Filtered by CWE-79
Filtered by vendor Subscriptions
Total 44932 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-50859 1 Ehcp 1 Easy Hosting Control Panel 2025-09-24 6.1 Medium
Reflected Cross-Site Scripting in the Change Template function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the template parameter.
CVE-2025-50858 1 Ehcp 1 Easy Hosting Control Panel 2025-09-24 6.1 Medium
Reflected Cross-Site Scripting in the List MySQL Databases function in Easy Hosting Control Panel (EHCP) 20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via the action parameter.
CVE-2023-3726 1 Ocsinventory-ng 1 Ocsinventory-ocsreports 2025-09-24 6.9 Medium
OCSInventory allow stored email template with special characters that lead to a Stored cross-site Scripting.
CVE-2023-2507 1 Clevertap 1 Clevertap 2025-09-24 9.3 Critical
CleverTap Cordova Plugin version 2.6.2 allows a remote attacker to execute JavaScript code in any application that is opened via a specially constructed deeplink by an attacker. This is possible because the plugin does not correctly validate the data coming from the deeplinks before using them.
CVE-2025-53504 2 Group-office, Intermesh 2 Group Office, Group-office 2025-09-24 N/A
Group-Office versions prior to 6.8.119 and prior to 25.0.20 provided by Intermesh BV contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
CVE-2025-25973 1 Yandaozi 1 Ppress 2025-09-23 6.5 Medium
A stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.0.9 allows a remote attacker to execute arbitrary code via a crafted script to the article.title, article.category, and article.tags parameters.
CVE-2025-50581 1 Mrcms 1 Mrcms 2025-09-23 4.8 Medium
MRCMS v3.1.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/group/save.do.
CVE-2025-59712 1 Snipeitapp 1 Snipe-it 2025-09-23 6.4 Medium
Snipe-IT before 8.1.18 allows XSS.
CVE-2025-59715 1 Smseagle 1 Smseagle 2025-09-23 4.8 Medium
SMSEagle before 6.11 allows reflected XSS via a username or contact phone number.
CVE-2025-59411 1 Cubecart 1 Cubecart 2025-09-23 5.4 Medium
CubeCart is an ecommerce software solution. Prior to version 6.5.11, the contact form’s Enquiry field accepts raw HTML and that HTML is included verbatim in the email sent to the store admin. By submitting HTML in the Enquiry, the admin receives an email containing that HTML. This indicates user input is not being escaped or sanitized before being output in email (and possibly when re-rendering the form), leading to Cross-Site Scripting / HTML injection risk in email clients or admin UI. This issue has been patched in version 6.5.11.
CVE-2025-59412 1 Cubecart 1 Cubecart 2025-09-23 5.4 Medium
CubeCart is an ecommerce software solution. Prior to version 6.5.11, a vulnerability exists in the product reviews feature where user-supplied input is not properly sanitized before being displayed. An attacker can submit HTML tags inside the review description field. Once the administrator approves the review, the injected HTML is rendered on the product page for all visitors. This could be used to redirect users to malicious websites or to display unwanted content. This issue has been patched in version 6.5.11.
CVE-2024-51446 1 Siemens 1 Polarion Alm 2025-09-23 6.5 Medium
A vulnerability has been identified in Polarion V2310 (All versions), Polarion V2404 (All versions < V2404.4). The file upload feature of the affected application improperly sanitizes xml files. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by uploading specially crafted xml files that are later downloaded and viewed by other users of the application.
CVE-2025-26514 1 Netapp 1 Storagegrid 2025-09-23 6.4 Medium
StorageGRID (formerly StorageGRID Webscale) versions prior to 11.8.0.15 and 11.9.0.8 are susceptible to a Reflected Cross-Site Scripting vulnerability. Successful exploit could allow an attacker to view or modify configuration settings or add or modify user accounts but requires the attacker to know specific information about the target instance and then trick a privileged user into clicking a specially crafted link.
CVE-2024-29182 1 Collaboraoffice 1 Collabora Online 2025-09-23 6.1 Medium
Collabora Online is a collaborative online office suite based on LibreOffice. A stored cross-site scripting vulnerability was found in Collabora Online. An attacker could create a document with an XSS payload in document text referenced by field which, if hovered over to produce a tooltip, could be executed by the user's browser. Users should upgrade to Collabora Online 23.05.10.1 or higher. Earlier series of Collabora Online, 22.04, 21.11, etc. are unaffected.
CVE-2024-12923 1 Qnap 1 Photo Station 2025-09-22 5.4 Medium
A cross-site scripting (XSS) vulnerability has been reported to affect Photo Station. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: Photo Station 6.4.5 ( 2025/01/02 ) and later
CVE-2025-48007 1 Hallowelt 1 Bluespice 2025-09-22 6.4 Medium
Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceAvatars) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1.
CVE-2025-46703 1 Hallowelt 1 Bluespice 2025-09-22 6.4 Medium
Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:AtMentions) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1.
CVE-2025-58114 1 Hallowelt 1 Bluespice 2025-09-22 4.8 Medium
Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects BlueSpice: from 5 through 5.1.1.
CVE-2025-57880 1 Hallowelt 1 Bluespice 2025-09-22 5.4 Medium
Improper Encoding or Escaping of Output vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceWhoIsOnline) allows Cross-Site Scripting (XSS). This issue affects BlueSpice: from 5 through 5.1.1.
CVE-2025-54800 1 Nixos 1 Hydra 2025-09-22 6.1 Medium
Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the Hydra database that is automatically evaluated in a client's browser when anyone visits the build page. This could be done by a third-party project as part of its build process. This also happens in other places like with hydra-release-name. This issue has been patched by commit dea1e16. A workaround involves either not building untrusted packages or not visiting the builds page.