CWE-79 · Cross-site Scripting (page 83)
Page 83 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41519 | Medium | 6.1 | 2025-08-07 | Student Attendance Management System v1 was discovered to contain a cross-site scripting (XSS) vulnerability via the sessionName parameter at createSessionTerm… |
CVE-2025-54395 | Medium | 6.1 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication configuration data. |
CVE-2025-54392 | Medium | 6.1 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data, a different vulnerability than CVE… |
CVE-2025-55134 | Medium | 6.4 | 2025-08-07 | In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js. |
CVE-2025-55133 | Medium | 6.4 | 2025-08-07 | In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js. |
CVE-2024-52680 | Medium | 6.1 | 2025-08-07 | EyouCMS 1.6.7 is vulnerable to Cross Site Scripting (XSS) in /login.php?m=admin&c=System&a=web&lang=cn. |
CVE-2025-8581 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-8580 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-8579 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-8577 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-54784 | Medium | 6.1 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability i… |
CVE-2025-54783 | Medium | 6.1 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site… |
CVE-2025-51053 | Medium | 6.1 | 2025-08-06 | A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and… |
CVE-2025-50740 | Medium | 6.1 | 2025-08-06 | AutoConnect 1.4.2, an Arduino library, is vulnerable to a cross site scripting (xss) vulnerability. The AutoConnect web interface /_ac/config allows HTML/JS co… |
CVE-2025-51624 | High | 7.6 | 2025-08-06 | Cross-site scripting (XSS) vulnerability in Zone Bitaqati thru 3.4.0. |
CVE-2025-51531 | Medium | 6.1 | 2025-08-06 | A reflected cross-site scripting (XSS) vulnerability in Sage DPW 2024_12_004 and earlier allows attackers to execute arbitrary JavaScript in the context of a v… |
CVE-2025-7727 | Medium | 6.4 | 2025-08-06 | The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and… |
CVE-2025-8100 | Medium | 5.4 | 2025-08-06 | The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in version… |
CVE-2025-7498 | Medium | 6.4 | 2025-08-06 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all versions up to, and includ… |
CVE-2025-7399 | Medium | 6.4 | 2025-08-06 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due… |
CVE-2025-7502 | Medium | 6.4 | 2025-08-06 | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several shortcodes in all versions up to, and inc… |
CVE-2025-6690 | Medium | 6.4 | 2025-08-06 | The WP Tournament Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘field’ parameter in all versions up to, and including… |
CVE-2025-6259 | Medium | 6.4 | 2025-08-06 | The esri-map-view plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's esri-map-view shortcode in all versions up to, and includi… |
CVE-2025-6256 | Medium | 6.4 | 2025-08-06 | The Flex Guten plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘thumbnailHoverEffect’ parameter in all versions up to, and including… |
CVE-2025-54571 | Medium | 6.1 | 2025-08-06 | ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.11 and below, an attacker can ov… |
CVE-2025-32430 | Medium | 6.1 | 2025-08-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 4.2-milestone-3 through 16.4.7, 16.5.0-rc-… |
CVE-2025-8573 | Medium | 4.8 | 2025-08-05 | Concrete CMS versions 9 through 9.4.2 are vulnerable to Stored XSS from Home Folder on Members Dashboard page. Version 8 was not affected. A rogue admin could… |
CVE-2025-8571 | Medium | 4.8 | 2025-08-05 | Concrete CMS 9 to 9.4.2 and versions below 8.5.21 are vulnerable to Reflected Cross-Site Scripting (XSS) in the Conversation Messages Dashboard Page. Unsanitiz… |
CVE-2025-51541 | Medium | 6.1 | 2025-08-05 | A stored cross-site scripting (XSS) vulnerability exists in the Shopware 6 installation interface at /recovery/install/database-configuration/. The c_database_… |
CVE-2025-50592 | Medium | 5.4 | 2025-08-05 | Cross site scripting vulnerability in seacms before 13.2 via the vid parameter to Upload/js/player/dmplayer/player. |
CVE-2012-10032 | | 2025-08-05 | Maxthon3 version 3.2.2 build 1000 and prior are vulnerable to cross context scripting (XCS) via the about:history page. The browser’s trusted zone improperly h… | |
CVE-2025-51857 | Medium | 6.1 | 2025-08-05 | The reconcile method in the AttachmentReconciler class of the Halo system v.2.20.18LTS and before is vulnerable to XSS attacks. |
CVE-2025-46958 | Medium | 5.4 | 2025-08-05 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-8555 | Low | 3.5 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. Affected is an unknown function of the file /search. The manipulati… |
CVE-2025-8554 | Low | 2.4 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in atjiu pybbs up to 6.0.0. This issue affects some unknown processing of the file /admin/… |
CVE-2025-8553 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic was found in atjiu pybbs up to 6.0.0. This vulnerability affects unknown code of the file /admin/sensitive_word/list… |
CVE-2025-8552 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic has been found in atjiu pybbs up to 6.0.0. This affects an unknown part of the file /admin/tag/list. The manipulation… |
CVE-2025-8551 | Low | 3.5 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin… |
CVE-2025-8295 | Medium | 6.4 | 2025-08-05 | The Employee Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including… |
CVE-2025-8294 | Medium | 6.4 | 2025-08-05 | The Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3 due t… |
CVE-2025-8550 | Low | 2.4 | 2025-08-05 | A vulnerability was found in atjiu pybbs up to 6.0.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-8315 | Medium | 6.4 | 2025-08-05 | The WP Easy Contact plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 4… |
CVE-2025-8313 | Medium | 6.4 | 2025-08-05 | The Campus Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg’ parameter in all versions up to, and including, 1… |
CVE-2025-7050 | High | 7.2 | 2025-08-05 | The Use-your-Drive | Google Drive plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in file meta… |
CVE-2025-8545 | Low | 2.4 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the f… |
CVE-2025-8544 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic was found in Portabilis i-Educar 2.10. Affected by this vulnerability is an unknown functionality of the file /module… |
CVE-2025-8543 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php… |
