CWE-79 · Cross-site Scripting (page 92)
Page 92 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-9035 | Medium | 5.4 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Horato Internet Technologies Ind. And Trade Inc. V… |
CVE-2025-8079 | Medium | 4.6 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. Smar… |
CVE-2025-53692 | High | 7.1 | 2025-09-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecor… |
CVE-2025-10758 | Low | 2.4 | 2025-09-21 | A security vulnerability has been detected in htmly up to 3.1.0. The impacted element is an unknown function of the file /htmly/admin/field/post of the compone… |
CVE-2025-10181 | Medium | 6.4 | 2025-09-20 | The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'drafts' shortcode in all versions up to, and including, 2.6… |
CVE-2025-56762 | Medium | 6.1 | 2025-09-19 | Paracrawl KeOPs v2 is vulnerable to Cross Site Scripting (XSS) in error.php. |
CVE-2025-26514 | Medium | 6.4 | 2025-09-19 | StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Reflected Cross-Site Scripting vulnerability. Succ… |
CVE-2025-36248 | Medium | 6.1 | 2025-09-19 | IBM Copy Services Manager 6.3.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in… |
CVE-2025-8664 | Medium | 6.3 | 2025-09-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saysis Computer Systems Trade Ltd. Co. StarCities… |
CVE-2025-58114 | Medium | 4.8 | 2025-09-19 | Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects… |
CVE-2025-57880 | Medium | 5.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS). This is… |
CVE-2025-48007 | Medium | 6.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS). This issue… |
CVE-2025-46703 | Medium | 6.4 | 2025-09-19 | Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS). This issue affect… |
CVE-2025-10711 | Medium | 4.3 | 2025-09-19 | A vulnerability has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This vulnerability affects unknown code of the file /index.php/sysmanage/Log… |
CVE-2025-10710 | Medium | 4.3 | 2025-09-19 | A flaw has been found in 07FLYCMS, 07FLY-CMS and 07FlyCRM up to 20250831. This affects an unknown part of the file /index.php. This manipulation of the argumen… |
CVE-2025-9969 | High | 7.1 | 2025-09-19 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Packages allows Conte… |
CVE-2025-10146 | Medium | 6.1 | 2025-09-19 | The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘user_ids’ parameter in all versions up to, and including, 3… |
CVE-2025-59715 | Medium | 4.8 | 2025-09-19 | SMSEagle before 6.11 allows reflected XSS via a username or contact phone number. |
CVE-2025-59712 | Medium | 6.4 | 2025-09-19 | Snipe-IT before 8.1.18 allows XSS. |
CVE-2025-30755 | Medium | 6.1 | 2025-09-19 | OpenGrok 1.14.1 has a reflected Cross-Site Scripting (XSS) issue when producing the cross reference page. This happens through improper handling of the revisio… |
CVE-2025-59424 | High | 7.3 | 2025-09-18 | LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting (XSS) vulnerability has been identified on the /system… |
CVE-2025-36139 | Medium | 5.5 | 2025-09-18 | IBM Lakehouse (watsonx.data 2.2) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code i… |
CVE-2025-59417 | Medium | 6.1 | 2025-09-18 | Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.129.4, there is a a cross-site scripting (XSS) vulnerability when handli… |
CVE-2025-57452 | Medium | 6.1 | 2025-09-18 | In realme BackupRestore app v15.1.12_2810c08_250314, improper URI scheme handling in com.coloros.pc.PcToolMainActivity allows local attackers to cause a crash… |
CVE-2025-9992 | Medium | 6.4 | 2025-09-18 | The Ghost Kit – Page Builder Blocks, Motion Effects & Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS field in a… |
CVE-2025-0547 | Medium | 4.7 | 2025-09-18 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Bizmu allows Cross-Site Scripting… |
CVE-2025-10642 | Low | 3.5 | 2025-09-18 | A vulnerability has been found in wangchenyi1996 chat_forum up to 80bdb92f5b460d36cab36e530a2c618acef5afd2. This impacts an unknown function of the file /q.php… |
