CWE-79 · Cross-site Scripting (page 78)
Page 78 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58620 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Stored… |
CVE-2025-58618 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar allows DOM-Ba… |
CVE-2025-58614 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows… |
CVE-2025-58612 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS… |
CVE-2025-58610 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery all… |
CVE-2025-58609 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode a… |
CVE-2025-58607 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA… |
CVE-2025-58605 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored… |
CVE-2025-58602 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalizati… |
CVE-2025-58596 | Medium | 5.9 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This… |
CVE-2025-58593 | Medium | 6.5 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allo… |
CVE-2025-57151 | High | 8.8 | 2025-09-03 | phpgurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/userprofile.php via the fullname parameter. |
CVE-2025-57150 | High | 7.2 | 2025-09-03 | phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/subcategory.php via the categoryName parameter. |
CVE-2025-26210 | High | 8.8 | 2025-09-03 | DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parti… |
CVE-2025-0878 | Medium | 4.7 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft LimonDesk allows Cross-Site Scripting (XS… |
CVE-2024-13064 | Medium | 4.3 | 2025-09-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft MyRezzta allows Cross-Site Scripting (XSS… |
CVE-2025-9378 | Medium | 6.4 | 2025-09-03 | The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie… |
CVE-2023-3666 | Low | 3.3 | 2025-09-03 | The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2025-58351 | Medium | 6.8 | 2025-09-03 | Outline is a service that allows for collaborative documentation. In versions 0.72.0 through 0.83.0, Outline introduced a feature which facilitates local file… |
CVE-2025-9845 | Low | 3.5 | 2025-09-03 | A vulnerability has been found in code-projects Fruit Shop Management System 1.0. Affected by this vulnerability is an unknown functionality of the file produc… |
CVE-2025-9834 | Low | 3.5 | 2025-09-02 | A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /registration.php. Executing manipulation o… |
CVE-2025-51966 | Medium | 6.1 | 2025-09-02 | A cross-site scripting (XSS) vulnerability exists in the PDF preview functionality of uTools thru 7.1.1. When a user previews a specially crafted PDF file, emb… |
CVE-2025-55474 | Medium | 6.1 | 2025-09-02 | Many Notes 0.10.1 is vulnerable to Cross Site Scripting (XSS), which allows malicious Markdown files to execute JavaScript when viewed. |
CVE-2025-55473 | Medium | 6.1 | 2025-09-02 | Asian Arts Talents Foundation (AATF) Website v5.1.x and Docker version 2024.12.8.1 are vulnerable to Cross Site Scripting (XSS). The vulnerability exists in th… |
CVE-2024-51423 | Medium | 6.1 | 2025-09-02 | Cross Site Scripting vulnerability in Infor Global HR GHR v.11.23.03.00.21 and before allows a remote attacker to execute arbitrary code via the class paramete… |
CVE-2024-12974 | Medium | 4.3 | 2025-09-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft ProKuaför allows Cross-Site Scripting (XS… |
CVE-2024-12972 | Medium | 4.3 | 2025-09-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft OctoCloud allows Cross-Site Scripting (XS… |
CVE-2025-9796 | Low | 3.5 | 2025-09-01 | A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/Enco… |
CVE-2025-33083 | Medium | 5.4 | 2025-09-01 | IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript c… |
CVE-2025-33082 | Medium | 5.4 | 2025-09-01 | IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript c… |
CVE-2025-0656 | Medium | 6.1 | 2025-09-01 | IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript… |
CVE-2024-12914 | Medium | 4.3 | 2025-09-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akınsoft QR Menü allows Cross-Site Scripting (XSS)… |
CVE-2025-9773 | Medium | 4.3 | 2025-09-01 | A flaw has been found in RemoteClinic up to 2.0. This vulnerability affects unknown code of the file /staff/edit.php. Executing manipulation of the argument La… |
CVE-2025-9569 | Medium | 6.1 | 2025-09-01 | The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code… |
CVE-2025-9568 | Medium | 6.1 | 2025-09-01 | The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code… |
CVE-2025-9567 | Medium | 6.1 | 2025-09-01 | The eHRD developed by Sunnet has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code… |
CVE-2025-9755 | Medium | 4.3 | 2025-09-01 | A vulnerability has been found in Khanakag-17 Library Management System up to 60ed174506094dcd166e34904a54288e5d10ff24. This affects an unknown function of the… |
CVE-2025-9754 | Low | 3.5 | 2025-09-01 | A flaw has been found in Campcodes Online Hospital Management System 1.0. The impacted element is an unknown function of the file /edit-profile.php of the comp… |
