CWE-79 · Cross-site Scripting (page 87)
Page 87 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53820 | Medium | 6.5 | 2025-07-14 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability w… |
CVE-2025-7601 | Low | 3.5 | 2025-07-14 | A vulnerability has been found in PHPGurukul Online Library Management System 3.0 and classified as problematic. This vulnerability affects unknown code of the… |
CVE-2025-7618 | | 2025-07-14 | A stored Cross-Site Scripting (XSS) vulnerability vulnerability was found in the File Explorer and Text Editor of ADM. An attacker could exploit this vulnerabi… | |
CVE-2025-7380 | | 2025-07-14 | A stored Cross-Site Scripting (XSS) vulnerability exists in the Access Control of ADM, the issue allows an attacker to inject malicious scripts into the folder… | |
CVE-2025-7569 | Low | 3.5 | 2025-07-14 | A vulnerability was found in Bigotry OneBase up to 1.3.6. It has been declared as problematic. Affected by this vulnerability is the function parse_args of the… |
CVE-2025-7567 | Medium | 4.3 | 2025-07-14 | A vulnerability was found in ShopXO up to 6.5.0 and classified as problematic. This issue affects some unknown processing of the file header.html. The manipula… |
CVE-2025-7554 | Low | 2.4 | 2025-07-14 | A vulnerability classified as problematic was found in Sapido RB-1802 1.0.32. This vulnerability affects unknown code of the file urlfilter.asp of the componen… |
CVE-2025-53865 | Medium | 6.4 | 2025-07-13 | In Roundup before 2.5.0, XSS can occur via interaction between URLs and issue tracker templates (devel and responsive). |
CVE-2023-38329 | Medium | 6.1 | 2025-07-11 | An issue was discovered in eGroupWare 17.1.20190111. A cross-site scripting Reflected (XSS) vulnerability exists in calendar/freebusy.php, which allows unauthe… |
CVE-2025-6068 | Medium | 6.4 | 2025-07-11 | The FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th… |
CVE-2025-5530 | Medium | 6.4 | 2025-07-11 | The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'shortcode_btn' shortcode in all versi… |
CVE-2025-6716 | Medium | 6.4 | 2025-07-11 | The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugi… |
CVE-2025-6200 | Medium | 5.9 | 2025-07-11 | The GeoDirectory WordPress plugin before 2.8.120 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2025-7435 | Low | 3.5 | 2025-07-11 | A vulnerability was found in LiveHelperChat lhc-php-resque Extension up to ee1270b35625f552425e32a6a3061cd54b5085c4. It has been classified as problematic. Thi… |
CVE-2025-53519 | Medium | 5.4 | 2025-07-11 | A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulati… |
CVE-2025-53397 | Medium | 5.4 | 2025-07-11 | A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By exploiting… |
CVE-2025-41442 | Medium | 5.4 | 2025-07-11 | A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulati… |
CVE-2025-45662 | Medium | 6.1 | 2025-07-10 | A cross-site scripting (XSS) vulnerability in the component /master/login.php of mpgram-web commit 94baadb allows attackers to execute arbitrary Javascript in… |
CVE-2025-53626 | Medium | 6.1 | 2025-07-10 | pdfme is a TypeScript-based PDF generator and React-based UI. The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allow… |
CVE-2025-28245 | Medium | 6.1 | 2025-07-10 | Cross-site scripting (XSS) vulnerability in Alteryx Server 2023.1.1.460 allows remote attackers to inject arbitrary web script or HTML via the notification bod… |
CVE-2025-28243 | High | 8.0 | 2025-07-10 | An issue in Alteryx Server v.2023.1.1.460 allows HTML injection via a crafted script to the pages component. |
CVE-2025-7408 | Low | 3.5 | 2025-07-10 | A vulnerability has been found in SourceCodester Zoo Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /… |
CVE-2024-36697 | Medium | 6.1 | 2025-07-10 | A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrary web scripts or HT… |
CVE-2025-6948 | High | 8.7 | 2025-07-10 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.11 before 17.11.6, 18.0 before 18.0.4, and 18.1 before 18.1.2 that, under certain c… |
CVE-2025-7387 | Medium | 5.5 | 2025-07-10 | The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10… |
CVE-2025-6236 | Medium | 4.8 | 2025-07-10 | The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2025-6234 | Medium | 6.1 | 2025-07-10 | The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2025-5807 | Medium | 6.1 | 2025-07-10 | The Gwolle Guestbook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘gwolle_gb_content’ parameter in all versions up to, and includi… |
CVE-2025-4406 | Medium | 5.4 | 2025-07-10 | The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.4.5 due to insu… |
CVE-2025-6976 | Medium | 6.4 | 2025-07-09 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in a… |
CVE-2025-6975 | Medium | 6.1 | 2025-07-09 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ para… |
