Cross-Site Scripting

Stored cross-site scripting in Flowsint, an open-source OSINT graph exploration tool, allows an authenticated remote attacker to inject arbitrary HTML into map node labels that executes in the browser of any user who selects that node marker in the map tab. Affected versions are all releases prior to 1.2.3, which delivers the official fix. Publicly available exploit code exists per SSVC data, though EPSS sits at just 0.16% (37th percentile), consistent with the tool's niche deployment footprint and the non-automatable nature of the attack.

Reflected XSS in SillyTavern's CORS proxy middleware (all versions prior to 1.18.0) allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL that triggers the server's unescaped HTTP 500 error response. The server concatenates the raw attacker-controlled URL parameter directly into the response body at src/middleware/corsProxy.js:40 without HTML encoding, enabling token theft and session manipulation against any user who loads a crafted proxy link. No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.05% (15th percentile), indicating low real-world exploitation activity; a vendor patch is available in version 1.18.0.

Stored cross-site scripting in efw4.X's previewServlet allows authenticated low-privilege users to cause arbitrary JavaScript execution in victims' browsers by uploading .html, .htm, or .svg files that are served without sanitization or protective security headers. All efw4.X versions prior to 4.08.010 are affected; the framework serves these files with text/html or image/svg+xml MIME types derived from extension alone, giving browsers a green light to parse and execute embedded scripts within the application's origin. No active exploitation confirmed in CISA KEV, but SSVC data confirms a POC exists; EPSS at 0.03% (8th percentile) reflects low opportunistic exploitation probability consistent with the authentication and user-interaction requirements.

Stored Cross-Site Scripting in Adobe Commerce allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in any victim's browser upon visiting the affected page. All active release trains from 2.4.4 through 2.4.8 are affected, along with the 2.4.9-beta1 pre-release. No public exploit identified at time of analysis; an EPSS score of 0.02% (5th percentile) and SSVC exploitation status of 'none' confirm negligible current exploitation activity, keeping real-world urgency low despite the stored nature of the flaw.

Stored Cross-Site Scripting in Adobe Commerce 2.4.x allows a high-privileged attacker to inject persistent JavaScript payloads into vulnerable form fields, which execute in the browser of any user who subsequently views the affected page. The scope change (S:C) means injected scripts run in the victim's browser security context, enabling session hijacking or unauthorized action execution against lower-privileged users. No public exploit code has been identified and EPSS at 0.06% (20th percentile) with SSVC exploitation status of 'none' confirm no current active exploitation.

Cross-site scripting in Microsoft Visual Studio Code (all versions prior to 1.119.1) allows a local attacker to inject malicious scripts into VS Code's webview rendering engine, bypassing security feature protections with high confidentiality impact across component boundaries. The CVSS Scope:Changed metric (S:C) combined with C:H indicates the injected payload can escape the webview sandbox and exfiltrate data accessible to the broader VS Code/Electron process, such as environment variables, authentication tokens, or workspace file contents. No public exploit code has been identified and EPSS sits at 0.04% (13th percentile), indicating low current exploitation pressure despite the meaningful confidentiality impact.

Stored cross-site scripting (XSS) in the Continually WordPress plugin versions up to 4.3.1 allows authenticated administrators to inject arbitrary web scripts into admin settings that execute whenever users access affected pages. The vulnerability requires high-privilege administrator access and is limited to multisite WordPress installations or sites with unfiltered_html disabled, resulting in low CVSS impact (4.4) despite network accessibility. No public exploit code or active exploitation has been identified at this time.

Stored Cross-Site Scripting in FastBots plugin for WordPress up to version 1.0.12 allows authenticated administrators to inject arbitrary JavaScript into admin settings that executes when any user accesses affected pages. The vulnerability requires high-privilege administrator access and affects only multi-site WordPress installations or single-site installations with the unfiltered_html capability disabled. No public exploit code or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in BJ Lazy Load plugin for WordPress versions up to 1.0.9 allows authenticated attackers with Contributor-level access to inject arbitrary web scripts via regex-based HTML attribute manipulation in the `filter_images()` function. The vulnerability exploits improper handling of HTML attribute boundaries during `src` attribute replacement, enabling attackers to promote malicious content from class attribute values into executable DOM attributes. When victims access injected pages, the injected scripts execute in their browsers with the privileges of the compromised site.

Stored Cross-Site Scripting in Scratchblocks for WP plugin for WordPress allows authenticated contributors and above to inject arbitrary JavaScript through the 'element' attribute of the 'scratchblocks' shortcode due to insufficient input sanitization and output escaping. The vulnerability affects all versions up to 1.0.1 and enables malicious scripts to execute in the browsers of all users viewing affected pages, with cross-site scope impact.

Reflected Cross-Site Scripting (XSS) in WP Google Maps Integration plugin for WordPress versions up to 1.2 allows unauthenticated attackers to inject arbitrary web scripts via the `page` parameter due to insufficient input sanitization and output escaping. Exploitation requires tricking an administrator into clicking a malicious link, but successful attacks can hijack admin sessions, modify site content, or steal credentials with medium attack complexity and limited immediate confidentiality and integrity impact.

Stored Cross-Site Scripting in Credits Shortcode WordPress plugin up to version 1.2 allows authenticated contributors and above to inject arbitrary JavaScript via the 'link' attribute of the credits shortcode, which executes when other users view affected pages. The vulnerability stems from insufficient input sanitization and output escaping on user-supplied shortcode attributes. CVSS 6.4 reflects moderate risk with network vector and limited scope impact, though real-world risk depends on site contributor population and user awareness.

Stored cross-site scripting in the Advanced Social Media Icons WordPress plugin through version 1.2 allows authenticated contributors and above to inject arbitrary JavaScript via insufficiently sanitized shortcode attributes, with execution occurring whenever any user views an affected page. The vulnerability affects all installations of the plugin up to and including version 1.2 and requires only Contributor-level WordPress access to exploit, making it a significant risk for multi-author sites.

Stored Cross-Site Scripting in Voyage Plus WordPress plugin versions up to 1.0.6 allows authenticated contributors and above to inject malicious scripts via the 'class' attribute of the 'post-content' shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the browsers of all users viewing affected pages, enabling credential theft, session hijacking, or malware distribution. No public exploit code or active KEV listing identified at time of analysis, but the vulnerability requires only contributor-level access and no user interaction, making it practical for insider threats or compromised contributor accounts.

Stored Cross-Site Scripting in Next Date WordPress plugin (all versions up to 1.0) allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'default' shortcode attribute due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, potentially compromising site visitors and administrators. No public exploit code or active exploitation has been identified at time of analysis.

SP Blog Designer plugin for WordPress versions up to 1.0.0 allows authenticated attackers with Contributor-level access to inject arbitrary web scripts via the 'design' attribute of the wpsbd_post_carousel shortcode, resulting in stored cross-site scripting (XSS) that executes for all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping in shortcode handling. No public exploit code or active exploitation has been confirmed at time of analysis.

Stored cross-site scripting in Quick Table plugin for WordPress allows authenticated contributors and above to inject malicious scripts via the 'style' attribute of the 'qtbl' shortcode, which execute when any user views the affected page. The vulnerability affects all versions up to 1.0.0 due to insufficient input sanitization and output escaping. No public exploit code or active exploitation has been identified at time of analysis.

Reflected Cross-Site Scripting in AzonPost WordPress plugin versions up to 1.3 allows unauthenticated attackers to inject arbitrary JavaScript via the `editpos_hidden` parameter, executing in the browsers of administrators who click malicious links. The vulnerability stems from insufficient input sanitization and output escaping, requiring user interaction but affecting all versions of the plugin without requiring authentication or special configuration.

Stored Cross-Site Scripting (XSS) in WP SEO Structured Data Schema plugin for WordPress versions up to 2.8.1 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the `_kcseo_ative_tab` parameter, which executes in the browsers of users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping in the plugin's metadata handling. No public exploit code or active exploitation has been identified at time of analysis.

Stored cross-site scripting in the Bootstrap Shortcode plugin for WordPress allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages via the `box` shortcode, executing malicious scripts whenever users view affected pages. The vulnerability exists in all versions up to 1.0 due to insufficient input sanitization and output escaping. No public exploit code or active exploitation has been identified at this time.

Stored Cross-Site Scripting in Fancy Image Show plugin for WordPress up to version 9.1 allows authenticated contributors and above to inject arbitrary JavaScript via the `fancy-img-show` shortcode due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user viewing the affected page, affecting site integrity and potentially compromising administrative accounts. No public exploit code or active exploitation has been confirmed at time of analysis.

Reflected Cross-Site Scripting in Pricing Tables for WP plugin allows unauthenticated attackers to inject arbitrary JavaScript via the 'page' parameter. The vulnerability affects all versions up to 1.1.0 due to insufficient input sanitization and output escaping. Exploitation requires social engineering (e.g., tricking an administrator into clicking a malicious link), but no public exploit code or active exploitation has been identified at time of analysis.

Stored cross-site scripting in Shortcodely WordPress plugin versions up to 1.0.1 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'widget_area' parameter, with scripts executing whenever users access affected pages. The vulnerability stems from insufficient input sanitization and output escaping, affecting all installations with vulnerable plugin versions active. CVSS 6.4 reflects the cross-site scope and information disclosure potential, though exploitation requires authenticated contributor-level access.

SAP Business Server Pages TAF_APPLAUNCHER contains a cross-site scripting vulnerability that allows unauthenticated attackers to craft malicious links redirecting users to attacker-controlled sites, potentially exposing or altering sensitive information. The vulnerability requires user interaction (clicking the link) and affects confidentiality and integrity with a CVSS score of 6.1. No active exploitation has been publicly confirmed at time of analysis.

Reflected cross-site scripting (XSS) in SAP NetWeaver Application Server ABAP (Business Server Pages) allows unauthenticated attackers to inject malicious scripts via unprotected URL parameters. Successful exploitation requires victim interaction (clicking a crafted link) and affects confidentiality and integrity of application data. No public exploit code or active exploitation reported at time of analysis.

Stored cross-site scripting (XSS) in FluentCMS 1.2.3 File Management module allows authenticated administrators to upload SVG files with embedded malicious JavaScript that executes when any user-including unauthenticated visitors-accesses the image URL directly. The vulnerability has public proof-of-concept code available via GitHub pull request, and CISA SSVC framework confirms exploitability is feasible but requires user interaction and is not automatable. CVSS 5.4 reflects the attack complexity introduced by authentication requirement and user interaction, but the cross-origin scope and ability to affect multiple users elevates real-world risk.

Cross-origin iframe download settings confusion in Apple WebKit allows a malicious iframe to inherit or apply another website's download configuration, effectively bypassing per-origin download policy isolation. Affected platforms include iOS/iPadOS, macOS Tahoe, and visionOS prior to their respective 26.5 releases. EPSS sits at 0.02% (4th percentile), SSVC exploitation status is 'none', and no KEV listing or public proof-of-concept exists, placing real-world exploitation risk well below what the network-accessible CVSS vector alone might suggest.

Stored cross-site scripting (XSS) in Audiobookshelf prior to 2.33.0 allows authenticated administrators to inject malicious HTML and JavaScript into the authLoginCustomMessage field via the /api/auth-settings endpoint, which is then rendered on the login page for all users without sanitization. This enables attackers with admin credentials to capture user credentials, perform account takeover, or redirect users to phishing sites. No public exploit code identified at time of analysis.

HTML injection in local-deep-research's PDF export service (pdf_service.py:_markdown_to_html) allows any authenticated user to embed arbitrary HTML tags into WeasyPrint-rendered documents by supplying a crafted research query, chaining directly to SSRF that bypasses the application's existing ssrf_validator.py defenses. All versions prior to v1.6.0 are affected via the pip package pkg:pip/local-deep-research; a detailed public proof-of-concept is included in the GitHub Security Advisory (GHSA-fj2m-qvh9-jq4q). No CISA KEV listing and EPSS of 0.03% (8th percentile) indicate no confirmed widespread exploitation, but the attack is trivially repeatable by any authenticated user on shared or cloud-hosted deployments, with IAM credential theft as the highest-severity outcome.

Reflected XSS in MantisBT versions 1.0.0 through 2.28.1 allows an authenticated low-privilege attacker to inject arbitrary HTML into the View Issues Page by supplying a malicious value in the unvalidated `filter_target` parameter of the `return_dynamic_filters.php` AJAX endpoint, exploitable specifically when the target resolves to a TEXTAREA-type custom field. The vendor's CVSS 4.0 vector confirms low-privilege authentication is required and impact is limited to low confidentiality and integrity loss against victim users. No public exploit has been identified and EPSS probability stands at 0.04%, placing this firmly in the low-urgency tier despite its network accessibility; patch version 2.28.2 is confirmed available.

HTML injection in Mermaid's state diagram `classDef` parser allows escape from the SVG rendering context into the parent document DOM, affecting npm/mermaid through v11.14.0 and through v10.9.5 under the default `securityLevel` configuration. By embedding SVG/style-closing sequences inside CSS property values, an attacker can inject arbitrary HTML and CSS that overlays the full browser viewport - enabling UI redressing and phishing-style attacks on any platform that renders user-supplied diagrams. A public proof-of-concept is available per SSVC assessment; however, `<script>` tag stripping is confirmed to prevent classic XSS, and no CISA KEV active exploitation has been recorded.

Reflected HTML injection in MantisBT's tag update page (tag_update_page.php) arises from the application echoing the HTTP Referer header into an HTML hidden input without proper escaping. All versions through 2.28.1 are affected. In the most exploitable scenario, an attacker poisons a caching proxy by submitting a crafted Referer value, causing downstream users who receive the cached response to execute attacker-controlled JavaScript - a web-cache-deception-style XSS path. No public exploit identified at time of analysis, though SSVC classifies exploitation status as poc; EPSS is low at 0.04% (14th percentile).

Stored XSS in MantisBT's bug update page (bug_update_page.php) allows a low-privileged authenticated reporter to inject arbitrary HTML - and JavaScript where CSP is not enforced - into textarea-type custom field values, which execute in any victim's browser upon loading the Update Issue form. The impact chain reaches session theft and full administrative takeover of the MantisBT instance. No active exploitation has been confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS at 0.03% (10th percentile) reflects very low current exploitation probability; however, the attacker-controlled payload persists until the bug is edited and the preconditions for exploitation are common among MantisBT deployments that use custom fields.

Stored Cross-Site Scripting in WeGIA versions prior to 3.7.3 allows authenticated high-privilege users to inject malicious JavaScript into the Processo de Aceitação page that executes when any user accesses the vulnerable endpoint, enabling session hijacking and account takeover. The vulnerability is confined to high-privilege authenticated access (PR:H) with no user interaction required on the victim side, though scope is changed (S:C) indicating cross-context impact. No public exploit code or active exploitation has been identified.

Stored cross-site scripting (XSS) in WeGIA versions prior to 3.7.3 allows authenticated high-privilege users to inject malicious JavaScript into the Etapas de um Processo page, which executes when other users access the page, enabling session hijacking and account takeover. The vulnerability requires high-privilege authentication (PR:H) but affects all users who subsequently visit the injected page, with no public exploit identified at time of analysis.

Reflected cross-site scripting (XSS) in WeGIA versions before 3.7.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the id_processo parameter in lista_arquivos_etapa.php, enabling session hijacking, credential theft, or malicious actions in victim browsers. User interaction (clicking a crafted link) is required. The vulnerability is fixed in version 3.7.0.

Stored XSS in WeGIA's employee profile module affects all versions prior to 3.7.0, enabling persistent JavaScript injection via the Description (Descrição) field at the funcionario/profile_funcionario.php endpoint. Any party able to edit that field can plant a payload that executes silently in every subsequent visitor's browser - including administrators - enabling session hijacking and privileged action execution. A proof-of-concept exists per SSVC assessment; however, no CISA KEV listing and an EPSS of 0.05% (15th percentile) indicate no observed widespread exploitation at time of analysis.

CRLF injection in cowlib's SSE encoder allows an attacker who supplies field values - id, event, data, or comment - containing bare carriage-return (\r) characters to split and forge arbitrary SSE events on receiving clients. Affected are all cowlib deployments from version 2.6.0 used to stream SSE to browser EventSource clients or other SSE consumers that dispatch on event.type or render event.data into the DOM, where the impact is equivalent to stored XSS. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.04% (14th percentile), and SSVC rates automatable as 'no', indicating this is a targeted rather than mass-exploitable flaw; however, applications that echo user-controlled data through SSE fields face meaningful client-side integrity risk.

Stored cross-site scripting (XSS) via CSS injection in Open edX Platform allows enrolled students to inject arbitrary CSS into discussion notification emails sent to other users by bypassing insufficient HTML sanitization in the clean_thread_html_body() function. The vulnerability affects all versions prior to the fix commit and enables email tracking through malicious stylesheets, content spoofing, and phishing attacks against recipients who view notification emails.

Stored cross-site scripting (XSS) in Sonatype Nexus Repository 3.6.0 through 3.91.x allows authenticated users with upload permissions to inject malicious JavaScript into repository content, which executes in the browsers of any user viewing the affected repository directory via the HTML index page. An attacker can perform unauthorized actions within a victim's session context, including potential data theft or privilege escalation depending on the victim's role. The vulnerability requires user interaction (clicking/viewing the malicious content) and prior repository upload access, limiting but not eliminating real-world risk in multi-tenant or open-source repository environments.

Taiga Front prior to version 6.9.1 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with limited privileges to inject malicious scripts into confirmation messages and dialogs. When other users view these messages, the scripts execute in their browser context, potentially allowing attackers to steal session cookies, perform unauthorized actions, or redirect victims to malicious sites. The vulnerability requires user interaction (UI:R) but affects confidentiality with a CVSS score of 5.7.

Cross-site scripting via CSP nonce poisoning in Next.js App Router allows attackers to inject malicious scripts into cached HTML responses when applications process untrusted CSP request headers. Versions 13.4.0-15.5.15 and 16.0.0-16.2.4 are vulnerable; attackers can craft malformed nonce values that escape sanitization and execute arbitrary JavaScript for subsequent cache visitors. No public exploit code identified at time of analysis, but the attack requires no authentication and low user interaction (cache hit by victim), making it practically exploitable in shared hosting and CDN scenarios.

Cross-site scripting in Next.js beforeInteractive scripts allows remote unauthenticated attackers to execute arbitrary JavaScript in visitor browsers when applications pass untrusted content to beforeInteractive script features. The vulnerability arises from insufficient HTML escaping of serialized script content before embedding into the document, enabling attackers to break out of the script context. Affected versions include 13.0.0 through 15.5.15 and 16.0.0 through 16.2.4; patched versions 15.5.16 and 16.2.5 are available. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS score of 6.1 reflects moderate risk with required user interaction.

Cross-site scripting (XSS) vulnerability in Wikimedia Scribunto 1.45.0 through 1.45.1 allows authenticated users to inject malicious scripts that may be executed in the context of other users' browsers, potentially compromising session security and enabling unauthorized actions on affected wiki installations. The vulnerability requires login credentials and elevated attack complexity but carries low availability impact; CVSS 2.3 reflects limited real-world threat when combined with the authentication requirement.

Stored cross-site scripting (XSS) in pgAdmin 4 before version 9.15 allows authenticated administrators to execute arbitrary JavaScript in the browsers of other pgAdmin users by crafting malicious PostgreSQL object names (databases, schemas, tables, columns) that are rendered unsafely via innerHTML in the Browser Tree and Explain Visualizer modules. The vulnerability requires administrator privileges and user interaction (navigation to or EXPLAIN execution over the malicious object), limiting real-world exploitation scope despite the network attack vector.

Reflected cross-site scripting (XSS) in Cradle eCommerce platform allows unauthenticated remote attackers to execute arbitrary JavaScript in users' browsers via crafted input to the /product/ endpoint. The vulnerability requires user interaction (clicking a malicious link) and affects the latest demo version. A vendor patch is available.

Reflected XSS in Cradle eCommerce platform allows unauthenticated remote attackers to execute arbitrary JavaScript in user browsers via unsanitized input reflected in the /collection/ endpoint. The vulnerability requires user interaction (clicking a malicious link) but affects the latest demo version with CVSS 5.1 (low-medium severity). No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available.

Reflected XSS in ATutor's /install/install.php endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL. Version 2.2.4 is confirmed vulnerable; the product is no longer actively maintained and vendor response to disclosure was unsuccessful, leaving no official patch available.

Reflected XSS in ATutor's /install/upgrade.php endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via a specially crafted URL. The vulnerability affects at least version 2.2.4 and potentially other versions; the product is no longer actively maintained and vendors did not respond with details about the full vulnerable version range. While CVSS 5.1 indicates low severity, the attack requires user interaction (clicking a malicious link) and has limited scope impact.

Cross-site scripting (XSS) in Devs Palace ERP Online version 4.0.0 and earlier allows authenticated high-privilege users to inject malicious scripts via the /accounts/chart-save endpoint. The vulnerability requires user interaction (UI:P) to trigger and results in limited integrity impact. Publicly available exploit code exists, though the CVSS 4.0 score of 1.9 reflects low severity due to the high privilege requirement (PR:H) and user interaction dependency.

Cross-site scripting (XSS) in Devs Palace ERP Online up to version 4.0.0 allows high-privileged authenticated users to inject malicious scripts via the /inventory/sales_save endpoint with user interaction, resulting in integrity impact. The exploit code has been publicly released and the vendor has not responded to early disclosure attempts, leaving affected deployments without vendor-provided patches.

Reflected cross-site scripting (XSS) in Devs Palace ERP Online up to version 4.0.0 allows high-privileged authenticated users to inject malicious scripts via the /accounts/mr-save endpoint, enabling session hijacking or credential theft with user interaction. Exploit code is publicly available and the vendor has not responded to disclosure efforts, leaving affected deployments without an official patch.

Cross-site scripting (XSS) vulnerability in Devs Palace ERP Online versions up to 4.0.0 allows authenticated users with high privileges to inject malicious scripts via the /inventory/add_new_customer endpoint. The vulnerability requires user interaction (UI:P) and has publicly available exploit code, but real-world impact is significantly limited by the requirement for authenticated high-privilege access and user interaction, resulting in a CVSS score of only 1.9 despite network accessibility.

Stored cross-site scripting in iotgateway v.3.0.1 allows remote unauthenticated attackers to inject malicious JavaScript through the Log Record Function, which then executes in the browser of any user who views the affected log entries. The CVSS scope change (S:C) confirms the injected script breaks out of the application's security context to operate within the victim's browser session, enabling session hijacking or credential theft. No active exploitation is confirmed by CISA KEV; however, SSVC intelligence indicates a proof-of-concept exists, and EPSS stands at a low 0.05%, suggesting targeted rather than widespread opportunistic exploitation.

Reflected cross-site scripting in Mercury docuForm (Managed Print Services) v11.11c enables authenticated attackers to execute arbitrary JavaScript in victim browsers when users click malicious links. The vulnerability exists in dfm-menu_markeralerts.php due to unfiltered variable handling. CVSS 7.3 (High) reflects network-accessible attack requiring low-privilege authentication and user interaction. No public exploit confirmed, but proof-of-concept code published by ZeroBreach GmbH demonstrates feasibility. EPSS data unavailable; not in CISA KEV, indicating no confirmed widespread exploitation at time of analysis.

Reflected XSS in docuForm Managed Print Services 11.11c enables authenticated attackers to execute malicious JavaScript in victim browsers via crafted links. The dfm-menu_orderopt.php component fails to sanitize input parameters, allowing session hijacking and account takeover when low-privilege users click attacker-controlled URLs. EPSS data unavailable; no CISA KEV listing indicates exploitation remains opportunistic rather than widespread. Public exploit code exists via GitHub Gist, lowering barrier to attack.

Reflected cross-site scripting in the login page of docuFORM Managed Print Service Client 11.11c enables remote, unauthenticated attackers to inject malicious JavaScript into victim browsers via crafted URLs. Because the login page is publicly accessible and requires no prior authentication, the attack surface is wide - though exploitation still requires a victim to click a attacker-controlled link (UI:R). A public proof-of-concept is referenced via a ZeroBreach GmbH GitHub gist; however, EPSS at 0.03% (8th percentile) and SSVC exploitation status of 'none' indicate no public exploitation activity at the time of analysis.

Reflected cross-site scripting (XSS) in GmbH Mercury Managed Print Services docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting a malicious payload into an unfiltered variable in the dfm-menu_departments.php component. The vulnerability requires user interaction (clicking a crafted link) and affects confidentiality and integrity with limited scope. No public exploit code has been independently confirmed at this time, though the detailed nature of the component reference suggests proof-of-concept research exists.

Reflected cross-site scripting in Mercury docuForm v11.11c allows authenticated attackers to execute arbitrary JavaScript in victim browsers via crafted payloads to dfm-menu_alerts.php. Attack requires low complexity and user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R). Public proof-of-concept exists on GitHub (ZeroBreach-GmbH gist), but no CISA KEV listing indicates targeted or low-volume exploitation. EPSS data not available, but the authentication requirement and user interaction dependency reduce attack surface compared to stored XSS.

