Export limit exceeded: 237701 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 237701 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 24325 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (24325 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-36752 | 1 Growatt | 3 Shine Lan-x, Shine Lan-x Firmware, Shinelan-x | 2026-01-14 | 9.8 Critical |
| Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, such as allowing any attacker to access the Setting Center. This means that this is effectively backdoor for all devices utilizing a Growatt ShineLan-X communication dongle. | ||||
| CVE-2025-38741 | 1 Dell | 1 Enterprise Sonic Os | 2026-01-14 | 7.5 High |
| Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to unauthorized access to communication. | ||||
| CVE-2025-35451 | 4 Multicam-systems, Ptzoptics, Smtav and 1 more | 102 Mcamii Ptz, Mcamii Ptz Firmware, Ndi Fixed Camera and 99 more | 2026-01-14 | 9.8 Critical |
| PTZOptics and possibly other ValueHD-based pan-tilt-zoom cameras use hard-coded, default administrative credentials. The passwords can readily be cracked. Many cameras have SSH or telnet listening on all interfaces. The passwords cannot be changed by the user, nor can the SSH or telnet service be disabled by the user. | ||||
| CVE-2025-61074 | 1 Adata | 1 Mitarbeiter Portal | 2026-01-14 | 4.6 Medium |
| A stored Cross Site Scripting (XSS) vulnerability in the bulletin board (SchwarzeBrett) in adata Software GmbH Mitarbeiter Portal 2.15.2.0 allows remote authenticated users to execute arbitrary JavaScript code in the web browser of other users via manipulation of the 'Inhalt' parameter of the '/SchwarzeBrett/Nachrichten/CreateNachricht' or '/SchwarzeBrett/Nachrichten/EditNachricht/' requests. | ||||
| CVE-2025-54353 | 1 Fortinet | 1 Fortisandbox | 2026-01-14 | 5.3 Medium |
| An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests. | ||||
| CVE-2025-12956 | 2 3ds, Dassult | 2 3dexperience Enovia, Enovia Collaborative Industry Innovator | 2026-01-12 | 8.7 High |
| A reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session. | ||||
| CVE-2025-63725 | 2 Meeco, Radioinorr | 2 Svx Portal, Svx Portal | 2026-01-12 | 6.1 Medium |
| Reflected Cross-Site Scripting (XSS) vulnerability in SVX Portal 2.7A via the id parameter to Recivers.php. | ||||
| CVE-2025-63243 | 1 Pixeon | 1 Weblaudos | 2026-01-12 | 4.6 Medium |
| A reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25.1 (01). The sle_sSenha parameter to the loginAlterarSenha.asp file. An attacker can craft a malicious URL that, when visited by a victim, causes arbitrary JavaScript code to be executed in the victim's browser within the security context of the vulnerable application. This issue could allow attackers to steal session cookies, disclose sensitive information, perform unauthorized actions on behalf of the user, or conduct phishing attacks. | ||||
| CVE-2024-13352 | 1 Alwayscurious | 1 Legull | 2026-01-09 | 7.1 High |
| The Legull WordPress plugin through 1.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||
| CVE-2024-13219 | 1 Waelhassan | 1 Privacy Policy Genius | 2026-01-09 | 6.1 Medium |
| The Privacy Policy Genius WordPress plugin through 2.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. | ||||
| CVE-2025-63735 | 2 Ruckus, Ruckuswireless | 2 Unleashed, Ruckus Unleashed | 2026-01-09 | 6.1 Medium |
| A reflected Cross site scripting (XSS) vulnerability in Ruckus Unleashed 200.13.6.1.319 via the name parameter to the the captive-portal endpoint selfguestpass/guestAccessSubmit.jsp. | ||||
| CVE-2025-64054 | 1 Fanvil | 3 X210, X210 Firmware, X210 V2 | 2026-01-09 | 9.6 Critical |
| A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to the /cgi-bin/webconfig?page=upload&action=submit endpoint. | ||||
| CVE-2025-55341 | 1 Quipux | 1 Quipux | 2026-01-08 | 6.5 Medium |
| Cross Site Scripting vulnerability in Quipux 4.0.1 through e1774ac allows anexos/anexos_nuevo.php asocImgRad. | ||||
| CVE-2025-60880 | 1 Webkul | 1 Bagisto | 2026-01-08 | 8.3 High |
| An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions. | ||||
| CVE-2025-67634 | 1 Cisa | 2 Software Acquisition Guide, Software Acquisition Guide Tool | 2026-01-08 | 4.4 Medium |
| The CISA Software Acquisition Guide Supplier Response Web Tool before 2025-12-11 was vulnerable to cross-site scripting via text fields. If an attacker could convince a user to import a specially-crafted JSON file, the Tool would load JavaScript from the file into the page. The JavaScript would execute in the context of the user's browser when the user submits the page (clicks 'Next'). | ||||
| CVE-2022-3539 | 1 Themepoints | 1 Super Testimonials | 2026-01-07 | 4.8 Medium |
| The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | ||||
| CVE-2021-36858 | 1 Themepoints | 1 Super Testimonials | 2026-01-07 | 4.8 Medium |
| Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themepoints Testimonials plugin <= 2.6 on WordPress. | ||||
| CVE-2025-14519 | 2 Baowzh, Hfly Project | 2 Hfly, Hfly | 2026-01-06 | 3.5 Low |
| A security flaw has been discovered in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. This issue affects some unknown processing of the file /admin/index.php/advtext/add of the component advtext Module. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be exploited. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-36746 | 1 Solaredge | 2 Monitoring Platform, Solaredge Monitoring Platform | 2026-01-06 | 5.4 Medium |
| SolarEdge monitoring platform contains a Cross‑Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s browser during a deletion attempt. | ||||
| CVE-2018-25138 | 1 Flir | 2 Flir Ax8, Flir Ax8 Firmware | 2026-01-05 | 9.8 Critical |
| FLIR AX8 Thermal Camera 1.32.16 contains hard-coded SSH and web panel credentials that cannot be changed through normal camera operations. Attackers can exploit these persistent credentials to gain unauthorized shell access and login to multiple camera interfaces using predefined username and password combinations. | ||||