CVE-2025-10632 | Low | 3.5 | 2025-09-18 | A security flaw has been discovered in itsourcecode Online Petshop Management System 1.0. The affected element is an unknown function of the file availablefram… |
CVE-2025-10631 | Low | 3.5 | 2025-09-18 | A vulnerability was identified in itsourcecode Online Petshop Management System 1.0. Impacted is an unknown function of the file addcnp.php of the component Av… |
CVE-2025-59415 | Medium | 4.6 | 2025-09-17 | Frappe Learning is a learning system that helps users structure their content. In versions 2.34.1 and below, there is a security vulnerability in Frappe Learni… |
CVE-2025-37122 | Medium | 6.1 | 2025-09-17 | A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected… |
CVE-2025-10614 | Medium | 4.3 | 2025-09-17 | A vulnerability was determined in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0 on COVID. This affects an unknown function of the file… |
CVE-2025-10606 | Medium | 4.3 | 2025-09-17 | A weakness has been identified in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /module/Configuracao/ConfiguracaoMovim… |
CVE-2025-10605 | Medium | 4.3 | 2025-09-17 | A security flaw has been discovered in Portabilis i-Educar up to 2.10. This vulnerability affects unknown code of the file /agenda_preferencias.php. The manipu… |
CVE-2025-0879 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Shopside Software Shopside App allows Cross-Site S… |
CVE-2025-8411 | High | 7.1 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dokuzsoft Technology E-Commerce Web Design Product… |
CVE-2025-0546 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Restriction of Rendered UI Layers or Frames vulnerability… |
CVE-2025-10591 | Low | 3.5 | 2025-09-17 | A weakness has been identified in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/educar_funcao_cad.php of the component… |
CVE-2025-10590 | Medium | 4.3 | 2025-09-17 | A security flaw has been discovered in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file /intranet/educar_usuario_det.php… |
CVE-2025-0420 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripti… |
CVE-2025-0419 | Medium | 4.7 | 2025-09-17 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. Zirve Nova all… |
CVE-2025-9565 | Medium | 6.4 | 2025-09-17 | The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocksy_newsletter_subscribe shortcode in all versions… |
CVE-2025-9203 | Medium | 6.4 | 2025-09-17 | The Media Player Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'subtitle_ssize', 'track_title', and 'track_art… |
CVE-2025-10584 | Low | 3.5 | 2025-09-17 | A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anotacao_cad.php. Suc… |
CVE-2025-9851 | Medium | 6.4 | 2025-09-17 | The Appointmind plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'appointmind_calendar' shortcode in all versions up to, and… |
CVE-2025-8394 | Medium | 6.4 | 2025-09-17 | The Productive Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's display_productive_breadcrumb shortcode in all versions… |
CVE-2025-8153 | | 2025-09-17 | Cross-site Scripting vulnerability in NEC Corporation UNIVERGE IX from Ver.9.5 to Ver.10.7, from Ver.10.8.21 to Ver.10.8.36, from Ver.10.9.11 to Ver.10.9.24, f… | |
CVE-2025-10166 | Medium | 6.4 | 2025-09-17 | The Social Media Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'twitter' shortcode in all versions up to, and i… |
CVE-2025-43804 | Medium | 6.1 | 2025-09-16 | Cross-site scripting (XSS) vulnerability in Search widget in Liferay Portal 7.4.3.93 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4… |
CVE-2025-10566 | Medium | 4.3 | 2025-09-16 | A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /index.php… |
CVE-2025-58174 | Medium | 4.6 | 2025-09-16 | LDAP Account Manager (LAM) is a webfrontend for managing entries stored in an LDAP directory. LAM before 9.3 allows stored cross-site scripting in the Profile… |
CVE-2025-57145 | Medium | 5.4 | 2025-09-16 | A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize… |
CVE-2025-56293 | Medium | 5.4 | 2025-09-16 | code-projects Human Resource Integrated System 1.0 is vulnerable to Cross Site Scripting (XSS) in the Add Child Information section in the Childs Name field. |
