CWE-79 · Cross-site Scripting (page 75)
Page 75 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-10590 | Medium | 4.3 | 2025-09-17 | A security flaw has been discovered in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_usuario_det.php… |
CVE-2025-0420 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripti… |
CVE-2025-0419 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. Zirve Nova all… |
CVE-2025-9565 | Medium | 6.4 | 2025-09-17 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocksy_newsletter_subscribe shortcode in all versions… |
CVE-2025-9203 | Medium | 6.4 | 2025-09-17 | The Media Player Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtitle_ssize', 'track_title', and 'track_art… |
CVE-2025-10584 | Low | 3.5 | 2025-09-17 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anotacao_cad.php. Suc… |
CVE-2025-9851 | Medium | 6.4 | 2025-09-17 | The Appointmind plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appointmind_calendar' shortcode in all versions up to, and… |
CVE-2025-8394 | Medium | 6.4 | 2025-09-17 | The Productive Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_productive_breadcrumb shortcode in all versions… |
CVE-2025-8153 | | 2025-09-17 | Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, f… | |
CVE-2025-10166 | Medium | 6.4 | 2025-09-17 | The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'twitter' shortcode in all versions up to, and i… |
CVE-2025-43804 | Medium | 6.1 | 2025-09-16 | Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4… |
CVE-2025-10566 | Medium | 4.3 | 2025-09-16 | A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /index.php… |
CVE-2025-58174 | Medium | 4.6 | 2025-09-16 | LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile… |
CVE-2025-57145 | Medium | 5.4 | 2025-09-16 | A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize… |
CVE-2025-56293 | Medium | 5.4 | 2025-09-16 | code-projects Human Resource Integrated System 1.0 is vulnerable to Cross Site Scripting (XSS) in the Add Child Information section in the Childs Name field. |
CVE-2025-56289 | Medium | 5.4 | 2025-09-16 | code-projects Document Management System 1.0 has a Cross Site Scripting (XSS) vulnerability, where attackers can leak admin's cookie information by entering ma… |
CVE-2025-56280 | Medium | 5.4 | 2025-09-16 | code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the area where users submit reservation information. |
CVE-2025-8276 | Medium | 4.3 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization o… |
CVE-2025-56276 | Medium | 5.4 | 2025-09-16 | code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the registration function. An attacker enters malicious JavaScript… |
CVE-2024-12796 | Medium | 5.3 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows… |
CVE-2025-55834 | Medium | 6.1 | 2025-09-16 | A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logController.do component |
CVE-2025-10546 | | 2025-09-16 | This vulnerability exist in PPC 2K15X Router, due to improper input validation for the Common Gateway Interface (CGI) parameters at its web management portal… | |
CVE-2025-10534 | High | 8.1 | 2025-09-16 | Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-6575 | Medium | 5.4 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dolusoft Omaspot allows Reflected XSS. This issue… |
CVE-2025-56697 | Medium | 6.1 | 2025-09-16 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Computer Base Test v1… |
CVE-2025-2404 | Medium | 4.3 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ubit Information Technologies STOYS allows Cross-S… |
CVE-2025-10316 | | 2025-09-16 | The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from… | |
CVE-2025-10485 | Medium | 4.3 | 2025-09-15 | A vulnerability has been found in pojoin h3blog up to 5bf704425ebc11f4c24da51f32f36bb17ae20489. Affected by this issue is the function ppt_log of the file /log… |
CVE-2025-6947 | | 2025-09-15 | A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An authe… | |
CVE-2025-57117 | Medium | 5.4 | 2025-09-15 | A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScript on the departmen… |
CVE-2025-43802 | Medium | 6.1 | 2025-09-15 | Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay… |
CVE-2025-59332 | High | 8.6 | 2025-09-15 | 3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser function allow users to provide custom attri… |
CVE-2025-45091 | Medium | 5.4 | 2025-09-15 | Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An authenticated attacker can exploit this… |
CVE-2025-43800 | Medium | 6.1 | 2025-09-15 | Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7… |
CVE-2025-52344 | Medium | 6.1 | 2025-09-15 | Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's… |
CVE-2025-43791 | Medium | 6.1 | 2025-09-15 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA t… |
CVE-2025-58177 | Medium | 5.4 | 2025-09-15 | n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting (XSS) vulnerability in @n8n/n8n-nodes… |
CVE-2025-58172 | | 2025-09-15 | drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting (XSS) vulnerability exists in the debug logging… | |
CVE-2025-56252 | Medium | 6.1 | 2025-09-15 | Cross Site Scripting (xss) vulnerability in ServitiumCRM 2.10 allowing attackers to execute arbitrary code via a crafted URL to the mobile parameter. |