CVE-2025-8542 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empre… |
CVE-2025-8541 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/publi… |
CVE-2025-8540 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municip… |
CVE-2025-8539 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this issue is some unknown functionality of the file /intranet… |
CVE-2025-8538 | Low | 2.4 | 2025-08-05 | A vulnerability has been found in Portabilis i-Educar 2.10 and classified as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-8535 | Low | 3.5 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in cronoh NanoVault up to 1.2.1. This issue affects the function executeJavaScript of the… |
CVE-2025-4604 | Medium | 6.1 | 2025-08-04 | The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through… |
CVE-2025-4599 | Medium | 6.1 | 2025-08-04 | The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 202… |
CVE-2025-50754 | Critical | 9.6 | 2025-08-04 | Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality. A malicious script submitted by an attacker i… |
CVE-2025-8521 | Low | 2.4 | 2025-08-04 | A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5. This issue affects some unknown processing of the file /vadmi… |
CVE-2025-51534 | High | 8.1 | 2025-08-04 | A cross-site scripting (XSS) vulnerability in Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2025-26065 | High | 7.3 | 2025-08-04 | A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injectin… |
CVE-2025-36605 | Medium | 6.1 | 2025-08-04 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the C… |
CVE-2025-8511 | Low | 3.5 | 2025-08-03 | A vulnerability classified as problematic was found in Portabilis i-Diario 1.5.0. This vulnerability affects unknown code of the file /diario-de-observacoes/ o… |
CVE-2025-8510 | Low | 3.5 | 2025-08-03 | A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matri… |
CVE-2025-8509 | Low | 3.5 | 2025-08-03 | A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intra… |
CVE-2025-8508 | Low | 3.5 | 2025-08-03 | A vulnerability was found in Portabilis i-Educar 2.9. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-8507 | Low | 3.5 | 2025-08-03 | A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educar_funca… |
CVE-2024-41177 | Medium | 6.1 | 2025-08-03 | Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin. This issue affects Apache Zeppelin: before 0.12.0. Users are recommended to up… |
CVE-2025-8506 | Low | 3.5 | 2025-08-03 | A vulnerability was found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This issue affects some unknown pr… |
CVE-2025-8501 | Low | 3.5 | 2025-08-03 | A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Affected is an unknown function of the file /in… |
CVE-2025-52133 | Medium | 6.4 | 2025-08-03 | The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import. |
CVE-2025-52132 | Medium | 6.4 | 2025-08-03 | The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page. |
CVE-2025-52131 | Medium | 6.4 | 2025-08-03 | The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field. |
CVE-2025-7500 | Medium | 6.4 | 2025-08-02 | The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 d… |
CVE-2025-8400 | Medium | 6.1 | 2025-08-02 | The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sa… |
CVE-2025-8399 | Medium | 6.4 | 2025-08-02 | The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0… |
CVE-2025-8391 | Medium | 6.4 | 2025-08-02 | The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6… |
CVE-2025-6832 | Medium | 6.1 | 2025-08-02 | The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'non… |
CVE-2025-8317 | Medium | 6.4 | 2025-08-02 | The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due… |
CVE-2025-8212 | Medium | 6.4 | 2025-08-02 | The Medical Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter widget in all versions up to, and… |
CVE-2025-6626 | Medium | 4.4 | 2025-08-02 | The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting… |
CVE-2025-4588 | Medium | 6.4 | 2025-08-02 | The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortcode in all versions up to, and includin… |
CVE-2025-8146 | Medium | 6.4 | 2025-08-02 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and i… |
CVE-2025-50869 | Medium | 6.1 | 2025-08-01 | A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query an… |
CVE-2025-33118 | Medium | 6.4 | 2025-08-01 | IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 12 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary… |
CVE-2025-51504 | High | 7.6 | 2025-08-01 | Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field. |
CVE-2025-51502 | Medium | 6.1 | 2025-08-01 | Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the… |
CVE-2025-51501 | Medium | 6.1 | 2025-08-01 | Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaS… |
CVE-2025-45778 | Medium | 6.1 | 2025-08-01 | A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2025-6228 | Medium | 6.4 | 2025-08-01 | The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Te… |
CVE-2025-4684 | Medium | 6.4 | 2025-08-01 | The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites – Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Import… |
CVE-2025-7646 | Medium | 6.4 | 2025-08-01 | The The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2025-5921 | Medium | 5.8 | 2025-08-01 | The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2025-7845 | Medium | 6.4 | 2025-08-01 | The Stratum – Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widge… |
CVE-2025-7725 | High | 7.2 | 2025-08-01 | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugi… |
CVE-2025-37109 | Low | 3.5 | 2025-07-31 | Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product |
CVE-2025-37108 | Low | 3.5 | 2025-07-31 | Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product |
CVE-2025-26064 | High | 7.3 | 2025-07-31 | A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injectin… |
CVE-2025-51503 | High | 7.6 | 2025-07-31 | A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile fields, leading to arbit… |
CVE-2025-50866 | Medium | 6.1 | 2025-07-31 | CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting (XSS) vulnerability in the email parameter of the postquerypublic endpoint. Improper s… |
CVE-2025-52203 | High | 7.6 | 2025-07-31 | A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fa… |
CVE-2025-50848 | Medium | 6.1 | 2025-07-31 | A file upload vulnerability was discovered in CS Cart 4.18.3, allows attackers to execute arbitrary code. CS Cart 4.18.3 allows unrestricted upload of HTML fil… |