcode in all versions up to, and… |
CVE-2025-9129 | Medium | 6.4 | 2025-10-03 | The Flexi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin for WordPress's flexi-form-tag shortcode in all versions up to, and… |
CVE-2025-9080 | Medium | 6.4 | 2025-10-03 | The Generic Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget fields in version 1.2.8 and earlier. This is due to… |
CVE-2025-9077 | Medium | 6.4 | 2025-10-03 | The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Animated Text' field of the Typeout Widget in ve… |
CVE-2025-9045 | Medium | 6.4 | 2025-10-03 | The Easy Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widget parameters in versions less than, or equal to, 2… |
CVE-2025-8776 | Medium | 6.4 | 2025-10-03 | The Epic Bootstrap Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘icol’ parameter in all versions up to, and including, 1.0… |
CVE-2025-10192 | Medium | 6.4 | 2025-10-03 | The WP Photo Effects plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wppe_effect' shortcode in all versions up to, and incl… |
CVE-2025-10165 | Medium | 6.4 | 2025-10-03 | The AP Background plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'adv_parallax_back' shortcode in all versions up to, and i… |
CVE-2025-10053 | Medium | 4.4 | 2025-10-03 | The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including… |