Filtered by CWE-79
Filtered by vendor Subscriptions
Total 44865 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-63520 1 Feehi 2 Feehi Cms, Feehicms 2025-12-02 6.1 Medium
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 via the id parameter of the User Update function (?r=user%2Fupdate).
CVE-2021-26829 3 Linux, Microsoft, Scadabr 3 Linux Kernel, Windows, Scadabr 2025-12-02 5.4 Medium
OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.
CVE-2025-64047 1 Openrapid 1 Rapidcms 2025-12-02 6.1 Medium
OpenRapid RapidCMS 1.3.1 is vulnerable to Cross Site Scripting (XSS) in /user/user-move.php.
CVE-2025-63834 1 Tenda 2 Ac18, Ac18 Firmware 2025-12-01 5.4 Medium
A stored cross-site scripting (XSS) vulnerability was discovered in Tenda AC18 v15.03.05.05_multi. The vulnerability exists in the ssid parameter of the wireless settings. Remote attackers can inject malicious payloads that execute when any user visits the router's homepage.
CVE-2025-63709 2 Chuck24, Sourcecodester 2 Simple To-do List System, Simple Todo List System 2025-12-01 5.4 Medium
A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Simple To-Do List System 1.0 in the "Add Tasks" text input. An authenticated user can submit HTML/JavaScript that is not correctly sanitized or encoded on output. The injected script is stored and later rendered in the browser of any user who views the task, allowing execution of arbitrary script in the context of the victim's browser.
CVE-2025-27208 2 Revive, Revive-adserver 2 Adserver, Revive Adserver 2025-12-01 6.1 Medium
A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Revive Adserver version 5.5.2. An attacker could trick a user with access to the user interface of a Revive Adserver instance into clicking on a specifically crafted URL and execute injected JavaScript code in the context of the victim's browser. The session cookie cannot be accessed, but a number of other operations could be performed. The vulnerability is present in the admin-search.php file and can be exploited via the compact parameter.
CVE-2025-8155 2 D-link, Dlink 3 Dcs-6010l, Dcs-6010l, Dcs-6010l Firmware 2025-12-01 3.5 Low
A vulnerability has been found in D-Link DCS-6010L 1.15.03 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /vb.htm of the component Management Application. The manipulation of the argument paratest leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2025-36088 1 Ibm 5 Diamondback Tape Library, Diamondback Tape Library Firmware, Storage Ts4500 Library and 2 more 2025-12-01 5.4 Medium
IBM TS4500 1.11.0.0-D00, 1.11.0.1-C00, 1.11.0.2-C00, and 1.10.00-F00 web GUI is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2024-51723 1 Blackberry 1 Athoc 2025-12-01 4.6 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in the Management Console of BlackBerry AtHoc version 7.15 could allow an attacker to potentially execute actions in the context of the victim's session.
CVE-2025-45778 1 Languagesloth 1 The Language Sloth 2025-12-01 6.1 Medium
A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description text field.
CVE-2025-64048 1 Yccms 1 Yccms 2025-12-01 6.1 Medium
YCCMS 3.4 contains a stored cross-site scripting (XSS) vulnerability in the article management functionality. The vulnerability exists in the add() and getPost() functions within the ArticleAction.class.php file due to improper neutralization of user input in the article title field.
CVE-2025-64730 1 Sony 2 Snc-cx600w, Snc-cx600w Firmware 2025-12-01 6.1 Medium
Cross-site scripting vulnerability exists in SNC-CX600W all versions. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the product.
CVE-2024-22048 1 Gov.uk 1 Govuk Tech Docs 2025-11-29 6.1 Medium
govuk_tech_docs versions from 2.0.2 to before 3.3.1 are vulnerable to a cross-site scripting vulnerability. Malicious JavaScript may be executed in the user's browser if a malicious search result is displayed on the search page.
CVE-2024-9440 2 Brian Voelker, Slimselectjs 2 Slim Select, Slim Select 2025-11-29 5.4 Medium
Slim Select 2.0 versions through 2.9.0 are affected by a potential cross-site scripting vulnerability. In select.ts:createOption(), the text variable from the user-provided Options object is assigned to an innerHTML without sanitation. Software that depends on this library to dynamically generate lists using unsanitized user-provided input may be vulnerable to cross-site scripting, resulting in attacker executed JavaScript. At this time, no patch is available.
CVE-2024-0758 1 Ipb-halle 1 Molecularfaces 2025-11-29 6.1 Medium
MolecularFaces before 0.3.0 is vulnerable to cross site scripting. A remote attacker can execute arbitrary JavaScript in the context of a victim browser via crafted molfiles.
CVE-2025-34253 2 D-link, Dlink 2 Nuclias Connect, Nuclias Connect 2025-11-28 5.4 Medium
D-Link Nuclias Connect firmware versions <= 1.3.1.4 contain a stored cross-site scripting (XSS) vulnerability due to improper sanitization of the 'Network' field when editing the configuration, creating a profile, and adding a network. An authenticated attacker can inject arbitrary JavaScript to be executed in the context of other users viewing the profile entry. NOTE: D-Link states that a fix is under development.
CVE-2025-34236 1 Advantech 2 Webaccess/vpn, Webaccess\/vpn 2025-11-28 5.4 Medium
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVE-2025-34237 1 Advantech 2 Webaccess/vpn, Webaccess\/vpn 2025-11-28 5.4 Medium
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
CVE-2025-60917 2 Austrian Archaeological Institute, Craws 2 Openatlas, Openatlas 2025-11-28 4.6 Medium
A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the color parameter.
CVE-2025-60916 2 Austrian Archaeological Institute, Craws 2 Openatlas, Openatlas 2025-11-28 5.4 Medium
A reflected cross-site scripting (XSS) vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter.