CWE-79 · Cross-site Scripting (page 84)
Page 84 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-51569 | Medium | 6.1 | 2025-07-31 | A cross-site scripting (XSS) vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U14_06 router's web interface. The /goform/goform_get_cmd_process endpoi… |
CVE-2025-50270 | Medium | 6.1 | 2025-07-31 | A stored Cross Site Scripting (xss) vulnerability in the "content management" feature in AnQiCMS v.3.4.11 allows a remote attacker to execute arbitrary code vi… |
CVE-2025-54589 | Medium | 6.3 | 2025-07-31 | Copyparty is a portable file server. In versions 1.18.6 and below, when accessing the recent uploads page at `/?ru`, users can filter the results using an inpu… |
CVE-2025-8380 | Low | 3.5 | 2025-07-31 | A vulnerability classified as problematic was found in Campcodes Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /admi… |
CVE-2025-40980 | | 2025-07-31 | A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of use… | |
CVE-2025-24854 | Medium | 6.1 | 2025-07-31 | A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript… |
CVE-2025-24853 | High | 7.5 | 2025-07-31 | A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's br… |
CVE-2025-7205 | Medium | 5.4 | 2025-07-31 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the donor notes parameter in all ve… |
CVE-2025-41391 | Medium | 5.4 | 2025-07-31 | Stored cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product user accesses a malicious page, an arbitrary script may be exec… |
CVE-2025-36563 | Medium | 6.1 | 2025-07-31 | Reflected cross-site scripting vulnerability exists in multiple versions of PowerCMS. If a product administrator accesses a crafted URL, an arbitrary script ma… |
CVE-2025-8370 | Medium | 4.3 | 2025-07-31 | A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9. Affected is an unknown function of the file /intranet/educar_escola… |
CVE-2025-8369 | Medium | 4.3 | 2025-07-31 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9. This issue affects some unknown processing of the file /intran… |
CVE-2025-8368 | Medium | 4.3 | 2025-07-31 | A vulnerability classified as problematic was found in Portabilis i-Educar 2.9. This vulnerability affects unknown code of the file /intranet/pesquisa_pessoa_l… |
CVE-2025-8367 | Medium | 4.3 | 2025-07-31 | A vulnerability classified as problematic has been found in Portabilis i-Educar 2.9. This affects an unknown part of the file /intranet/funcionario_vinculo_lst… |
CVE-2025-8366 | Medium | 4.3 | 2025-07-31 | A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intra… |
CVE-2025-5720 | Medium | 6.4 | 2025-07-31 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all versions up to, and in… |
CVE-2025-8365 | Low | 3.5 | 2025-07-31 | A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2025-8346 | Medium | 4.3 | 2025-07-31 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the f… |
CVE-2025-8340 | Medium | 4.3 | 2025-07-31 | A vulnerability was found in code-projects Intern Membership Management System 1.0. It has been declared as problematic. This vulnerability affects unknown cod… |
CVE-2025-8337 | Low | 2.4 | 2025-07-30 | A vulnerability, which was classified as problematic, has been found in code-projects Simple Car Rental System 1.0. This issue affects some unknown processing… |
CVE-2025-52187 | High | 8.2 | 2025-07-30 | GetProjectsIdea Create School Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in my_profile_update_form1.php. |
CVE-2025-51954 | Medium | 6.1 | 2025-07-30 | playground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2025-51951 | Medium | 6.1 | 2025-07-30 | andisearch v0.5.249 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2024-45515 | Medium | 6.1 | 2025-07-30 | An issue was discovered in Zimbra Collaboration (ZCS) through 10.1. A Cross-Site Scripting (XSS) vulnerability exists in Zimbra webmail due to insufficient val… |
CVE-2025-47001 | Medium | 5.4 | 2025-07-30 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-8319 | Medium | 6.1 | 2025-07-30 | the BMA login interface allows arbitrary JavaScript or HTML to be written straight into the page’s Document Object Model via the error= URL parameter |
CVE-2025-43229 | Medium | 6.1 | 2025-07-30 | This issue was addressed through improved state management. This issue is fixed in Safari 18.6, macOS Sequoia 15.6. Processing maliciously crafted web content… |
CVE-2025-5684 | Medium | 6.4 | 2025-07-29 | The MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `mf-tem… |
CVE-2025-53541 | Medium | 5.4 | 2025-07-29 | Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99… |
CVE-2025-27514 | Medium | 4.5 | 2025-07-29 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. In versions 9.5.0… |
