Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (24325 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-40626 1 Abantecart 1 Abantecart 2025-10-10 6.1 Medium
Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through "/about_us?[XSS_PAYLOAD]".
CVE-2025-40627 1 Abantecart 1 Abantecart 2025-10-10 6.1 Medium
Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sending the victim a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through "/eyes? [XSS_PAYLOAD]".
CVE-2025-61183 2 Vaahcms, Webreinvent 2 Vaahcms, Vaahcms 2025-10-10 6.1 Medium
Cross Site Scripting in vaahcms v.2.3.1 allows a remote attacker to execute arbitrary code via upload method in the storeAvatar() method of UserBase.php
CVE-2024-42200 1 Hcltech 1 Bigfix Platform 2025-10-09 5.4 Medium
HCL BigFix Web Reports might be subject to a Stored Cross-Site Scripting (XSS) attack, due to a potentially weak validation of user input.
CVE-2025-50927 1 Ehcp 1 Easy Hosting Control Panel 2025-10-09 6.3 Medium
A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to execute arbitrary JavaScript via injecting a crafted payload into the ftpusername parameter.
CVE-2025-51053 2 Vedo, Vedo Suite Project 2 Vedo Suite, Vedo Suite 2025-10-09 6.1 Medium
A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and potentially trigger code execution in victim's browser.
CVE-2025-40729 1 Oretnom23 1 Customer Support System 2025-10-09 6.1 Medium
Reflected Cross-Site Scripting (XSS) in /customer_support/index.php in Customer Support System v1.0, which allows remote attackers to execute arbitrary code via the page parameter.
CVE-2025-60313 2 Rems, Sourcecodester 2 Link Status Checker, Link Status Checker 2025-10-09 6.1 Medium
Sourcecodester Link Status Checker 1.0 is vulnerable to a Cross-Site Scripting (XSS) in the Enter URLs to check input field. This allows a remote attacker to execute arbitrary code.
CVE-2025-60318 2 Mayurik, Sourcecodester 2 Pet Grooming Management Software, Pet Grooming Management Software 2025-10-09 6.1 Medium
SourceCodester Pet Grooming Management Software 1.0 is vulnerable to Cross Site Scripting (XSS) in /admin/profile.php via the fname (First Name) and lname (Last Name) fields.
CVE-2023-36013 1 Microsoft 1 Powershell 2025-10-09 6.5 Medium
PowerShell Information Disclosure Vulnerability
CVE-2025-57145 1 Phpgurukul 1 Auto Taxi Stand Management System 2025-10-08 5.4 Medium
A cross-site scripting (XSS) vulnerability exists in the search-autootaxi.php endpoint of the ATSMS web application. The application fails to properly sanitize user input submitted through a form field, allowing an attacker to inject arbitrary JavaScript code. The malicious payload is stored in the backend and executed when a user or administrator accesses the affected report page. This allows attackers to exfiltrate session cookies, hijack user sessions, and perform unauthorized actions in the context of the victims browser.
CVE-2025-0746 1 Thesamur 1 Embedai 2025-10-08 6.1 Medium
A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to craft a malicious URL leveraging the"/embedai/users/show/<SCRIPT>" endpoint to inject the malicious JavaScript code. This JavaScript code will be executed when a user opens the malicious URL.
CVE-2025-0747 1 Thesamur 1 Embedai 2025-10-08 8.6 High
A Stored Cross-Site Scripting vulnerability has been found in EmbedAI. This vulnerability allows an authenticated attacker to inject a malicious JavaScript code into a message that will be executed when a user opens the chat.
CVE-2025-57407 1 Gp247 1 Gp247 2025-10-08 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser when they view the security log page, which could lead to session hijacking or other malicious actions.
CVE-2025-56304 1 Yzmcms 1 Yzmcms 2025-10-08 6.1 Medium
Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page.
CVE-2025-57452 2 Oppo, Realme 2 Coloros, Clone Phone 2025-10-08 6.1 Medium
In realme BackupRestore app v15.1.12_2810c08_250314, improper URI scheme handling in com.coloros.pc.PcToolMainActivity allows local attackers to cause a crash and potential XSS via crafted ADB intents.
CVE-2025-60448 2 Emlog, Emlog Pro Project 2 Emlog, Emlog Pro 2025-10-08 6.1 Medium
A stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The vulnerability exists due to insufficient validation of SVG file uploads in the /admin/media.php component, allowing attackers to upload malicious SVG files containing JavaScript code that executes when the uploaded file is viewed.
CVE-2025-50938 1 Hustoj 1 Hustoj 2025-10-07 6.1 Medium
Cross site scripting (XSS) vulnerability in Hustoj 2025-01-31 via the TID parameter to thread.php.
CVE-2025-57692 1 Dotnetfoundation 1 Piranha Cms 2025-10-07 6.8 Medium
PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser.
CVE-2025-57292 2 Doist, Todoist 2 Todoist, Todoist 2025-10-07 6.1 Medium
Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata.