CWE-79 · Cross-site Scripting (page 97)
Page 97 of 100 — CVEs classified under CWE-79, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-50976 | Medium | 6.1 | 2025-08-26 | IPFire 2.29 DNS management interface (dns.cgi) fails to properly sanitize user-supplied input in the NAMESERVER, REMARK, and TLS_HOSTNAME query parameters, res… |
CVE-2025-57425 | Medium | 6.1 | 2025-08-26 | A Stored Cross-Site Scripting (XSS) vulnerability in SourceCodester FAQ Management System 1.0 allows an authenticated attacker to inject malicious JavaScript i… |
CVE-2025-52184 | Medium | 6.1 | 2025-08-26 | Cross Site Scripting vulnerability in Helpy.io v.2.8.0 allows a remote attacker to escalate privileges via the New Topic Ticket funtion. |
CVE-2025-56432 | Medium | 6.1 | 2025-08-26 | A cross-site scripting (XSS) vulnerability exists in Nagios XI 2024R2. The vulnerability allows remote attackers to execute arbitrary JavaScript in the context… |
CVE-2025-52217 | Medium | 5.4 | 2025-08-26 | SelectZero Data Observability Platform before 2025.5.2 is vulnerable to HTML Injection. Legacy UI fields improperly handle user-supplied input, allowing inject… |
CVE-2025-52037 | Medium | 6.1 | 2025-08-26 | A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=sites. The manipulation of the… |
CVE-2025-52036 | Medium | 6.1 | 2025-08-26 | A vulnerability has been found in NotesCMS and classified as medium. Affected by this vulnerability is the page /index.php?route=categories. The manipulation o… |
CVE-2025-52035 | Medium | 6.1 | 2025-08-26 | A vulnerability in NotesCMS and specifically in the page /index.php?route=notes. The manipulation of the title of the service descriptions leads to a stored XS… |
CVE-2024-45753 | Medium | 6.1 | 2025-08-26 | In Mahara 23.04.8 and 24.04.4, the external RSS feed block can cause XSS if the external feed XML has a malicious value for the link attribute. |
CVE-2025-9440 | Medium | 4.3 | 2025-08-26 | A security vulnerability has been detected in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this issue is some unknown f… |
CVE-2025-9439 | Medium | 4.3 | 2025-08-26 | A weakness has been identified in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2025-9438 | Medium | 4.3 | 2025-08-26 | A security flaw has been discovered in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-9434 | Medium | 4.3 | 2025-08-26 | A vulnerability was determined in 1000projects Online Project Report Submission and Evaluation System 1.0. This affects an unknown function of the file /admin/… |
CVE-2025-9433 | Medium | 4.3 | 2025-08-26 | A vulnerability was found in mtons mblog up to 3.5.0. The impacted element is an unknown function of the file /admin/user/list of the component Admin Panel. Pe… |
CVE-2025-9432 | Medium | 4.3 | 2025-08-26 | A vulnerability has been found in mtons mblog up to 3.5.0. The affected element is an unknown function of the file /admin/post/list of the component Admin Pane… |
CVE-2025-9431 | Medium | 4.3 | 2025-08-26 | A flaw has been found in mtons mblog up to 3.5.0. Impacted is an unknown function of the file /search. This manipulation of the argument kw causes cross site s… |
CVE-2025-9430 | Low | 2.4 | 2025-08-26 | A vulnerability was detected in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /admin/options/update. The manipulation of the… |
CVE-2025-9429 | Low | 3.5 | 2025-08-26 | A security vulnerability has been detected in mtons mblog up to 3.5.0. This vulnerability affects unknown code of the file /post/submit of the component Post H… |
CVE-2025-9422 | Low | 2.4 | 2025-08-25 | A vulnerability was found in oitcode samarium up to 0.9.6. This impacts an unknown function of the file /dashboard/team of the component Team Image Handler. Th… |
CVE-2025-9416 | Low | 2.4 | 2025-08-25 | A security flaw has been discovered in oitcode samarium up to 0.9.6. This vulnerability affects unknown code of the file /cms/webpage/ of the component Pages I… |
CVE-2025-55574 | Medium | 6.1 | 2025-08-25 | Cross Site Scripting vulnerability in docmost v.0.21.0 and before allows an attacker to execute arbitrary code |
CVE-2025-55409 | High | 8.8 | 2025-08-25 | FoxCMS 1.2.6, there is a Cross Site Scripting vulnerability in /index.php/article. This allows attackers to execute arbitrary code. |
CVE-2025-3478 | | 2025-08-25 | A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Enterprise Security Manager. The vulnerability could be remotely exploited. | |
CVE-2024-39923 | Medium | 6.1 | 2025-08-25 | An issue was discovered in Mahara 24.04 before 24.04.2 and 23.04 before 23.04.7. The About, Contact, and Help footer links can be set up to be vulnerable to Cr… |
CVE-2025-9407 | Low | 3.5 | 2025-08-25 | A flaw has been found in mtons mblog up to 3.5.0. Affected by this vulnerability is an unknown functionality of the file /settings/profile. Executing manipulat… |
CVE-2025-54301 | | 2025-08-25 | A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped. | |
CVE-2025-54300 | | 2025-08-25 | A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads. | |
CVE-2025-9404 | Low | 2.4 | 2025-08-25 | A vulnerability was identified in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file /pointHierarchySLTS of the component Folder… |
CVE-2025-9388 | Low | 3.5 | 2025-08-24 | A vulnerability was determined in Scada-LTS up to 2.7.8.1. This impacts an unknown function of the file watch_list.shtm. Executing manipulation of the argument… |
CVE-2025-8208 | Medium | 6.4 | 2025-08-24 | The Spexo Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown widget in all versions up to, and i… |
CVE-2025-5352 | Critical | 9.6 | 2025-08-23 | A critical stored Cross-Site Scripting (XSS) vulnerability exists in the Analytics component of lunary-ai/lunary versions up to 1.9.23, where the NEXT_PUBLIC_C… |
CVE-2025-9131 | Medium | 6.4 | 2025-08-23 | The Ogulo – 360° Tour plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 1.0.11 d… |
CVE-2025-8062 | Medium | 6.4 | 2025-08-23 | The WS Theme Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ws_weather shortcode in all versions up to, and includin… |
CVE-2025-7957 | Medium | 6.4 | 2025-08-23 | The ShortcodeHub plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author_link_target’ parameter in all versions up to, and including… |
CVE-2025-43765 | Medium | 6.1 | 2025-08-23 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 t… |
CVE-2025-43769 | Medium | 6.1 | 2025-08-23 | Stored cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q3.1 through 2024.Q3.8, 2024.Q2.0 through 2024… |
CVE-2025-43770 | Medium | 6.1 | 2025-08-23 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.3, 2024.Q3.1 thro… |
CVE-2025-43761 | Medium | 6.1 | 2025-08-22 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 thro… |
CVE-2025-50859 | Medium | 6.1 | 2025-08-22 | Reflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute arbitra… |
CVE-2025-50858 | Medium | 6.1 | 2025-08-22 | Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute ar… |
CVE-2025-43760 | Medium | 5.4 | 2025-08-22 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 thro… |
CVE-2025-55620 | Medium | 6.1 | 2025-08-22 | A cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 allows attackers to execute arbitrary web scripts… |
CVE-2025-50733 | Medium | 6.1 | 2025-08-22 | NextChat contains a cross-site scripting (XSS) vulnerability in the HTMLPreview component of artifacts.tsx that allows attackers to execute arbitrary JavaScrip… |
CVE-2025-55573 | High | 8.8 | 2025-08-22 | QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS). |
CVE-2025-36042 | Medium | 5.4 | 2025-08-22 | IBM QRadar SIEM 7.5 through 7.5.0 Dashboard is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScrip… |
CVE-2025-57891 | Medium | 5.9 | 2025-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce Recurring PayPal Donations recurring-donation… |
CVE-2025-57890 | Medium | 5.9 | 2025-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy Sessions sessions allows Stored XSS.This is… |
CVE-2025-57887 | Medium | 6.5 | 2025-08-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Stored XSS.This… |
CVE-2025-8281 | High | 7.1 | 2025-08-22 | The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2025-43753 | Medium | 5.4 | 2025-08-21 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.32 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7, 2024.Q4.0 t… |
CVE-2025-55107 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticat… |
CVE-2025-55106 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-55105 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-55104 | Medium | 4.8 | 2025-08-21 | A stored cross-site scripting (XSS) vulnerability exists ArcGIS HUB and ArcGIS Enterprise Sites which allows an authenticated user with the ability to create o… |
CVE-2025-55103 | Medium | 4.8 | 2025-08-21 | There is a stored Cross-site Scripting vulnerability in Esri Portal for ArcGIS Enterprise Sites versions 10.9.1 – 11.4 that may allow a remote, authenticated a… |
CVE-2025-57768 | | 2025-08-21 | Phproject is a high performance full-featured project management system. From 1.8.0 to before 1.8.3, a Stored Cross-Site Scripting (XSS) vulnerability exists i… | |
CVE-2025-7969 | Medium | 6.1 | 2025-08-21 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in markdown-it allows Cross-Site Scripting (XSS). Thi… |
CVE-2025-57765 | Medium | 6.5 | 2025-08-21 | WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the pre_cadastro_ado… |
CVE-2025-57764 | Medium | 6.5 | 2025-08-21 | WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cargos.php endpo… |
CVE-2025-57763 | Medium | 6.1 | 2025-08-21 | WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the insere_despacho.php en… |
CVE-2025-57762 | Medium | 6.1 | 2025-08-21 | WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Stored Cross-Site Scripting (XSS) vulnerability in the dependente_docdependente… |
CVE-2025-55522 | Medium | 6.5 | 2025-08-21 | Cross-site scripting (XSS) vulnerability in the component /common/reports of Akaunting v3.1.18 allows attackers to execute arbitrary web scripts or HTML via in… |