CVE-2025-9753 | Low | 2.4 | 2025-09-01 | A vulnerability was detected in Campcodes Online Hospital Management System 1.0. The affected element is an unknown function of the file /admin/patient-search… |
CVE-2025-9746 | Low | 2.4 | 2025-08-31 | A vulnerability was detected in Campcodes Hospital Management System 1.0. This affects an unknown function of the file /admin/edit-doctor-specialization.php of… |
CVE-2025-9738 | Low | 3.5 | 2025-08-31 | A flaw has been found in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_tipo_ensino_ca… |
CVE-2025-9737 | Low | 3.5 | 2025-08-31 | A vulnerability was detected in O2OA up to 10.0-410. Affected is an unknown function of the file /x_query_assemble_designer/jaxrs/importmodel of the component… |
CVE-2025-9736 | Low | 3.5 | 2025-08-31 | A security vulnerability has been detected in O2OA up to 10.0-410. This impacts an unknown function of the file /x_query_assemble_designer/jaxrs/statement of t… |
CVE-2025-9735 | Low | 3.5 | 2025-08-31 | A weakness has been identified in O2OA up to 10.0-410. This affects an unknown function of the file /x_query_assemble_designer/jaxrs/table of the component Per… |
CVE-2025-9734 | Low | 3.5 | 2025-08-31 | A security flaw has been discovered in O2OA up to 10.0-410. The impacted element is an unknown function of the file /x_query_assemble_designer/jaxrs/stat of th… |
CVE-2025-9728 | Medium | 4.3 | 2025-08-31 | A security vulnerability has been detected in givanz Vvveb 1.0.7.2. This affects an unknown part of the file app/template/user/login.tpl. Such manipulation of… |
CVE-2025-9724 | Low | 3.5 | 2025-08-31 | A vulnerability was determined in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /intranet/educar_nivel_ensino_cad.php. Executing… |
CVE-2025-9723 | Low | 3.5 | 2025-08-31 | A vulnerability was found in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_tipo_regime_cad.php. Performing mani… |
CVE-2025-9722 | Low | 3.5 | 2025-08-31 | A vulnerability has been found in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_tipo_ocorrencia_disc… |
CVE-2025-9721 | Low | 3.5 | 2025-08-31 | A flaw has been found in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/FormulaMedia/edit. This manipulation o… |
CVE-2025-9720 | Low | 3.5 | 2025-08-31 | A vulnerability was detected in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /module/TabelaArredondamento/edit of the component… |
CVE-2025-9719 | Low | 3.5 | 2025-08-31 | A weakness has been identified in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_processplatform_assemble_designer/jaxrs/script of… |
CVE-2025-9718 | Low | 3.5 | 2025-08-31 | A security flaw has been discovered in O2OA up to 10.0-410. This affects an unknown part of the file /x_processplatform_assemble_designer/jaxrs/process of the… |
CVE-2025-9717 | Low | 3.5 | 2025-08-31 | A vulnerability was identified in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_organization_assemble_control/jaxrs/… |
CVE-2025-9716 | Low | 3.5 | 2025-08-31 | A vulnerability was determined in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_processplatform_assemble_desig… |
CVE-2025-5083 | Medium | 5.5 | 2025-08-31 | The Amministrazione Trasparente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.0… |
CVE-2025-9715 | Low | 3.5 | 2025-08-31 | A vulnerability was found in O2OA up to 10.0-410. Affected is an unknown function of the file /x_cms_assemble_control/jaxrs/script of the component Personal Pr… |
CVE-2025-9683 | Low | 3.5 | 2025-08-30 | A vulnerability was found in O2OA up to 10.0-410. Affected by this issue is some unknown functionality of the file /x_cms_assemble_control/jaxrs/form of the co… |
CVE-2025-9682 | Low | 3.5 | 2025-08-30 | A vulnerability has been found in O2OA up to 10.0-410. Affected by this vulnerability is an unknown functionality of the file /x_cms_assemble_control/jaxrs/des… |
CVE-2025-9681 | Low | 3.5 | 2025-08-30 | A flaw has been found in O2OA up to 10.0-410. Affected is an unknown function of the file /x_program_center/jaxrs/agent of the component Personal Profile Page… |
CVE-2025-9680 | Low | 3.5 | 2025-08-30 | A vulnerability was detected in O2OA up to 10.0-410. This impacts an unknown function of the file /x_portal_assemble_designer/jaxrs/page of the component Perso… |
CVE-2025-9500 | Medium | 6.4 | 2025-08-30 | The TablePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shortcode_debug’ parameter in all versions up to, and including, 3.2… |
CVE-2025-9499 | Medium | 6.4 | 2025-08-30 | The Ocean Extra plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's oceanwp_library shortcode in all versions up to, and includi… |
CVE-2023-41471 | High | 7.8 | 2025-08-29 | Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS funct… |
CVE-2025-55580 | Medium | 5.4 | 2025-08-29 | SolidInvoice version 2.3.7 is vulnerable to a stored cross-site scripting (XSS) issue in the Clients module. An authenticated attacker can inject JavaScript th… |