Reflected cross-site scripting in Mercury Managed Print Services docuForm v11.11c allows authenticated attackers with low privileges to execute arbitrary JavaScript in victim browsers via the acc-menu_pricess.php component. Public proof-of-concept exploit code exists on GitHub (ZeroBreach-GmbH). EPSS data not available, not listed in CISA KEV. Attack requires user interaction (phishing/social engineering to click malicious link), limiting automated exploitation but enabling credential theft and session hijacking for authenticated users.

Reflected XSS in docuForm v11.11c acc-menu_billings.php component allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into unfiltered variables, requiring user interaction to click a crafted link. CVSS 6.1 reflects limited confidentiality and integrity impact with required user interaction, but successful exploitation can lead to session hijacking, credential theft, or account takeover depending on application context.

HireFlow v1.2 contains reflected cross-site scripting (XSS) vulnerabilities in the candidate detail interface that allow authenticated users to inject malicious scripts via the Resume or Feedback Comment fields when submitting data to POST /candidates/add or POST /feedback/add endpoints. An attacker with user-level access can craft a malicious request containing JavaScript payloads that execute in the browsers of other users viewing the affected pages, potentially compromising session tokens, stealing credentials, or performing actions on behalf of victims. The CVSS score of 5.4 reflects the requirement for user interaction and authenticated access, though the cross-site scope indicates broader application impact beyond the attacker's session.

Reflected cross-site scripting (XSS) in GmbH Mercury docuForm v11.11c allows remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into an unfiltered variable in the dfm-menu_maintenance.php component. The vulnerability requires user interaction (clicking a crafted link) but affects all site visitors, making it suitable for credential theft, session hijacking, or malware delivery. No public active exploitation has been confirmed at time of analysis.

Reflected XSS in docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into the dfm-menu_firmware.php component, requiring the victim to click a crafted link. CVSS 6.1 reflects moderate impact (confidentiality and integrity compromise) with required user interaction. Exploit code is publicly available via GitHub.

Reflected cross-site scripting (XSS) in docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a user's browser by crafting a malicious URL containing a payload injected into an unfiltered variable in the dfm-menu_coveragealerts.php component. Successful exploitation requires user interaction (clicking a malicious link) and can lead to session hijacking, credential theft, or malware delivery. CVSS 6.1 reflects moderate impact with low attack complexity; no public patch version has been identified.

Reflected XSS in docuForm v11.11c allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by injecting malicious payloads into the acc-menu_papers.php component. The vulnerability requires user interaction (clicking a crafted link) and has limited scope (session-based impact), with a CVSS score of 6.1. No public exploit code availability or CISA KEV listing confirmed at time of analysis, though a reference repository exists.

Stored cross-site scripting (XSS) in Devs Palace ERP Online up to version 4.0.0 allows high-privileged users to inject malicious scripts via the /inventory/purchase_save endpoint, affecting the confidentiality of other users' sessions. The vulnerability requires administrative-level privileges and user interaction (UI:R), resulting in a low CVSS score of 2.4, though publicly available exploit code exists and the vendor has not responded to disclosure attempts.

WordPress Picture Gallery 1.4.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Edit Content URL field in the Access. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Advanced Guestbook 2.4.4 contains a persistent cross-site scripting vulnerability in the smilies administration interface that allows authenticated attackers to inject malicious scripts by. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

WordPress GetPaid Plugin 2.4.6 contains an HTML injection vulnerability that allows authenticated attackers to inject arbitrary HTML code by exploiting the Help Text field in payment forms. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Projectsend r1295 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting crafted input in the 'name' parameter of. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Exponent CMS 2.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the Title and Text Block parameters in the text editing. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Filterable Portfolio Gallery 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious JavaScript by entering payloads in the title field. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

WordPress Plugin WP Symposium Pro 2021.10 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by exploiting insufficient sanitization. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Contact Form to Email 1.3.24 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by creating forms with script tags in the form name. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CMDBuild 3.3.2 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject arbitrary web script or HTML via crafted input in card creation and file. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Ultimate Product Catalog 5.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the price parameter. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the title parameter. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

AccessPress Social Icons 1.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering JavaScript payloads into the 'icon. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Rocket LMS 1.1 contains a persistent cross-site scripting vulnerability in the support ticket module that allows authenticated users to inject malicious script code through the title parameter. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulating the tab parameter. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the backend/mailingLog/manage module. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/manage module. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the tickets/manage module. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the news/manage module. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the posts/manage module. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/loose module. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/active module. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the orders/myOrders module. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.