Total
47276 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-67342 | 1 Ruoyi | 1 Ruoyi | 2026-06-17 | N/A | 4.6 MEDIUM |
| RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter, the protection can be bypassed. Additionally, because the menu is shared across all users, any user with menu modification permissions can impact all users by exploiting this stored XSS vulnerability. | |||||
| CVE-2025-67341 | 1 Jishenghua | 1 Jsherp | 2026-06-17 | N/A | 4.6 MEDIUM |
| jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Additionally, these PDF files can be accessed via static URLs, making them accessible to all users. | |||||
| CVE-2025-67263 | 1 Abacre | 1 Retail Point Of Sale | 2026-06-17 | N/A | 6.1 MEDIUM |
| Abacre Retail Point of Sale 14.0.0.396 is affected by a stored cross-site scripting (XSS) vulnerability in the Clients module. The application fails to properly sanitize user-supplied input stored in the Name and Surname fields. An attacker can insert malicious HTML or script content into these fields, which, persisted in the database. | |||||
| CVE-2025-67231 | 1 Todesktop | 1 Builder | 2026-06-17 | N/A | 5.9 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability in ToDesktop Builder v0.33.1 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload. | |||||
| CVE-2025-67202 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb. | |||||
| CVE-2025-67170 | 1 Ritecms | 1 Ritecms | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability in RiteCMS v3.1.0 allows attackers to execute arbitrary code in the context of a user's browser via a crafted payload. | |||||
| CVE-2025-67163 | 1 Simplemachines | 1 Simple Machines Forum | 2026-06-17 | N/A | 6.1 MEDIUM |
| A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Forum Name parameter. | |||||
| CVE-2025-67078 | 1 Agora-project | 1 Agora-project | 2026-06-17 | N/A | 6.1 MEDIUM |
| Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrary code via the notify parameter of the file controller used to display errors. | |||||
| CVE-2025-67025 | 1 Anycomment | 1 Anycomment.io | 2026-06-17 | N/A | 6.1 MEDIUM |
| Cross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to execute arbitrary code via the Anycomment comment section | |||||
| CVE-2025-66939 | 1 Altumcode | 1 66biolinks | 2026-06-17 | N/A | 5.4 MEDIUM |
| Cross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon file | |||||
| CVE-2025-66924 | 1 Opensourcepos | 1 Open Source Point Of Sale | 2026-06-17 | N/A | 6.1 MEDIUM |
| A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter. | |||||
| CVE-2025-66923 | 1 Opensourcepos | 1 Open Source Point Of Sale | 2026-06-17 | N/A | 7.2 HIGH |
| A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the phone_number parameter. | |||||
| CVE-2025-66921 | 1 Opensourcepos | 1 Open Source Point Of Sale | 2026-06-17 | N/A | 7.2 HIGH |
| A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "name" parameter. | |||||
| CVE-2025-66918 | 1 Hashenudara | 1 Edoc-doctor-appointment-system | 2026-06-17 | N/A | 8.8 HIGH |
| edoc-doctor-appointment-system v1.0.1 is vulnerable to Cross Site Scripting (XSS) in admin/add-session.php via the "title" parameter. | |||||
| CVE-2025-66880 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| Cross Site Scripting vulnerability in Wethink Technology Inc 720yun pano-sdk 0.5.877 allows a remote attacker to execute arbitrary code via the LoginComp (Module 2093) and SignupComp (Module 2094) modules. | |||||
| CVE-2025-66845 | 1 Nooncarlett | 1 Techstore | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected Cross-Site Scripting (XSS) vulnerability has been identified in TechStore version 1.0. The user_name endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser. | |||||
| CVE-2025-66843 | 1 Getgrav | 1 Grav | 2026-06-17 | N/A | 5.4 MEDIUM |
| grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with permission to edit content can inject malicious JavaScript payloads into editable fields. The payload is stored on the server and later executed when any other user views or edits the affected page. | |||||
| CVE-2025-66686 | 1 Grabaperch | 1 Perch | 2026-06-17 | N/A | 6.1 MEDIUM |
| A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges can inject malicious JavaScript code into the “Help button url” setting within the admin panel. The injected payload is stored and executed when any authenticated user clicks the Help button, potentially leading to session hijacking, information disclosure, privilege escalation, and unauthorized administrative actions. | |||||
| CVE-2025-66648 | 1 Vega-functions Project | 1 Vega-functions | 2026-06-17 | N/A | 7.2 HIGH |
| vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user input, malicious use of an internal function (not part of the public API) could be used to run unintentional javascript (XSS). This issue is fixed in vega-functions `6.1.1`. There is no workaround besides upgrading. Using `vega.expressionInterpreter` as described in CSP safe mode does not prevent this issue. | |||||
| CVE-2025-66580 | 1 Openagentplatform | 1 Dive | 2026-06-17 | N/A | 9.6 CRITICAL |
| Dive is an open-source MCP Host Desktop Application that enables integration with function-calling LLMs. A critical Stored Cross-Site Scripting (XSS) vulnerability exists in versions prior to 0.11.1 in the Mermaid diagram rendering component. The application allows the execution of arbitrary JavaScript via `javascript:`. An attacker can exploit this to inject a malicious Model Context Protocol (MCP) server configuration, leading to Remote Code Execution (RCE) on the victim's machine when the node is clicked. Version 0.11.1 fixes the issue. | |||||