CVE-2025-52357 | Medium | 4.1 | 2025-07-09 | Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowing an authenticate… |
CVE-2021-27961 | Medium | 6.5 | 2025-07-09 | evesys 7.1 (2152) through 8.0 (2202) allows Reflected XSS via the indexeva.php action parameter. |
CVE-2025-53658 | Medium | 5.4 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page, resulting in a stored cross-site scripting (XSS) vulner… |
CVE-2025-7059 | Medium | 6.4 | 2025-07-09 | The Simple Featured Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slideshow’ parameter in all versions up to, and including… |
CVE-2025-5678 | Medium | 6.4 | 2025-07-09 | The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘redirectURL’ para… |
CVE-2025-49547 | Medium | 5.4 | 2025-07-08 | Adobe Experience Manager versions FP11.4 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2025-49534 | Medium | 5.4 | 2025-07-08 | Adobe Experience Manager versions FP11.4 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged… |
CVE-2025-49543 | Medium | 4.3 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privi… |
CVE-2025-49542 | Medium | 5.2 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenticated attacker i… |
CVE-2025-49541 | Medium | 4.3 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privi… |
CVE-2025-49540 | Medium | 4.3 | 2025-07-08 | ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privi… |
CVE-2023-43039 | Medium | 6.1 | 2025-07-08 | IBM OpenPages with Watson 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alte… |
CVE-2025-7363 | Medium | 5.4 | 2025-07-08 | The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the #titleicon_unicode parser function. User input passed to this function is wrapped… |
CVE-2025-7362 | Medium | 5.4 | 2025-07-08 | The MsUpload extension for MediaWiki is vulnerable to stored XSS via the msu-continue system message, which is inserted into the DOM without proper sanitizatio… |
CVE-2025-53479 | Medium | 5.4 | 2025-07-08 | The CheckUser extension’s Special:CheckUser interface is vulnerable to reflected XSS via the rev-deleted-user message. This message is rendered without proper… |
CVE-2025-7182 | Medium | 4.3 | 2025-07-08 | A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0 and classified as problematic. Affected by this vulnerability is an unk… |
CVE-2025-53480 | Medium | 5.4 | 2025-07-08 | The CheckUser extension’s Special:Investigate page has a vulnerability in the Account information tab, where specific internationalized messages are rendered w… |
CVE-2025-3630 | Medium | 6.4 | 2025-07-08 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 … |
CVE-2025-2793 | Medium | 5.4 | 2025-07-08 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 … |
CVE-2025-40721 | Medium | 5.4 | 2025-07-08 | Reflected Cross-site Scripting (XSS) vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to execute Jav… |
CVE-2025-40720 | Medium | 6.1 | 2025-07-08 | Reflected Cross-site Scripting (XSS) vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to execute Jav… |
CVE-2025-40719 | Medium | 6.1 | 2025-07-08 | Reflected Cross-site Scripting (XSS) vulnerability in versions prior to 4.7.0 of Quiter Gateway by Quiter. This vulnerability allows an attacker to execute Jav… |
CVE-2025-6743 | Medium | 6.4 | 2025-07-08 | The Woodmart theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'multiple_markers' attribute in all versions up to, and includin… |
CVE-2025-42956 | Medium | 6.1 | 2025-07-08 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. W… |
CVE-2025-5537 | Medium | 6.4 | 2025-07-08 | The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alternative texts in all versi… |
CVE-2025-6244 | Medium | 6.4 | 2025-07-08 | The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via `Cal… |
CVE-2025-5570 | Medium | 5.4 | 2025-07-08 | The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwai_chatbot shortcode 'id' parameter in all versions up to, and includ… |
CVE-2025-42973 | Medium | 5.4 | 2025-07-08 | Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associate… |
CVE-2025-42969 | Medium | 6.1 | 2025-07-08 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The vic… |
CVE-2025-42962 | Medium | 6.1 | 2025-07-08 | SAP Business Warehouse (Business Explorer Web) allows an attacker to create a malicious link. If an authenticated user clicks on this link, the injected script… |
CVE-2025-7153 | Low | 3.5 | 2025-07-08 | A vulnerability classified as problematic was found in CodeAstro Simple Hospital Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-7148 | Low | 3.5 | 2025-07-07 | A vulnerability was found in CodeAstro Simple Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionalit… |
CVE-2025-7144 | Low | 2.4 | 2025-07-07 | A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the… |