CVE-2025-56289 | Medium | 5.4 | 2025-09-16 | code-projects Document Management System 1.0 has a Cross Site Scripting (XSS) vulnerability, where attackers can leak admin's cookie information by entering ma… |
CVE-2025-56280 | Medium | 5.4 | 2025-09-16 | code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the area where users submit reservation information. |
CVE-2025-8276 | Medium | 4.3 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization o… |
CVE-2025-56276 | Medium | 5.4 | 2025-09-16 | code-projects Food Ordering Review System 1.0 is vulnerable to Cross Site Scripting (XSS) in the registration function. An attacker enters malicious JavaScript… |
CVE-2024-12796 | Medium | 5.3 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows… |
CVE-2025-55834 | Medium | 6.1 | 2025-09-16 | A Cross Site Scripting vulnerability in JeeWMS v.3.7 and before allows a remote attacker to obtain sensitive information via the logController.do component |
CVE-2025-10546 | | 2025-09-16 | This vulnerability exist in PPC 2K15X Router, due to improper input validation for the Common Gateway Interface (CGI) parameters at its web management portal… | |
CVE-2025-10534 | High | 8.1 | 2025-09-16 | Spoofing issue in the Site Permissions component. This vulnerability was fixed in Firefox 143 and Thunderbird 143. |
CVE-2025-6575 | Medium | 5.4 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Dolusoft Omaspot allows Reflected XSS. This issue… |
CVE-2025-56697 | Medium | 6.1 | 2025-09-16 | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Computer Base Test v1… |
CVE-2025-2404 | Medium | 4.3 | 2025-09-16 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ubit Information Technologies STOYS allows Cross-S… |
CVE-2025-10316 | | 2025-09-16 | The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from… | |
CVE-2025-10485 | Medium | 4.3 | 2025-09-15 | A vulnerability has been found in pojoin h3blog up to 5bf704425ebc11f4c24da51f32f36bb17ae20489. Affected by this issue is the function ppt_log of the file /log… |
CVE-2025-6947 | | 2025-09-15 | A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An authe… | |
CVE-2025-57117 | Medium | 5.4 | 2025-09-15 | A Clickjacking vulnerability exists in Rems' Employee Management System 1.0. This flaw allows remote attackers to execute arbitrary JavaScript on the departmen… |
CVE-2025-43802 | Medium | 6.1 | 2025-09-15 | Stored cross-site scripting (XSS) vulnerability in a custom object’s /o/c/<object-name> API endpoint in Liferay Portal 7.4.3.51 through 7.4.3.109, and Liferay… |
CVE-2025-59332 | High | 8.6 | 2025-09-15 | 3DAlloy is a lightWeight 3D-viewer for MediaWiki. From 1.0 through 1.8, the <3d> parser tag and the {{#3d}} parser function allow users to provide custom attri… |
CVE-2025-45091 | Medium | 5.4 | 2025-09-15 | Seafile versions 11.0.18-Pro, 12.0.10, and 12.0.10-Pro are vulnerable to a stored Cross-Site Scripting (XSS) attack. An authenticated attacker can exploit this… |
CVE-2025-43800 | Medium | 6.1 | 2025-09-15 | Cross-site scripting (XSS) vulnerability in Objects in Liferay Portal 7.4.3.20 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4 and 7… |
CVE-2025-52344 | Medium | 6.1 | 2025-09-15 | Multiple Cross Site Scripting (XSS) vulnerabilities in input fields in Explorance Blue 8.1.2 allows attackers to inject arbitrary JavaScript code on the user's… |
CVE-2025-43791 | Medium | 6.1 | 2025-09-15 | Multiple cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA t… |
CVE-2025-58177 | Medium | 5.4 | 2025-09-15 | n8n is an open source workflow automation platform. From 1.24.0 to before 1.107.0, there is a stored cross-site scripting (XSS) vulnerability in @n8n/n8n-nodes… |
CVE-2025-58172 | | 2025-09-15 | drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting (XSS) vulnerability exists in the debug logging… | |
CVE-2025-56252 | Medium | 6.1 | 2025-09-15 | Cross Site Scripting (xss) vulnerability in ServitiumCRM 2.10 allowing attackers to execute arbitrary code via a crafted URL to the mobile parameter. |