CVE-2025-55579 | Medium | 5.4 | 2025-08-29 | SolidInvoice version 2.3.7 is vulnerable to a Stored Cross-Site Scripting (XSS) issue in the Tax Rates functionality. The vulnerability is fixed in version 2.3… |
CVE-2025-22483 | Medium | 4.8 | 2025-08-29 | A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator acco… |
CVE-2024-12923 | Medium | 5.4 | 2025-08-29 | A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-9659 | Low | 3.5 | 2025-08-29 | A vulnerability has been found in O2OA up to 10.0-410. The affected element is an unknown function of the file /x_portal_assemble_designer/jaxrs/widget of the… |
CVE-2025-9658 | Low | 3.5 | 2025-08-29 | A flaw has been found in O2OA up to 10.0-410. Impacted is an unknown function of the file /x_portal_assemble_designer/jaxrs/dict/ of the component Personal Pro… |
CVE-2025-9657 | Low | 3.5 | 2025-08-29 | A vulnerability was detected in O2OA up to 10.0-410. This issue affects some unknown processing of the file /x_program_center/jaxrs/script of the component Per… |
CVE-2025-9656 | Medium | 4.3 | 2025-08-29 | A security vulnerability has been detected in PHPGurukul Directory Management System 2.0. This vulnerability affects unknown code of the file /admin/add-direct… |
CVE-2025-9655 | Low | 3.5 | 2025-08-29 | A weakness has been identified in O2OA up to 10.0-410. This affects an unknown part of the file /x_organization_assemble_control/jaxrs/person/ of the component… |
CVE-2025-9653 | Low | 3.5 | 2025-08-29 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_proje… |
CVE-2025-9652 | Low | 3.5 | 2025-08-29 | A vulnerability was determined in Portabilis i-Educar up to 2.10. Affected is an unknown function of the file /intranet/educar_transferencia_tipo_cad.php of th… |
CVE-2025-9647 | Medium | 4.3 | 2025-08-29 | A weakness has been identified in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/role/list. This manipulation of the ar… |
CVE-2025-9646 | Low | 3.5 | 2025-08-29 | A security flaw has been discovered in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /x_organization_assemble_personal/jaxrs/definit… |
CVE-2025-40709 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40708 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40707 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40706 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40705 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40704 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40703 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-40702 | Medium | 5.4 | 2025-08-29 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas v8.9.0 from the Austrian Centre for Digital Humanities and Cultural Heritage (ACDH-CH), due to inadequate… |
CVE-2025-8150 | Medium | 6.4 | 2025-08-29 | The Events Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter and Countdown widgets in all versi… |
CVE-2024-13987 | Medium | 5.9 | 2025-08-29 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Synology RADIUS Server allows remote authenticated users… |
CVE-2025-8619 | Medium | 6.4 | 2025-08-29 | The OSM Map Widget for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Map Block URL in all versions up to, and in… |
CVE-2025-8290 | Medium | 6.4 | 2025-08-29 | The List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 1.0.6 due t… |
CVE-2025-9595 | Medium | 4.3 | 2025-08-29 | A vulnerability was found in code-projects Student Information Management System 1.0. The impacted element is an unknown function of the file /login.php. The m… |
CVE-2025-9591 | Low | 2.4 | 2025-08-28 | A security vulnerability has been detected in ZrLog up to 3.1.5. This vulnerability affects unknown code of the file /api/admin/template/config of the componen… |
CVE-2025-9590 | Low | 3.5 | 2025-08-28 | A vulnerability was identified in Weaver E-Mobile Mobile Management Platform up to 20250813. Affected by this vulnerability is an unknown functionality. The ma… |
CVE-2025-56236 | Medium | 6.1 | 2025-08-28 | FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing m… |
CVE-2025-51967 | Medium | 6.1 | 2025-08-28 | A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. The application fails… |
CVE-2024-49790 | Medium | 5.4 | 2025-08-28 | IBM Watson Studio on Cloud Pak for Data 4.0 and 5.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary J… |
CVE-2025-54724 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Golo golo allows Reflected XSS.This issue affects G… |
CVE-2025-53579 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu captcha-eu allows Reflected XSS.Thi… |
CVE-2025-53289 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas all… |
CVE-2025-53225 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eboekhouden e-Boekhouden.nl e-boekhoudennl-connector allo… |
CVE-2025-53224 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Koen Schuit NextGEN Gallery Search nextgen-gallery-search… |