CVE-2025-7143 | Low | 2.4 | 2025-07-07 | A vulnerability, which was classified as problematic, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /p… |
CVE-2025-7142 | Low | 2.4 | 2025-07-07 | A vulnerability, which was classified as problematic, has been found in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown… |
CVE-2025-53543 | Medium | 4.2 | 2025-07-07 | Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP re… |
CVE-2025-53496 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MediaSearch Exten… |
CVE-2025-7141 | Low | 2.4 | 2025-07-07 | A vulnerability classified as problematic was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-7140 | Low | 2.4 | 2025-07-07 | A vulnerability classified as problematic has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel… |
CVE-2025-53488 | Medium | 6.1 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiHiero Extensi… |
CVE-2025-53478 | Medium | 5.4 | 2025-07-07 | The CheckUser extension’s Special:Investigate interface is vulnerable to reflected XSS due to improper escaping of certain internationalized system messages re… |
CVE-2025-7139 | Low | 2.4 | 2025-07-07 | A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of t… |
CVE-2025-53526 | Medium | 6.1 | 2025-07-07 | WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was submitted, the vuln… |
CVE-2025-53525 | Medium | 6.1 | 2025-07-07 | WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familiar.php endpoint of… |
CVE-2025-53497 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RelatedArticles E… |
CVE-2025-53491 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - FlaggedRevs Exten… |
CVE-2025-53377 | Medium | 6.1 | 2025-07-07 | WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_dependente_pessoa_nova… |
CVE-2025-7057 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Quiz Extension al… |
CVE-2025-53487 | Medium | 5.4 | 2025-07-07 | The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper esca… |
CVE-2025-53486 | Medium | 5.4 | 2025-07-07 | The WikiCategoryTagCloud extension is vulnerable to reflected XSS via the linkstyle attribute, which is improperly concatenated into inline HTML without escapi… |
CVE-2025-7056 | Medium | 6.3 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UrlShortener Exte… |
CVE-2025-4779 | Medium | 6.1 | 2025-07-07 | lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into… |
CVE-2025-3467 | Medium | 5.4 | 2025-07-07 | An XSS vulnerability exists in langgenius/dify versions prior to 1.1.3, specifically affecting Firefox browsers. This vulnerability allows an attacker to obtai… |
CVE-2024-43334 | High | 7.1 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gavias Zilom zilom allows Reflected XSS.This issue affect… |
CVE-2025-7113 | Low | 3.5 | 2025-07-07 | A vulnerability was found in Portabilis i-Educar 2.9.0. It has been classified as problematic. Affected is an unknown function of the file /module/ComponenteCu… |
CVE-2025-7112 | Low | 3.5 | 2025-07-07 | A vulnerability was found in Portabilis i-Educar 2.9.0 and classified as problematic. This issue affects some unknown processing of the file /intranet/educar_f… |
CVE-2025-7111 | Low | 3.5 | 2025-07-07 | A vulnerability has been found in Portabilis i-Educar 2.9.0 and classified as problematic. This vulnerability affects unknown code of the file /intranet/educar… |
CVE-2025-7110 | Low | 3.5 | 2025-07-07 | A vulnerability, which was classified as problematic, was found in Portabilis i-Educar 2.9.0. This affects an unknown part of the file /intranet/educar_escola_… |
CVE-2025-7109 | Low | 3.5 | 2025-07-07 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.9.0. Affected by this issue is some unknown functionality of the… |
CVE-2025-53484 | Critical | 9.8 | 2025-07-04 | User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-contro… |
CVE-2025-53482 | Medium | 6.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension… |
CVE-2025-7066 | Medium | 6.1 | 2025-07-04 | Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scri… |
CVE-2025-6740 | Medium | 6.1 | 2025-07-04 | The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and includi… |
CVE-2025-52798 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This i… |
CVE-2025-52796 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tggfref WP-Recall allows Reflected XSS. This issue affect… |
CVE-2025-52776 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thanhtungtnt Video List Manager video-list-manager allows… |
CVE-2025-49866 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner beautiful-and-respo… |
CVE-2025-49274 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awordpresslife Neom Blog neom-blog allows Reflected XSS.T… |
CVE-2025-49247 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Team Showcase team-showcase-cm allows DOM-Based… |