CVE-2025-44136 | Critical | 9.8 | 2025-07-29 | MapTiler Tileserver-php v2.0 is vulnerable to Cross Site Scripting (XSS). The GET parameter "layer" is reflected in an error message without html encoding. Thi… |
CVE-2025-52358 | Medium | 6.3 | 2025-07-29 | A cross-site scripting vulnerability in Vivaldi United Group iCONTROL+ Server including Firmware version 4.7.8.0.eden Logic version 5.32 and below. This issue… |
CVE-2025-6060 | Medium | 5.4 | 2025-07-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in DECE Software Geodi allows Cross-Site Scripting (X… |
CVE-2025-40686 | Medium | 6.1 | 2025-07-29 | Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in… |
CVE-2025-40685 | Medium | 6.1 | 2025-07-29 | Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in… |
CVE-2025-40684 | Medium | 6.1 | 2025-07-29 | Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in… |
CVE-2025-40683 | Medium | 6.1 | 2025-07-29 | Reflected Cross-Site Scripting (XSS) in Human Resource Management System version 1.0. This vulnerability could allow an attacker to execute JavaScript code in… |
CVE-2025-5587 | Medium | 6.4 | 2025-07-29 | The Appzend theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘progressbarLayout’ parameter in all versions up to, and including, 1.2.6… |
CVE-2025-8216 | Medium | 6.4 | 2025-07-29 | The Sky Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple widgets in all versions up to, and including, 3.1.4… |
CVE-2025-8196 | Medium | 6.4 | 2025-07-29 | The Magical Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Custom Attributes in all versions up to, an… |
CVE-2025-6692 | Medium | 6.4 | 2025-07-29 | The YouTube Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘instance’ parameter in all versions up to, and including, 10.3 due… |
CVE-2025-6681 | Medium | 6.4 | 2025-07-29 | The Fan Page plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 1.0.1 due to ins… |
CVE-2025-4566 | Medium | 6.4 | 2025-07-29 | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-text DOM element a… |
CVE-2025-3075 | Medium | 6.4 | 2025-07-29 | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-ele… |
CVE-2025-7811 | Medium | 6.4 | 2025-07-29 | The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions… |
CVE-2025-7810 | Medium | 5.4 | 2025-07-29 | The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up… |
CVE-2025-7809 | Medium | 6.4 | 2025-07-29 | The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions u… |
CVE-2025-54423 | Medium | 5.4 | 2025-07-28 | copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code… |
CVE-2025-54299 | | 2025-07-28 | A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered. | |
CVE-2025-54298 | | 2025-07-28 | A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered. | |
CVE-2025-54534 | Medium | 4.8 | 2025-07-28 | In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page |
CVE-2025-32731 | Medium | 6.1 | 2025-07-28 | A reflected cross-site scripting (xss) vulnerability exists in the radiationDoseReport.php functionality of meddream MedDream PACS Premium 7.3.5.860. A special… |
CVE-2025-40730 | | 2025-07-28 | HTML injection in Vox Media's Chorus CMS. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious… | |
CVE-2025-27802 | Medium | 4.8 | 2025-07-28 | The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authent… |
CVE-2025-27801 | Medium | 4.8 | 2025-07-28 | The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authent… |
CVE-2025-27800 | Medium | 4.8 | 2025-07-28 | The Episerver Content Management System (CMS) by Optimizely was affected by multiple Stored Cross-Site Scripting (XSS) vulnerabilities. This allowed an authent… |
CVE-2025-8222 | Low | 3.5 | 2025-07-27 | A vulnerability, which was classified as problematic, has been found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Aff… |
CVE-2025-8221 | Medium | 4.3 | 2025-07-27 | A vulnerability classified as problematic was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 up to 24a15c02b4f75042c9f7f615a3fed2ec1cefb999. Affected by this vul… |
CVE-2025-54597 | High | 7.2 | 2025-07-27 | LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter. |
CVE-2025-8211 | Low | 3.5 | 2025-07-26 | A vulnerability was found in Roothub up to 2.6. It has been declared as problematic. Affected by this vulnerability is the function Edit of the file src/main/j… |
CVE-2025-8206 | Low | 3.1 | 2025-07-26 | A vulnerability, which was classified as problematic, was found in Comodo Dragon up to 134.0.6998.179. This affects an unknown part of the component IP DNS Lea… |
CVE-2025-8191 | Low | 3.5 | 2025-07-26 | A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.h… |