CVE-2025-43794 | Medium | 4.8 | 2025-09-15 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1… |
CVE-2025-9826 | Medium | 5.4 | 2025-09-15 | Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. |
CVE-2025-10434 | Low | 2.4 | 2025-09-15 | A vulnerability was identified in IbuyuCMS up to 2.6.3. Impacted is an unknown function of the file /admin/article.php?a=mod of the component Add Article Page… |
CVE-2025-10411 | Medium | 4.3 | 2025-09-14 | A vulnerability was detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /… |
CVE-2025-10388 | Low | 3.5 | 2025-09-14 | A vulnerability was identified in Selleo Mentingo 2025.08.27. This issue affects some unknown processing of the file /api/course/enroll-course of the component… |
CVE-2025-10386 | Medium | 4.3 | 2025-09-14 | A vulnerability was found in Yida ECMS Consulting Enterprise Management System 1.0. This affects an unknown part of the file /login.do of the component POST Re… |
CVE-2025-10373 | Low | 3.5 | 2025-09-13 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /intranet/educar_turma_ti… |
CVE-2025-10372 | Low | 3.5 | 2025-09-13 | A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_modulo_cad.php. This manipulatio… |
CVE-2025-10370 | Low | 3.5 | 2025-09-13 | A vulnerability was identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. This vulnerability affects unknown code of the file /htdocs/userScripts.php. The manip… |
CVE-2025-10369 | Low | 3.5 | 2025-09-13 | A vulnerability was determined in MiczFlor RPi-Jukebox-RFID up to 2.8.0. This affects an unknown part of the file /htdocs/cardRegisterNew.php. Executing manipu… |
CVE-2025-10368 | Low | 3.5 | 2025-09-13 | A vulnerability was found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/manageFilesFolders… |
CVE-2025-10367 | Low | 3.5 | 2025-09-13 | A vulnerability has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/cardEdi… |
CVE-2025-10366 | Low | 3.5 | 2025-09-13 | A flaw has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/inc.setWlanIpMail.php. This manipulation of… |
CVE-2025-10340 | Low | 3.5 | 2025-09-13 | A vulnerability was determined in WhatCD Gazelle up to 63b337026d49b5cf63ce4be20fdabdc880112fa3. The affected element is an unknown function of the file /secti… |
CVE-2025-10332 | Low | 3.5 | 2025-09-13 | A vulnerability was found in cdevroe unmark up to 1.9.3. Impacted is an unknown function of the file application/views/marks/info.php. Performing manipulation… |
CVE-2025-10331 | Low | 3.5 | 2025-09-13 | A vulnerability has been found in cdevroe unmark up to 1.9.3. This issue affects some unknown processing of the file /application/controllers/Marks.php. Such m… |
CVE-2025-10330 | Medium | 4.3 | 2025-09-12 | A flaw has been found in cdevroe unmark up to 1.9.3. This vulnerability affects unknown code of the file application/views/layouts/topbar/searchform.php. This… |
CVE-2025-45585 | Medium | 5.4 | 2025-09-12 | Multiple stored cross-site scripting (XSS) vulnerabilities in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to execute arbitrary web scripts or… |
CVE-2025-52074 | Medium | 6.1 | 2025-09-12 | PHPGURUKUL Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) due to lack of input sanitization in the quantity parameter when adding a pro… |
CVE-2025-43787 | Medium | 5.4 | 2025-09-12 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0… |
CVE-2025-55996 | Medium | 6.3 | 2025-09-12 | Viber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message compose/forward interface |
CVE-2025-8280 | Medium | 5.8 | 2025-09-12 | The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, wh… |
CVE-2025-9879 | Medium | 6.4 | 2025-09-12 | The Spotify Embed Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotify' shortcode in all versions up to, and inc… |
CVE-2025-9877 | Medium | 6.4 | 2025-09-12 | The Embed Google Datastudio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'egds' shortcode in all versions up to, and incl… |
CVE-2025-10274 | Medium | 4.3 | 2025-09-12 | A security flaw has been discovered in erjinzhi 10OA 1.0. Affected by this issue is some unknown functionality of the file /trial/mvc/item. Performing manipula… |
CVE-2025-10272 | Medium | 4.3 | 2025-09-11 | A vulnerability was determined in erjinzhi 10OA 1.0. Affected is an unknown function of the file /trial/mvc/catalogue. This manipulation of the argument Name c… |
CVE-2025-10271 | Medium | 4.3 | 2025-09-11 | A vulnerability was found in erjinzhi 10OA 1.0. This impacts an unknown function of the file /trial/mvc/finder. The manipulation of the argument Name results i… |
CVE-2025-10255 | Low | 3.5 | 2025-09-11 | A vulnerability was determined in Ascensio System SIA OnlyOffice up to 12.7.0. Impacted is an unknown function of the file /Products/Projects/Messages.aspx of… |
CVE-2025-10254 | Low | 3.5 | 2025-09-11 | A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7.0. This issue affects some unknown processing of the file /Products/Projects/Messages.as… |
CVE-2025-10253 | Low | 3.5 | 2025-09-11 | A vulnerability has been found in openDCIM 23.04. This vulnerability affects unknown code of the file /scripts/uploadifive.php of the component SVG File Handle… |
