Total
47279 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-66040 | 2026-06-17 | N/A | 3.6 LOW | ||
| Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server that allows for JavaScript injection through the unsanitized error parameter. Attackers can execute arbitrary JavaScript in the user's browser during OAuth authentication. This issue has been patched in version 2.25.2. | |||||
| CVE-2025-66036 | 2026-06-17 | N/A | 6.1 MEDIUM | ||
| Retro is an online platform providing items of vintage collections. Prior to version 2.4.7, Retro is vulnerable to a cross-site scripting (XSS) in the input handling component. This issue has been patched in version 2.4.7. | |||||
| CVE-2025-66026 | 1 Redaxo | 1 Redaxo | 2026-06-17 | N/A | 6.1 MEDIUM |
| REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context when an authenticated user visits a crafted link while logged in. This issue has been patched in version 5.20.1. | |||||
| CVE-2025-66021 | 1 Owasp | 1 Java Html Sanitizer | 2026-06-17 | N/A | 6.1 MEDIUM |
| OWASP Java HTML Sanitizer is a configureable HTML Sanitizer written in Java, allowing inclusion of HTML authored by third-parties in web applications while protecting against XSS. In version 20240325.1, OWASP java html sanitizer is vulnerable to XSS if HtmlPolicyBuilder allows noscript and style tags with allowTextIn inside the style tag. This could lead to XSS if the payload is crafted in such a way that it does not sanitise the CSS and allows tags which is not mentioned in HTML policy. At time of publication no known patch is available. | |||||
| CVE-2025-65961 | 1 Contao | 1 Contao | 2026-06-17 | N/A | 3.3 LOW |
| Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually. | |||||
| CVE-2025-65959 | 1 Openwebui | 1 Open Webui | 2026-06-17 | N/A | 8.7 HIGH |
| Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.6.37, a Stored XSS vulnerability was discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as PDF. This vulnerability can be exploited by any authenticated user, and unauthenticated external attackers can steal session tokens from users (both admin and regular users) by sharing specially crafted markdown files. This vulnerability is fixed in 0.6.37. | |||||
| CVE-2025-65956 | 1 Formwork Project | 1 Formwork | 2026-06-17 | N/A | 6.5 MEDIUM |
| Formwork is a flat file-based Content Management System (CMS). Prior to version 2.2.0, inserting unsanitized data into the blog tag field results in stored cross‑site scripting (XSS). Any user with credentials to the Formwork CMS who accesses or edits an affected blog post will have attacker‑controlled script executed in their browser. The issue is persistent and impacts privileged administrative workflows. This issue has been patched in version 2.2.0. | |||||
| CVE-2025-65923 | 1 Frappe | 1 Erpnext | 2026-06-17 | N/A | 5.4 MEDIUM |
| A Stored Cross-Site Scripting (XSS) vulnerability was discovered within the CSV import mechanism of ERPNext thru 15.88.1 when using the Update Existing Recordsoption. An attacker can embed malicious JavaScript code into a CSV field, which is then stored in the database and executed whenever the affected record is viewed by a user within the ERPNext web interface. This exposure may allow an attacker to compromise user sessions or perform unauthorized actions under the context of a victim's account. | |||||
| CVE-2025-65892 | 1 Krpano | 1 Krpano | 2026-06-17 | N/A | 6.1 MEDIUM |
| Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the victim's browser via a crafted URL to the passQueryParameters function with the xml parameter enabled. | |||||
| CVE-2025-65881 | 1 Oretnom23 | 1 Zoo Management System | 2026-06-17 | N/A | 6.1 MEDIUM |
| Sourcecodester Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /classes/Login.php. | |||||
| CVE-2025-65858 | 1 Janeczku | 1 Calibre-web | 2026-06-17 | N/A | 3.5 LOW |
| A Stored Cross-Site Scripting (XSS) vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed. | |||||
| CVE-2025-65837 | 1 Publiccms | 1 Publiccms | 2026-06-17 | N/A | 5.4 MEDIUM |
| PublicCMS V5.202506.b is vulnerable to Cross Site Scripting (XSS) in the Content Search module. | |||||
| CVE-2025-65790 | 1 Realtimelogic | 1 Fuguhub | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected cross-site scripting (XSS) vulnerability exists in FuguHub 8.1 when serving SVG files through the /fs/ file manager interface. FuguHub does not sanitize or restrict script execution inside SVG content. When a victim opens a crafted SVG containing an inline <script> element, the browser executes the attacker-controlled JavaScript. | |||||
| CVE-2025-65778 | 1 Wekan Project | 1 Wekan | 2026-06-17 | N/A | 8.1 HIGH |
| An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token theft and CSRF actions. | |||||
| CVE-2025-65754 | 1 Algernon Project | 1 Algernon | 2026-06-17 | N/A | 6.1 MEDIUM |
| Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filename. | |||||
| CVE-2025-65734 | 1 Openeclass | 1 Openeclass | 2026-06-17 | N/A | 5.4 MEDIUM |
| An authenticated arbitrary file upload vulnerability in the Courses/Work Assignments module of gunet Open eClass v3.11, and fixed in v3.13, allows attackers to execute arbitrary code via uploading a crafted SVG file. | |||||
| CVE-2025-65717 | 1 Ritwickdey | 1 Live Server | 2026-06-17 | N/A | 4.3 MEDIUM |
| An issue in Visual Studio Code Extensions Live Server v5.7.9 allows attackers to exfiltrate files via user interaction with a crafted HTML page. | |||||
| CVE-2025-65592 | 1 Nopcommerce | 1 Nopcommerce | 2026-06-17 | N/A | 6.1 MEDIUM |
| nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) in the product management functionality. Malicious payloads inserted into the "Product Name" and "Short Description" fields are stored in the backend database and executed automatically whenever a user views the affected pages. | |||||
| CVE-2025-65591 | 1 Nopcommerce | 1 Nopcommerce | 2026-06-17 | N/A | 5.4 MEDIUM |
| nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Currencies functionality. | |||||
| CVE-2025-65590 | 1 Nopcommerce | 1 Nopcommerce | 2026-06-17 | N/A | 5.4 MEDIUM |
| nopCommerce 4.90.0 is vulnerable to Cross Site Scripting (XSS) via the Blog posts functionality in the Content Management area. | |||||