CVE-2025-5529 | Medium | 6.4 | 2025-07-26 | The Educenter theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Circle Counter Block in all versions up to, and including, 1.6.2 due to… |
CVE-2025-7501 | Medium | 6.4 | 2025-07-26 | The Wonder Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image title and description DOM in all versions up to, and includi… |
CVE-2025-6987 | Medium | 6.4 | 2025-07-26 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and i… |
CVE-2025-8167 | Low | 3.5 | 2025-07-25 | A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2025-46198 | High | 8.8 | 2025-07-25 | Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img el… |
CVE-2025-46199 | Critical | 9.8 | 2025-07-25 | Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields |
CVE-2025-45960 | Medium | 6.1 | 2025-07-25 | Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays… |
CVE-2025-45893 | Medium | 6.1 | 2025-07-25 | OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because… |
CVE-2025-45892 | Medium | 6.1 | 2025-07-25 | OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because input in the blog's… |
CVE-2025-45406 | Medium | 6.1 | 2025-07-25 | A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2023-53155 | High | 7.2 | 2025-07-25 | goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter. |
CVE-2022-4979 | | 2025-07-25 | A cross-site scripting (XSS) vulnerability exists in Sitecore Experience Platform (XP) 7.5 - 10.2 and CMS 7.2 - 7.2 Update-6 that may allow authenticated Sitec… | |
CVE-2025-52360 | High | 8.8 | 2025-07-25 | A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. Unsanitized input entered in the search… |
CVE-2025-51411 | Medium | 6.1 | 2025-07-25 | A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postquerypublic endpoint. The… |
CVE-2025-8155 | Low | 3.5 | 2025-07-25 | A vulnerability has been found in D-Link DCS-6010L 1.15.03 and classified as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-5254 | Medium | 6.1 | 2025-07-25 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kron Technologies Kron PAM allows Stored XSS. Thi… |
CVE-2025-3614 | Medium | 6.4 | 2025-07-24 | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in al… |
CVE-2025-8115 | Low | 3.5 | 2025-07-24 | A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown funct… |
CVE-2025-53084 | Critical | 9.0 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A speciall… |
CVE-2025-50128 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff… |
CVE-2025-47061 | Medium | 5.4 | 2025-07-24 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-46996 | Medium | 5.4 | 2025-07-24 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-46993 | Medium | 5.4 | 2025-07-24 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-46410 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 and dev master commi… |
CVE-2025-41420 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A spec… |
CVE-2025-36548 | High | 8.3 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8… |
CVE-2025-8071 | Medium | 6.4 | 2025-07-24 | Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to i… |
CVE-2025-7966 | Medium | 6.4 | 2025-07-24 | The Get Youtube Subs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘channel', 'layout', and 'subs_count’ parameters in all versions… |
CVE-2025-7959 | Medium | 6.4 | 2025-07-24 | The Station Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width' and 'height’ parameter in all versions up to, and including… |
CVE-2025-6588 | Medium | 6.1 | 2025-07-24 | The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 du… |
CVE-2025-6539 | Medium | 6.4 | 2025-07-24 | The Voltax Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.5 du… |
CVE-2025-6387 | Medium | 6.4 | 2025-07-24 | The WP Get The Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.5 due to… |
CVE-2025-6385 | Medium | 6.4 | 2025-07-24 | The WP Applink plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 0.4.1 due to i… |
CVE-2025-6382 | Medium | 6.4 | 2025-07-24 | The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's taeggie-feed shortcode in all versions up to, and including… |
CVE-2025-6262 | Medium | 6.4 | 2025-07-24 | The muse.ai video embedding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's muse-ai shortcode in all versions up to, and inc… |
CVE-2025-5084 | Medium | 6.1 | 2025-07-24 | The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘argsArray['read_more_text']’ parameter in all versions up to… |
CVE-2025-4608 | Medium | 6.4 | 2025-07-24 | The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all versions up to… |
CVE-2025-3669 | Medium | 6.4 | 2025-07-24 | The Supreme Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auto_qrcodesabb shortcode in all versi… |