CVE-2025-40696 | Medium | 5.4 | 2025-09-11 | Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validati… |
CVE-2025-40695 | Medium | 5.4 | 2025-09-11 | Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validati… |
CVE-2025-40694 | Medium | 5.4 | 2025-09-11 | Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validati… |
CVE-2025-40693 | Medium | 5.4 | 2025-09-11 | Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a reflected and stored authenticated XSS due to the lack of pr… |
CVE-2025-9861 | Medium | 6.4 | 2025-09-11 | The ThemeLoom Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'los_showposts' shortcode in all versions up to, and i… |
CVE-2025-9860 | Medium | 6.4 | 2025-09-11 | The Mixtape plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mixtape' shortcode in all versions up to, and including, 1.1 du… |
CVE-2025-9855 | Medium | 6.4 | 2025-09-11 | The Enhanced BibliPlug plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bibliplug_authors' shortcode in all versions up to… |
CVE-2025-9850 | Medium | 6.4 | 2025-09-11 | The Evenium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'evenium_single_event' shortcode in all versions up to, and incl… |
CVE-2025-9128 | Medium | 6.4 | 2025-09-11 | The eID Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.9.3 due to insuff… |
CVE-2025-9123 | Medium | 6.4 | 2025-09-11 | The CBX Map for Google Map & OpenStreetMap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the popup heading and location address paramet… |
CVE-2025-8721 | Medium | 6.4 | 2025-09-11 | The Workable Api plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's workable_jobs shortcode in all versions up to, and includin… |
CVE-2025-8691 | Medium | 6.4 | 2025-09-11 | The WP Scriptcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.0.0 due to… |
CVE-2025-8689 | Medium | 6.4 | 2025-09-11 | The Elements Plus! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Image Comparison, HotSpot Plus, and Google Maps widgets i… |
CVE-2025-8686 | Medium | 6.4 | 2025-09-11 | The WP Easy FAQs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's WP_EASY_FAQ shortcode in all versions up to, and including… |
CVE-2025-8445 | Medium | 6.4 | 2025-09-11 | The Countdown Timer for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'countdown_label' Parameter in all versions up to… |
CVE-2025-8398 | Medium | 6.4 | 2025-09-11 | The azurecurve BBCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'url' shortcode in all versions up to, and including… |
CVE-2025-8392 | Medium | 6.4 | 2025-09-11 | The Mitfahrgelegenheit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘date’ parameter in all versions up to, and including, 1.1.5 d… |
CVE-2025-8318 | Medium | 6.4 | 2025-09-11 | The Jobify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘keyword’ parameter in all versions up to, and including, 1.4.4 due to ins… |
CVE-2025-8316 | Medium | 6.4 | 2025-09-11 | The Certifica WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘evento’ parameter in all versions up to, and including, 3.1 due to… |
CVE-2025-8215 | Medium | 6.4 | 2025-09-11 | The Responsive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and including… |
CVE-2025-5801 | Medium | 6.4 | 2025-09-11 | The Digital Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘column’ parameter in all versions up to, and including… |
CVE-2025-9910 | Medium | 4.7 | 2025-09-11 | Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin. An attacker can inject malicious… |
CVE-2025-10246 | Low | 3.5 | 2025-09-11 | A weakness has been identified in lokibhardwaj PHP-Code-For-Unlimited-File-Upload up to 124fe96324915490c81eaf7db3234b0b4e4bab3c. This affects an unknown part… |
CVE-2025-10235 | Low | 2.4 | 2025-09-11 | A flaw has been found in Scada-LTS up to 2.7.8.1. This issue affects some unknown processing of the file /reports.shtm of the component Reports Module. This ma… |
CVE-2025-10234 | Low | 2.4 | 2025-09-11 | A vulnerability was detected in Scada-LTS up to 2.7.8.1. This vulnerability affects unknown code of the file /data_point_edit.shtm of the component Data Point… |
CVE-2025-43783 | Medium | 6.1 | 2025-09-10 | Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.73 through 7.4.3.128, and Liferay DXP 2024.Q3.0 through 2024.Q3.1, 2024.Q2.0 through… |
CVE-2025-57520 | Medium | 6.1 | 2025-09-10 | A Cross Site Scripting (XSS) vulnerability exists in Decap CMS thru 3.8.3. Input fields such as body, tags, title, and description are not properly sanitized b… |
CVE-2025-43785 | Medium | 6.1 | 2025-09-10 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.3.45 through 7.4.3.128, and Liferay DXP 2024 Q2.0 through 2024.Q2.9, 2024.Q1.1 through 20… |
CVE-2025-8681 | Medium | 5.5 | 2025-09-10 | Pega Platform versions 7.1.0 to Infinity 24.2.2 are affected by a Stored XSS issue in a user interface component. Requires a high privileged user with a devel… |
CVE-2025-59035 | Medium | 4.6 | 2025-09-10 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-… |
CVE-2025-40725 | | 2025-09-10 | Reflected Cross-Site Scripting (XSS) vulnerability in Azon Dominator. This vulnerability allows an attacker to execute JavaScript code in the victim's browser… |