CWE-79 · Cross-site Scripting (page 71)
Page 71 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0876 | Medium | 4.1 | 2025-10-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Isin Basi Advertisement Information Technologies T… |
CVE-2025-61599 | Medium | 5.4 | 2025-10-03 | Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter"feature of EMLOG Pro 2.5.21 and below… |
CVE-2025-61597 | High | 7.6 | 2025-10-03 | Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting (XSS) via the mail… |
CVE-2025-54089 | Low | 3.4 | 2025-10-02 | CVE-2025-54089 is a cross-site scripting vulnerability in versions of secure access prior to 14.10. Attackers with administrative access to the console can int… |
CVE-2025-56154 | Medium | 6.1 | 2025-10-02 | htmly v3.0.8 is vulnerable to Cross Site Scripting (XSS) in the /author/:name endpoint of the affected application. The name parameter is not properly sanitize… |
CVE-2025-61087 | Medium | 6.1 | 2025-10-02 | SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the Customer Name field under Customer Management Section. |
CVE-2025-60782 | Medium | 5.4 | 2025-10-02 | PHP Education Manager v1.0 is vulnerable to Cross Site Scripting (XSS) stored Cross-Site Scripting (XSS) vulnerability in the topics management module (topics… |
CVE-2025-59774 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59773 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59772 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59771 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59770 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59769 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59768 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59767 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59766 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59765 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59764 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59763 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59762 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59761 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59760 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59759 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59758 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59757 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59756 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59755 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59754 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59753 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59752 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59751 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59750 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59749 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59748 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59747 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-59746 | Medium | 6.1 | 2025-10-02 | Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's… |
CVE-2025-56379 | Medium | 5.4 | 2025-10-02 | A stored cross-site scripting (XSS) vulnerability in the blog post feature of ERPNEXT v15.67.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2025-40992 | | 2025-10-02 | Stored XSS vulnerability in Creativeitem Sociopro due to lack of proper validation of user inputs via the endpoint '/sociopro/profile/update_profile', affectin… | |
CVE-2025-40991 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-40990 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-40989 | Medium | 5.4 | 2025-10-02 | Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/clie… |
CVE-2025-57389 | Medium | 5.4 | 2025-10-01 | A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Java… |
CVE-2025-57444 | Medium | 6.1 | 2025-10-01 | An authenticated cross-site scripting (XSS) vulnerability in the Administrative interface of Radware AlteonOS Web UI Management v33.0.4.50 allows attackers to… |
CVE-2025-60991 | High | 8.8 | 2025-10-01 | A reflected cross-site scripted (XSS) vulnerability in Codazon Magento Themes v1.1.0.0 to v2.4.7 allows attackers to execute arbitrary Javascript in the contex… |
CVE-2025-57393 | High | 8.8 | 2025-10-01 | A stored cross-site scripting (XSS) in Kissflow Work Platform Kissflow Application Versions 7337 Account v2.0 to v4.2vallows attackers to execute arbitrary web… |
CVE-2024-57494 | Medium | 6.5 | 2025-10-01 | Cross Site Scripting vulnerability in Neto E-Commerce CMS v.6.313.0 through v.6.3115 allows a remote attacker to escalate privileges via the kw parameter. |
CVE-2025-34182 | | 2025-10-01 | In Deciso OPNsense before 25.7.4, when creating an "Interfaces: Devices: Point-to-Point" entry, the value of the parameter ptpid is not sanitized of HTML-relat… | |
CVE-2025-20368 | Medium | 5.7 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privil… |
CVE-2025-20367 | Medium | 5.7 | 2025-10-01 | In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privile… |
CVE-2025-20361 | Medium | 4.8 | 2025-10-01 | A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Man… |
CVE-2025-20357 | Medium | 5.4 | 2025-10-01 | A vulnerability in the web-based management interface of Cisco Cyber Vision Center could allow an authenticated, remote attacker to conduct cross-site scriptin… |
CVE-2025-20356 | Medium | 5.4 | 2025-10-01 | A vulnerability in the web-based management interface of Cisco Cyber Vision Center could allow an authenticated, remote attacker to conduct cross-site scriptin… |
CVE-2025-56515 | High | 8.8 | 2025-10-01 | File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowin… |
CVE-2025-56514 | Medium | 5.4 | 2025-10-01 | Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other us… |
CVE-2025-40648 | | 2025-10-01 | Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'nu… | |
CVE-2025-40647 | | 2025-10-01 | Stored Cross-Site Scripting (XSS) vulnerability in Issabel v5.0.0, consisting of a stored XSS due to a lack of proper validation of user input, through the 'em… | |
CVE-2025-9075 | Medium | 6.4 | 2025-10-01 | The ZoloBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Gutenberg blocks in versions up to, and including, 2.3.10. This i… |
CVE-2025-43826 | Medium | 5.4 | 2025-09-30 | Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Lif… |
CVE-2025-36132 | Medium | 5.4 | 2025-09-30 | IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated u… |
CVE-2025-56200 | Medium | 6.1 | 2025-09-30 | A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while… |