CVE-2025-43756 | Medium | 5.4 | 2025-08-21 | <!--td {border: 1px solid #cccccc;}br {mso-data-placement:same-cell;}-->A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, a… |
CVE-2025-43755 | Medium | 5.4 | 2025-08-21 | A Stored cross-site scripting vulnerability in the Liferay Portal 7.4.0 t through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.13, 2024.Q4.0… |
CVE-2025-9306 | Low | 3.5 | 2025-08-21 | A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/notice… |
CVE-2025-55742 | High | 8.0 | 2025-08-21 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. Before 0.2.1, UnoPim contains a stored cross-site scriptin… |
CVE-2025-55420 | High | 8.8 | 2025-08-21 | A Reflected Cross Site Scripting (XSS) vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is sent via a GET request, it is reflected… |
CVE-2025-8064 | Medium | 6.4 | 2025-08-21 | The Bible SuperSearch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘selector_height’ parameter in all versions up to, and includin… |
CVE-2025-8607 | Medium | 6.4 | 2025-08-21 | The SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countd… |
CVE-2025-53504 | Medium | 5.4 | 2025-08-21 | Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vulnerability is exp… |
CVE-2025-43757 | Medium | 5.4 | 2025-08-20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 thro… |
CVE-2025-43746 | Medium | 5.4 | 2025-08-20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.2, 2025.Q1.0 thro… |
CVE-2025-9237 | Low | 3.5 | 2025-08-20 | A vulnerability was found in CodeAstro Ecommerce Website 1.0. This impacts an unknown function of the file /customer/my_account.php?edit_account of the compone… |
CVE-2025-47054 | Medium | 5.4 | 2025-08-20 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could expl… |
CVE-2025-9235 | Low | 3.5 | 2025-08-20 | A flaw has been found in Scada-LTS up to 2.7.8.1. The impacted element is an unknown function of the file compound_events.shtm. This manipulation of the argume… |
CVE-2025-9234 | Low | 3.5 | 2025-08-20 | A vulnerability was detected in Scada-LTS up to 2.7.8.1. The affected element is an unknown function of the file maintenance_events.shtm. The manipulation of t… |
CVE-2025-46998 | Medium | 5.4 | 2025-08-20 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-46962 | Medium | 5.4 | 2025-08-20 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-46936 | Medium | 5.4 | 2025-08-20 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-46932 | Medium | 5.4 | 2025-08-20 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-46856 | Medium | 5.4 | 2025-08-20 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. A low privileged attacker could expl… |
CVE-2025-46852 | Medium | 5.4 | 2025-08-20 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-46849 | Medium | 5.4 | 2025-08-20 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-9233 | Low | 3.5 | 2025-08-20 | A security vulnerability has been detected in Scada-LTS up to 2.7.8.1. Impacted is an unknown function of the file view_edit.shtm. The manipulation of the argu… |
CVE-2025-51991 | High | 8.8 | 2025-08-20 | XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info fie… |
CVE-2025-51990 | Medium | 4.8 | 2025-08-20 | XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the… |
CVE-2025-54175 | Medium | 6.1 | 2025-08-20 | QuickCMS.EXT is vulnerable to Reflected XSS in sFileName parameter in thumbnail viewer functionality. An attacker can craft a malicious URL that results in ar… |
CVE-2025-54172 | Medium | 4.8 | 2025-08-20 | QuickCMS is vulnerable to Stored XSS in sTitle parameter in page editor functionality. Malicious attacker with admin privileges can inject arbitrary HTML and J… |
CVE-2025-43742 | Medium | 6.1 | 2025-08-20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 thro… |
CVE-2025-43741 | Medium | 5.4 | 2025-08-20 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 thro… |
CVE-2025-57731 | High | 8.7 | 2025-08-20 | In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content |
CVE-2025-9225 | Medium | 5.5 | 2025-08-20 | Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution of arbitrary JavaSc… |
CVE-2025-54670 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows Reflected XSS.This issue affec… |
CVE-2025-54056 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playl… |
CVE-2025-54055 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Druco druco allows Reflected XSS.This issue affe… |
CVE-2025-54046 | Medium | 6.5 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows St… |
CVE-2025-54044 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player all… |
CVE-2025-54032 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manage… |
CVE-2025-54027 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS… |
CVE-2025-53564 | High | 7.1 | 2025-08-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup HTML5 Radio Player - WPBakery Page Builder A… |