Filtered by CWE-79
Filtered by vendor Subscriptions
Total 42853 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-63708 2 Remyandrade, Sourcecodester 2 Ai Font Matcher, Ai Font Matcher 2025-11-20 6.1 Medium
Cross-Site Scripting (XSS) vulnerability exists in SourceCodester AI Font Matcher (nid=18425, 2025-10-10) that allows remote attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability occurs in the webfonts API handling mechanism where font family names are not properly sanitized. An attacker can intercept fetch requests to the webfonts endpoint and inject malicious JavaScript payloads through font family names, resulting in session cookie theft, account hijacking, and unauthorized actions performed on behalf of authenticated users. The vulnerability can be exploited by injecting a fetch hook that returns controlled font data containing malicious scripts.
CVE-2023-3971 1 Redhat 7 Ansible Automation Controller, Ansible Automation Platform, Ansible Automation Platform Developer and 4 more 2025-11-20 7.3 High
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
CVE-2024-4812 2 Katello Project, Redhat 2 Katello, Satellite 2025-11-20 4.8 Medium
A flaw was found in the Katello plugin for Foreman, where it is possible to store malicious JavaScript code in the "Description" field of a user. This code can be executed when opening certain pages, for example, Host Collections.
CVE-2024-10033 1 Redhat 6 Ansible Automation Platform, Ansible Automation Platform Developer, Ansible Automation Platform Inside and 3 more 2025-11-20 6.1 Medium
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
CVE-2019-14863 2 Angularjs, Redhat 5 Angularjs, Decision Manager, Jboss Enterprise Bpms Platform and 2 more 2025-11-20 6.1 Medium
There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web application delivers data to its users along with other trusted dynamic content, without validating it.
CVE-2020-7676 2 Angularjs, Redhat 5 Angularjs, Amq Broker, Ansible Tower and 2 more 2025-11-20 5.4 Medium
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "<option>" elements in "<select>" ones changes parsing behavior, leading to possibly unsanitizing code.
CVE-2022-25869 1 Angularjs 1 Angularjs 2025-11-20 4.2 Medium
All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.
CVE-2025-65013 1 Librenms 1 Librenms 2025-11-20 6.2 Medium
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting (XSS) vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without proper output encoding or sanitization, allowing an attacker to craft a URL that, when visited by a victim, causes arbitrary JavaScript execution in the victim’s browser. This issue has been patched in version 25.11.0.
CVE-2025-13343 2 Janobe, Sourcecodester 2 Interview Management System, Interview Management System 2025-11-20 3.5 Low
A security flaw has been discovered in SourceCodester Interview Management System 1.0. Affected is an unknown function of the file /editQuestion.php. The manipulation of the argument Question results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.
CVE-2025-13349 2 Remyandrade, Sourcecodester 2 Student Grades Management System, Student Grades Management System 2025-11-20 3.5 Low
A vulnerability has been found in SourceCodester Student Grades Management System 1.0. This issue affects some unknown processing of the file /grades.php of the component Add New Grade Page. The manipulation of the argument Remarks leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
CVE-2025-34172 2 Netgate, Pfsense 3 Pfsense Ce, Pfsense Plus, Pfsense 2025-11-20 6.1 Medium
In pfSense CE /usr/local/www/haproxy/haproxy_stats.php, the value of the showsticktablecontent parameter is displayed after being read from HTTP GET requests. This can enable reflected cross-site scripting when the victim is authenticated.
CVE-2025-34174 2 Netgate, Pfsense 3 Pfsense Ce, Pfsense Plus, Pfsense 2025-11-20 5.4 Medium
In pfSense CE /usr/local/www/status_traffic_totals.php, the value of the start-day parameter is not ensured to be a numeric value or sanitized of HTML-related characters/strings before being directly displayed in the input box. This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Status: Traffic Totals" permissions.
CVE-2025-34175 2 Netgate, Pfsense 3 Pfsense Ce, Pfsense Plus, Pfsense 2025-11-20 6.1 Medium
In pfSense CE /usr/local/www/suricata/suricata_filecheck.php, the value of the filehash parameter is directly displayed without sanitizing for HTML-related characters/strings. This can result in reflected cross-site scripting if the victim is authenticated.
CVE-2025-34177 2 Netgate, Pfsense 3 Pfsense Ce, Pfsense Plus, Pfsense 2025-11-20 5.4 Medium
In pfSense CE /suricata/suricata_flow_stream.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.
CVE-2025-34178 2 Netgate, Pfsense 3 Pfsense Ce, Pfsense Plus, Pfsense 2025-11-20 5.4 Medium
In pfSense CE /suricata/suricata_app_parsers.php, the value of the policy_name parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata package" permissions.
CVE-2025-6251 2 Wordpress, Wproyal 2 Wordpress, Royal Elementor Addons And Templates 2025-11-20 6.4 Medium
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['field_id'] in all versions up to, and including, 1.7.1036 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-13054 2 Cozmoslabs, Wordpress 2 Profile Builder, Wordpress 2025-11-20 6.4 Medium
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wppb-embed shortcode in all versions up to, and including, 3.14.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-12484 2 Rafflepress, Wordpress 3 Giveaways And Contests, Giveaways And Contests By Rafflepress, Wordpress 2025-11-20 7.2 High
The Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple social media username parameters in all versions up to, and including, 1.12.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-12878 3 Funnelkit, Woocommerce, Wordpress 3 Funnel Builder, Woocommerce, Wordpress 2025-11-20 6.4 Medium
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `wfop_phone` shortcode in all versions up to, and including, 3.13.1.2. This is due to insufficient input sanitization and output escaping on the user-supplied `default` attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-3092 1 Gitlab 1 Gitlab 2025-11-20 8.7 High
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. A payload may lead to a Stored XSS while using the diff viewer, allowing attackers to perform arbitrary actions on behalf of victims.