Total
47282 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-57874 | 1 Esri | 1 Portal For Arcgis | 2026-06-17 | N/A | 4.8 MEDIUM |
| There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser. | |||||
| CVE-2025-57873 | 1 Esri | 1 Portal For Arcgis | 2026-06-17 | N/A | 4.8 MEDIUM |
| There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser. | |||||
| CVE-2025-57871 | 1 Esri | 1 Portal For Arcgis | 2026-06-17 | N/A | 4.8 MEDIUM |
| There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS 11.4 and below that may allow a remote authenticated attacker with administrative access to supply a crafted string which would execute arbitrary JavaScript code in the browser. | |||||
| CVE-2025-57787 | 1 Meddream | 1 Pacs Server | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected cross-site scripting (xss) vulnerability exists in the modifyRoute functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability. | |||||
| CVE-2025-57786 | 1 Meddream | 1 Pacs Server | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability. | |||||
| CVE-2025-57769 | 1 Freshrss | 1 Freshrss | 2026-06-17 | N/A | 6.1 MEDIUM |
| FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below contain a vulnerability where a specially crafted page can trick a user into executing arbitrary JS code or promoting a user in FreshRSS by obscuring UI elements in iframes. If embedding an authenticated iframe is possible, this may lead to privilege escalation via obscuring the promote user button in the admin UI or XSS by tricking the user to drag content into the UserJS text area. This is fixed in version 1.27.0 | |||||
| CVE-2025-57768 | 2026-06-17 | N/A | N/A | ||
| Phproject is a high performance full-featured project management system. From 1.8.0 to before 1.8.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Planned Hours field when creating a new project. When sending a POST request to /issues/new/, the value provided in the Planned Hours field is included in the server response without any HTML encoding or sanitization. Because of this, an attacker can craft a malicious payload such as <script>alert(1)</script> and include it in the planned_hours parameter. The server reflects the input directly in the HTML of the project creation page, causing the browser to interpret and execute it. This vulnerability is fixed in 1.8.3. | |||||
| CVE-2025-57765 | 1 Wegia | 1 Wegia | 2026-06-17 | N/A | 6.5 MEDIUM |
| WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the pre_cadastro_adotante.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.4.7. | |||||
| CVE-2025-57764 | 1 Wegia | 1 Wegia | 2026-06-17 | N/A | 6.5 MEDIUM |
| WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, a Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cargos.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the msg_e parameter. This vulnerability is fixed in 3.4.7. | |||||
| CVE-2025-57763 | 1 Wegia | 1 Wegia | 2026-06-17 | N/A | 6.1 MEDIUM |
| WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the insere_despacho.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts in the cpf sccs. This vulnerability is fixed in 3.4.7. | |||||
| CVE-2025-57762 | 1 Wegia | 1 Wegia | 2026-06-17 | N/A | 6.1 MEDIUM |
| WeGIA is a Web manager for charitable institutions. Prior to 3.4.7, there is a Stored Cross-Site Scripting (XSS) vulnerability in the dependente_docdependente.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the nome parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. This vulnerability is fixed in 3.4.7. | |||||
| CVE-2025-57731 | 1 Jetbrains | 1 Youtrack | 2026-06-17 | N/A | 8.7 HIGH |
| In JetBrains YouTrack before 2025.2.92387 stored XSS was possible via Mermaid diagram content | |||||
| CVE-2025-57706 | 1 Qnap | 1 File Station | 2026-06-17 | N/A | 5.4 MEDIUM |
| A cross-site scripting (XSS) vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later | |||||
| CVE-2025-57703 | 1 Deltaww | 1 Diaenergie | 2026-06-17 | N/A | 6.1 MEDIUM |
| DIAEnergie - Reflected Cross-site Scripting | |||||
| CVE-2025-57702 | 1 Deltaww | 1 Diaenergie | 2026-06-17 | N/A | 6.1 MEDIUM |
| DIAEnergie - Reflected Cross-site Scripting | |||||
| CVE-2025-57701 | 1 Deltaww | 1 Diaenergie | 2026-06-17 | N/A | 6.1 MEDIUM |
| DIAEnergie - Reflected Cross-site Scripting | |||||
| CVE-2025-57700 | 1 Deltaww | 1 Diaenergie | 2026-06-17 | N/A | 6.1 MEDIUM |
| DIAEnergie - Stored Cross-site Scripting | |||||
| CVE-2025-57692 | 1 Dotnetfoundation | 1 Piranha Cms | 2026-06-17 | N/A | 6.8 MEDIUM |
| PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user s browser. | |||||
| CVE-2025-57681 | 1 Thestarware | 1 Worklogpro | 2026-06-17 | N/A | 5.4 MEDIUM |
| The WorklogPRO - Timesheets for Jira plugin in Jira Data Center before version 4.23.6-jira10 and before version 4.23.5-jira9 allows users and attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability. The vulnerability is exploited via a specially crafted payload placed in an issue's summary field | |||||
| CVE-2025-57665 | 1 Element-plus | 1 Element-plus | 2026-06-17 | N/A | 6.4 MEDIUM |
| Element Plus Link component (el-link) through 2.10.6 implements insufficient input validation for the href attribute, creating a security abstraction gap that obscures URL-based attack vectors. The component passes user-controlled href values directly to underlying anchor elements without protocol validation, URL sanitization, or security headers. This allows attackers to inject malicious URLs using dangerous protocols (javascript:, data:, file:) or redirect users to external malicious sites. While native HTML anchor elements present similar risks, UI component libraries bear additional responsibility for implementing security safeguards and providing clear risk documentation. The vulnerability enables XSS attacks, phishing campaigns, and open redirect exploits affecting applications that use Element Plus Link components with user-controlled or untrusted URL inputs. | |||||