Export limit exceeded: 10794 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 44166 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (44166 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-62715 | 2 Clip-bucket, Oxygenz | 2 Clipbucket, Clipbucket | 2025-11-10 | 5.4 Medium |
| ClipBucket v5 is an open source video sharing platform. Versions 5.5.2-#147 and below contain a stored Cross-Site Scripting (XSS) vulnerability in ClipBucket’s Collection tags feature. An authenticated normal user can create a tag containing HTML or JavaScript, which is later rendered unescaped in collection detail and tag-list pages. As a result, arbitrary JavaScript executes in the browsers of all users who view the affected pages. This issue is fixed in version 5.5.2-#152. | ||||
| CVE-2025-48076 | 1 Galette | 1 Galette | 2025-11-10 | 5.4 Medium |
| Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0. | ||||
| CVE-2025-48884 | 1 Galette | 1 Galette | 2025-11-10 | 6.1 Medium |
| Galette is a membership management web application for non profit organizations. In versions 1.1.5.2 and below, Galette's Document Type is vulnerable to Cross-site Scripting. This issue is fixed in version 1.2.0. | ||||
| CVE-2025-63589 | 1 Cmsimple-xh | 1 Cmsimple Xh | 2025-11-10 | 7.1 High |
| A reflected XSS vulnerability exists in CMSimple_XH 1.8's index.php router when attacker-controlled path segments are not sanitized or encoded before being inserted into the generated HTML (navigation links, breadcrumbs, search form action, footer links). An attacker-controlled string placed in the URL path is reflected into multiple HTML elements, allowing execution of arbitrary JavaScript in victims' browsers visiting a crafted URL. | ||||
| CVE-2025-63588 | 1 Cmsimple-xh | 1 Cmsimple Xh | 2025-11-10 | 7.1 High |
| An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via a crafted request (e.g., a maliciously crafted POST login). Successful exploitation may lead to theft of session cookies, credential disclosure, or other client-side impacts. | ||||
| CVE-2025-62264 | 1 Liferay | 4 Digital Experience Platform, Dxp, Liferay Portal and 1 more | 2025-11-10 | 6.1 Medium |
| Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, and 7.4 update 4 through update 92 allows remote attackers to inject arbitrary web script or HTML via the `_com_liferay_portal_language_override_web_internal_portlet_PLOPortlet_selectedLanguageId` parameter. | ||||
| CVE-2025-62267 | 1 Liferay | 4 Digital Experience Platform, Dxp, Liferay Portal and 1 more | 2025-11-10 | 6.1 Medium |
| Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 35 through update 92 allow remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user’s (1) First Name, (2) Middle Name, or (3) Last Name text field. | ||||
| CVE-2025-62618 | 2 Elog, Elog Project | 2 Elog, Elog | 2025-11-10 | 8 High |
| ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the target's credentials and replay them or crack the password hash offline. In ELOG 3.1.5-20251014 release, HTML files are rendered as plain text. | ||||
| CVE-2025-36592 | 1 Dell | 2 Policy Manager For Secure Connect Gateway, Secure Connect Gateway Policy Manager | 2025-11-10 | 5.4 Medium |
| Dell Secure Connect Gateway (SCG) Policy Manager, version(s) 5.20. 5.22, 5.24, 5.26, 5.28, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Script injection. | ||||
| CVE-2025-63446 | 1 Water Management System Project | 1 Water Management System | 2025-11-10 | 6.1 Medium |
| Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php. | ||||
| CVE-2025-4551 | 1 Continew | 2 Admin, Continew Admin | 2025-11-10 | 3.5 Low |
| A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Affected is an unknown function of the file /dev-api/common/file. The manipulation of the argument File leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-12284 | 2 Azure-access, Azure Access Technology | 6 Blu-ic2, Blu-ic2 Firmware, Blu-ic4 and 3 more | 2025-11-10 | 6.1 Medium |
| Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | ||||
| CVE-2021-44207 | 1 Acclaimsystems | 1 Usaherds | 2025-11-10 | 8.1 High |
| Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. | ||||
| CVE-2020-8657 | 1 Eyesofnetwork | 1 Eyesofnetwork | 2025-11-10 | 9.8 Critical |
| An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token. | ||||
| CVE-2025-63448 | 1 Water Management System Project | 1 Water Management System | 2025-11-10 | 6.1 Medium |
| Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1. | ||||
| CVE-2025-63450 | 1 Car-booking-system-php Project | 1 Car-booking-system-php | 2025-11-07 | 5.4 Medium |
| Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php. | ||||
| CVE-2025-63447 | 1 Water Management System Project | 1 Water Management System | 2025-11-07 | 6.1 Medium |
| Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php. | ||||
| CVE-2025-63449 | 1 Water Management System Project | 1 Water Management System | 2025-11-07 | 5.4 Medium |
| Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php. | ||||
| CVE-2025-12001 | 2 Azure-access, Azure Access Technology | 6 Blu-ic2, Blu-ic2 Firmware, Blu-ic4 and 3 more | 2025-11-07 | 6.1 Medium |
| Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | ||||
| CVE-2025-57244 | 1 Openkm | 1 Openkm | 2025-11-07 | 5.4 Medium |
| OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface. The Name field accepts script tags and the Email field is vulnerable when the POST request is modified to include encoded script tags, by passing frontend validation. | ||||