Filtered by CWE-79
Filtered by vendor Subscriptions
Total 42879 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-61788 2 Apereo, Opencast 2 Opencast, Opencast 2025-10-09 5.4 Medium
Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 17.8 and 18.2, the paella would include and render some user inputs (metadata like title, description, etc.) unfiltered and unmodified. The vulnerability allows attackers to inject and malicious HTML and JavaScript in the player, which would then be executed in the browsers of users watching the prepared media. This can then be used to modify the site or to execute actions in the name of logged-in users. To inject malicious metadata, an attacker needs write access to the system. For example, the ability to upload media and modify metadata. This cannot be exploited by unauthenticated users. This issue is fixed in Opencast 17.8 and 18.2.
CVE-2025-2979 1 Wcms 1 Wcms 2025-10-09 2.4 Low
A vulnerability classified as problematic has been found in WCMS 11. This affects an unknown part of the file /index.php?anonymous/setregister of the component Registration. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-3251 1 Xujiangfei 1 Admintwo 2025-10-09 3.5 Low
A vulnerability, which was classified as problematic, was found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation of the argument motto leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2023-36016 1 Microsoft 1 Dynamics 365 2025-10-09 6.2 Medium
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-36031 1 Microsoft 1 Dynamics 365 2025-10-09 7.6 High
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2023-36030 1 Microsoft 1 Dynamics 365 2025-10-09 6.1 Medium
Microsoft Dynamics 365 Sales Spoofing Vulnerability
CVE-2023-36007 1 Microsoft 1 Send Customer Voice Survey From Dynamics 365 2025-10-09 7.6 High
Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
CVE-2023-36410 1 Microsoft 1 Dynamics 365 2025-10-09 7.6 High
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability
CVE-2025-40991 1 Creativeitem 2 Ekushey Crm, Ekushey Project Manager Crm 2025-10-08 5.4 Medium
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_file/upload/xxxx", affecting to "description" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
CVE-2025-40990 1 Creativeitem 2 Ekushey Crm, Ekushey Project Manager Crm 2025-10-08 5.4 Medium
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_bug/create/xxx", affecting to "title" and "description" parameters via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
CVE-2025-40989 1 Creativeitem 2 Ekushey Crm, Ekushey Project Manager Crm 2025-10-08 5.4 Medium
Stored Cross Site Scripting vulnerability in Ekushey CRM v5.0 by Creativeitem, due to lack of proper validation of user inputs via the "/ekushey/index.php/client/project_message/add/xxx", affecting to "message" parameter via POST. This vulnerability could allow a remote attacker to send a specially crafted query to an authenticated user and steal his/her cookie session details.
CVE-2025-30196 1 Jenkins 1 Anchorchain 2025-10-08 6.5 Medium
Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` scheme, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control the input file for the Anchor Chain post-build step.
CVE-2025-20368 1 Splunk 3 Splunk, Splunk Cloud Platform, Splunk Enterprise 2025-10-08 5.7 Medium
In Splunk Enterprise versions below 9.4.4, 9.3.6, and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.108, 9.3.2408.118 and 9.2.2406.123, a low privileged user that does not hold the admin or power Splunk roles could craft a malicious payload through the error messages and job inspection details of a saved search. This could result in execution of unauthorized JavaScript code in the browser of a user.
CVE-2025-20367 1 Splunk 3 Splunk, Splunk Cloud Platform, Splunk Enterprise 2025-10-08 5.7 Medium
In Splunk Enterprise versions below 9.4.4, 9.3.6 and 9.2.8, and Splunk Cloud Platform versions below 9.3.2411.109, 9.3.2408.119 and 9.2.2406.122, a low-privileged user that does not hold the 'admin' or 'power' Splunk roles could craft a malicious payload through the `dataset.command` parameter of the `/app/search/table` endpoint, which could result in execution of unauthorized JavaScript code in the browser of a user.
CVE-2025-40649 1 Bbmri-eric 1 Negotiator 2025-10-08 N/A
Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 - European Research Infrastructure (BBMRI-ERIC), consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using parameter text in '/api/v3/negotiations/<postUID>/posts'. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.
CVE-2021-22291 1 Abb 2 Eibport V3 Knx, Eibport V3 Knx Gsm 2025-10-08 8 High
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ABB EIBPORT V3 KNX, ABB EIBPORT V3 KNX GSM.This issue affects EIBPORT V3 KNX: before 3.9.2; EIBPORT V3 KNX GSM: before 3.9.2.
CVE-2025-7400 2 Fifu, Wordpress 2 Featured Image From Url, Wordpress 2025-10-08 6.4 Medium
The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including, 5.2.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 5.2.2.
CVE-2025-61224 1 Dokuwiki 1 Dokuwiki 2025-10-08 6.5 Medium
Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q parameter
CVE-2025-11360 1 Jakowenko 1 Double-take 2025-10-08 4.3 Medium
A vulnerability was detected in jakowenko double-take up to 1.13.1. The impacted element is the function app.use of the file api/src/app.js of the component API. The manipulation of the argument X-Ingress-Path results in cross site scripting. The attack can be executed remotely. Upgrading to version 1.13.2 is sufficient to resolve this issue. The patch is identified as e11de9dd6b4ea6b7ec9a5607a920d48961e9fa50. The affected component should be upgraded.
CVE-2025-3448 1 Br-automation 1 Automation Runtime 2025-10-08 6.1 Medium
Reflected cross-site scripting (XSS) vulnerabilities exist in System Diagnostics Manager (SDM) of B&R Automation Runtime versions before 6.4 that enables a remote attacker to execute arbitrary JavaScript code in the context of the attacked user’s browser session