CVE-2025-56018 | Medium | 6.1 | 2025-09-30 | SourceCodester Web-based Pharmacy Product Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in Category Management via the category name field. |
CVE-2025-54476 | | 2025-09-30 | Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class. | |
CVE-2025-28016 | Medium | 4.8 | 2025-09-30 | A Reflected Cross-Site Scripting (XSS) vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management… |
CVE-2025-9852 | Medium | 6.4 | 2025-09-30 | The Yoga Schedule Momoyoga plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'momoyoga-schedule' shortcode in all versions up… |
CVE-2025-8777 | Medium | 6.4 | 2025-09-30 | The planetcalc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘language’ parameter in all versions up to, and including, 2.2 due to… |
CVE-2025-8624 | Medium | 6.4 | 2025-09-30 | The Nexa Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Google Maps widget in all versions up to, and including, 1.1… |
CVE-2025-8623 | Medium | 6.4 | 2025-09-30 | The WeedMaps Menu for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's weedmaps_menu shortcode in all versions up t… |
CVE-2025-8608 | Medium | 6.4 | 2025-09-30 | The Mihdan: Elementor Yandex Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's block attributes in all versions up to, an… |
CVE-2025-8566 | Medium | 6.4 | 2025-09-30 | The GutenBee – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via parameters in the CountUp and Google Maps Blocks in all v… |
CVE-2025-8560 | Medium | 6.4 | 2025-09-30 | The FancyTabs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.1.0 due to in… |
CVE-2025-8214 | Medium | 6.4 | 2025-09-30 | The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typing Letter widget in all versions up to, and… |
CVE-2025-8116 | Medium | 6.1 | 2025-09-30 | PAD CMS is vulnerable to Reflected XSS in printing and save to PDF functionality. Malicious attacker can craft special URL, which will result in arbitrary Java… |
CVE-2025-6941 | Medium | 6.4 | 2025-09-30 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of… |
CVE-2025-6815 | Medium | 5.5 | 2025-09-30 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘service[name]’ p… |
CVE-2025-10196 | Medium | 6.4 | 2025-09-30 | The Survey Anyplace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'surveyanyplace_embed' shortcode in all versions up to… |
CVE-2025-10191 | Medium | 6.4 | 2025-09-30 | The Big Post Shipping for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wooboigpost_shipping_status' shortcod… |
CVE-2025-10189 | Medium | 6.4 | 2025-09-30 | The BP Direct Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bpdm_login' shortcode in all versions up to, and includ… |
CVE-2025-10182 | Medium | 6.4 | 2025-09-30 | The dbview plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dbview' shortcode in all versions up to, and including, 0.5.5 du… |
CVE-2025-10179 | Medium | 6.4 | 2025-09-30 | The My AskAI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'myaskai' shortcode in all versions up to, and including, 1.0.0… |
CVE-2025-10168 | Medium | 6.4 | 2025-09-30 | The Any News Ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'any-ticker' shortcode in all versions up to, and includ… |
CVE-2025-10131 | Medium | 6.4 | 2025-09-30 | The All Social Share Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sc' shortcode in all versions up to, and inclu… |
CVE-2025-10130 | Medium | 6.4 | 2025-09-30 | The Layers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'webcam' shortcode in all versions up to, and including, 0.5 due… |
CVE-2025-59948 | Medium | 6.7 | 2025-09-29 | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not sanitize certain event handler attributes in feed content, so by finding a p… |
CVE-2025-43817 | Medium | 6.1 | 2025-09-29 | Multiple reflected cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.3.74 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.6, 2023.Q… |
CVE-2025-43812 | Medium | 5.4 | 2025-09-29 | Cross-site scripting (XSS) vulnerability in web content template in Liferay Portal 7.4.3.4 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023… |
CVE-2025-57769 | Medium | 6.1 | 2025-09-29 | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into execut… |
CVE-2025-43820 | Medium | 5.4 | 2025-09-29 | Multiple cross-site scripting (XSS) vulnerabilities in the Calendar widget when inviting users to a event in Liferay Portal 7.4.3.35 through 7.4.3.110, and Lif… |
CVE-2025-43818 | Medium | 6.1 | 2025-09-29 | Cross-site scripting (XSS) vulnerability in the Calendar widget in Liferay Portal 7.4.3.35 through 7.4.3.110, and Liferay DXP 2023.Q4.0 through 2023.Q4.4, 2023… |
CVE-2025-43815 | Medium | 6.1 | 2025-09-29 | Reflected cross-site scripting (XSS) vulnerability on the page configuration page in Liferay Portal 7.4.3.102 through 7.4.3.110, and Liferay DXP 2023.Q4.0 thro… |
CVE-2025-43811 | Medium | 5.4 | 2025-09-29 | Multiple stored cross-site scripting (XSS) vulnerability in the related asset selector in Liferay Portal 7.4.3.50 through 7.4.3.111, and Liferay DXP 2023.Q4.0… |
CVE-2025-35034 | Medium | 4.3 | 2025-09-29 | Medical Informatics Engineering Enterprise Health has a reflected cross site scripting vulnerability in the 'portlet_user_id' URL parameter. A remote, unauthen… |
CVE-2025-57877 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57876 | Medium | 4.8 | 2025-09-29 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote, authenticated attacker to inject malic… |
CVE-2025-57875 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57874 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57873 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57871 | Medium | 4.8 | 2025-09-29 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administra… |
CVE-2025-57424 | High | 7.3 | 2025-09-29 | A stored cross-site scripting (XSS) vulnerability exists in the MyCourts v3 application within the LTA number profile field. An attacker can insert arbitrary J… |
CVE-2025-57483 | High | 8.1 | 2025-09-29 | A reflected cross-site scripting (XSS) vulnerability in tawk.to chatbox widget v4 allows attackers to execute arbitrary Javascript in the context of the user's… |
CVE-2025-56807 | Medium | 6.1 | 2025-09-29 | A cross-site scripting (XSS) vulnerability in FairSketch RISE Ultimate Project Manager & CRM 3.9.4 allows an administrator to store a JavaScript payload using… |