CVE-2025-43794 | Medium | 4.8 | 2025-09-15 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1… |
CVE-2025-9826 | Medium | 5.4 | 2025-09-15 | Stored cross-site scripting vulnerability in M-Files Hubshare before version 25.8 allows authenticated attackers to cause script execution for other users. |
CVE-2025-10434 | Low | 2.4 | 2025-09-15 | A vulnerability was identified in IbuyuCMS up to 2.6.3. Impacted is an unknown function of the file /admin/article.php?a=mod of the component Add Article Page… |
CVE-2025-10411 | Medium | 4.3 | 2025-09-14 | A vulnerability was detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /… |
CVE-2025-10388 | Low | 3.5 | 2025-09-14 | A vulnerability was identified in Selleo Mentingo 2025.08.27. This issue affects some unknown processing of the file /api/course/enroll-course of the component… |
CVE-2025-10386 | Medium | 4.3 | 2025-09-14 | A vulnerability was found in Yida ECMS Consulting Enterprise Management System 1.0. This affects an unknown part of the file /login.do of the component POST Re… |
CVE-2025-10373 | Low | 3.5 | 2025-09-13 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /intranet/educar_turma_ti… |
CVE-2025-10372 | Low | 3.5 | 2025-09-13 | A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_modulo_cad.php. This manipulatio… |
CVE-2025-10370 | Low | 3.5 | 2025-09-13 | A vulnerability was identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. This vulnerability affects unknown code of the file /htdocs/userScripts.php. The manip… |
CVE-2025-10369 | Low | 3.5 | 2025-09-13 | A vulnerability was determined in MiczFlor RPi-Jukebox-RFID up to 2.8.0. This affects an unknown part of the file /htdocs/cardRegisterNew.php. Executing manipu… |
CVE-2025-10368 | Low | 3.5 | 2025-09-13 | A vulnerability was found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this issue is some unknown functionality of the file /htdocs/manageFilesFolders… |
CVE-2025-10367 | Low | 3.5 | 2025-09-13 | A vulnerability has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected by this vulnerability is an unknown functionality of the file /htdocs/cardEdi… |
CVE-2025-10366 | Low | 3.5 | 2025-09-13 | A flaw has been found in MiczFlor RPi-Jukebox-RFID up to 2.8.0. Affected is an unknown function of the file /htdocs/inc.setWlanIpMail.php. This manipulation of… |
CVE-2025-10340 | Low | 3.5 | 2025-09-13 | A vulnerability was determined in WhatCD Gazelle up to 63b337026d49b5cf63ce4be20fdabdc880112fa3. The affected element is an unknown function of the file /secti… |
CVE-2025-10332 | Low | 3.5 | 2025-09-13 | A vulnerability was found in cdevroe unmark up to 1.9.3. Impacted is an unknown function of the file application/views/marks/info.php. Performing manipulation… |
CVE-2025-10331 | Low | 3.5 | 2025-09-13 | A vulnerability has been found in cdevroe unmark up to 1.9.3. This issue affects some unknown processing of the file /application/controllers/Marks.php. Such m… |
CVE-2025-10330 | Medium | 4.3 | 2025-09-12 | A flaw has been found in cdevroe unmark up to 1.9.3. This vulnerability affects unknown code of the file application/views/layouts/topbar/searchform.php. This… |
CVE-2025-45585 | Medium | 5.4 | 2025-09-12 | Multiple stored cross-site scripting (XSS) vulnerabilities in Audi UTR 2.0 Universal Traffic Recorder 2.0 allows attackers to execute arbitrary web scripts or… |
CVE-2025-52074 | Medium | 6.1 | 2025-09-12 | PHPGURUKUL Online Shopping Portal 2.1 is vulnerable to Cross Site Scripting (XSS) due to lack of input sanitization in the quantity parameter when adding a pro… |
CVE-2025-43787 | Medium | 5.4 | 2025-09-12 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0… |
CVE-2025-55996 | Medium | 6.3 | 2025-09-12 | Viber Desktop 25.6.0 is vulnerable to HTML Injection via the text parameter of the message compose/forward interface |
CVE-2025-8280 | Medium | 5.8 | 2025-09-12 | The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, wh… |
CVE-2025-9879 | Medium | 6.4 | 2025-09-12 | The Spotify Embed Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spotify' shortcode in all versions up to, and inc… |