HumHub Community Edition versions prior to 1.18.7 and between 1.19.0 and before 1.19.1 contain a stored cross-site scripting (XSS) vulnerability in the friendship confirmation dialog. An authenticated low-privileged user can inject HTML into their first and last name fields, which is then rendered unsafely in a modal dialog when other users view the profile's Friends section. This allows execution of attacker-controlled markup within the victim's HumHub origin.
Dell Wyse Management Suite versions prior to 2609.0.0.155 contain a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability allows a low privileged attacker with remote access to inject malicious scripts. The vulnerability has a high severity with a CVSS score of 8.8, impacting confidentiality, integrity, and availability.
Dell Wyse Management Suite versions prior to 2609.0.0.155 contain a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This vulnerability allows a low privileged attacker with local access to inject malicious scripts. The issue has a low severity rating with a CVSS score of 3.3.
Dell Wyse Management Suite versions prior to 2609.0.0.155 contain a Cross-site Scripting (XSS) vulnerability. This flaw allows a low privileged remote attacker to inject malicious scripts due to improper input neutralization during web page generation. The vulnerability has a CVSS score of 6.8, indicating a medium severity risk. A fix is available in version 2609.0.0.155.
Dell Wyse Management Suite versions prior to 2609.0.0.155 contain a critical Cross-site Scripting (XSS) vulnerability (CWE-79). This flaw allows a low privileged remote attacker to inject malicious scripts via improper input neutralization during web page generation. Exploitation requires user interaction and can lead to full compromise of confidentiality, integrity, and availability. The vulnerability is fixed in version 2609.0.0.155.
CVE-2025-71452 is a medium severity cross-site scripting (XSS) vulnerability in Vembu BDRSuite versions before 7.6.0. It allows unauthenticated remote attackers to inject arbitrary JavaScript via unsanitized request parameters in the restore progress page. This can lead to session hijacking or manipulation of the user interface in the victim's browser. The issue is fixed in version 7.6.0.
CVE-2025-71451 is a medium-severity cross-site scripting (XSS) vulnerability in Vembu BDRSuite versions before 7.6.0. It allows unauthenticated remote attackers to inject arbitrary JavaScript by manipulating certain request parameters. This vulnerability can lead to session hijacking or manipulation of the user interface in the victim's browser. The issue is fixed in version 7.6.0.
Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON feature data rendered by popupRender, or the (4) geofenceId value rendered in AmplifyGeofenceControl.
To remediate this issue, users should upgrade to 4.0.3 or later.
Buku versions 5.0 through 5.1.1 have a stored cross-site scripting (XSS) vulnerability in the bukuserver bookmark list. This flaw allows attackers to inject malicious scripts via an unescaped bookmark URL submitted through the unauthenticated /api/bookmarks endpoint. Exploitation can lead to same-origin API requests executed with the viewer's credentials.
TeXlyre versions from 0.11.0 up to but not including 0.13.5 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to execute malicious scripts by supplying crafted LSP or typesetter recipe icons containing HTML event handlers. Successful exploitation can lead to persistent script execution, potentially exposing local projects and repository credentials to attackers.
A stored cross-site scripting (XSS) vulnerability exists in Barn2 Plugins Posts Table with Search & Sort up to version 1.4.14. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts that execute in users' browsers. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
A stored cross-site scripting (XSS) vulnerability exists in Cozmoslabs Paid Member Subscriptions plugin versions up to 3.1.3. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that execute in the context of other users. The flaw can lead to partial confidentiality, integrity, and availability impacts.
A Cross-Site Scripting (XSS) vulnerability exists in WPMU DEV Forminator through version 1.58.3 due to improper neutralization of script-related HTML tags. This flaw allows an attacker with low privileges to inject code that can be executed in the context of the affected web page. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity level. No public exploits or patches are currently documented.
A stored cross-site scripting (XSS) vulnerability exists in WPVibes AnyWhere Elementor plugin versions up to 1.3.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of the affected web application.
Tactical RMM has a stored cross-site scripting (XSS) vulnerability due to improper input validation or output encoding in multiple fields. This flaw allows attackers to inject malicious HTML or JavaScript into the application database, which executes in users' browsers when viewing affected content. Exploitation can lead to account takeover or arbitrary code execution in the context of the user session.