Total
47284 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-54543 | 1 Opensolution | 1 Quick.cms | 2026-06-17 | N/A | 4.8 MEDIUM |
| QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default admin user is not able to add JavaScript into the website. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. | |||||
| CVE-2025-54540 | 1 Opensolution | 1 Quick.cms | 2026-06-17 | N/A | 6.1 MEDIUM |
| QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. | |||||
| CVE-2025-54534 | 1 Jetbrains | 1 Teamcity | 2026-06-17 | N/A | 4.8 MEDIUM |
| In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page | |||||
| CVE-2025-54495 | 1 Meddream | 1 Pacs Server | 2026-06-17 | N/A | 6.1 MEDIUM |
| A reflected cross-site scripting (xss) vulnerability exists in the emailfailedjob functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious url can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability. | |||||
| CVE-2025-54476 | 2026-06-17 | N/A | N/A | ||
| Improper handling of input could lead to an XSS vector in the checkAttribute method of the input filter framework class. | |||||
| CVE-2025-54423 | 1 9001 | 1 Copyparty | 2026-06-17 | N/A | 5.4 MEDIUM |
| copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code in a victim's browser due to improper sanitization of multimedia tags in music files, including m3u files. This is fixed in version 1.18.5. | |||||
| CVE-2025-54421 | 1 Namelessmc | 1 Nameless | 2026-06-17 | N/A | 7.2 HIGH |
| NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.4 allows remote authenticated attackers to inject arbitrary web script or HTML via the default_keywords crafted parameter. This vulnerability is fixed in 2.2.4. | |||||
| CVE-2025-54411 | 1 Discourse | 1 Discourse | 2026-06-17 | N/A | 5.4 MEDIUM |
| Discourse is an open-source discussion platform. Welcome banner user name string for logged in users can be vulnerable to XSS attacks, which affect the user themselves or an admin impersonating them. Admins can temporarily alter the welcome_banner.header.logged_in_members site text to remove the preferred_display_name placeholder, or not impersonate any users for the time being. This vulnerability is fixed in 3.5.0.beta8. | |||||
| CVE-2025-54407 | 1 Groupsession | 1 Groupsession | 2026-06-17 | N/A | 6.1 MEDIUM |
| Stored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. If a user accesses a crafted page or URL, an arbitrary script may be executed on the web browser of the user. | |||||
| CVE-2025-54395 | 1 Netwrix | 1 Directory Manager | 2026-06-17 | N/A | 6.1 MEDIUM |
| Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication configuration data. | |||||
| CVE-2025-54392 | 1 Netwrix | 1 Directory Manager | 2026-06-17 | N/A | 6.1 MEDIUM |
| Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data, a different vulnerability than CVE-2025-47189. | |||||
| CVE-2025-54384 | 2026-06-17 | N/A | 6.3 MEDIUM | ||
| CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.9 and 2.11.4, the helpers.markdown_extract() function did not perform sufficient sanitization of input data before wrapping in an HTML literal element. This helper is used to render user-provided data on dataset, resource, organization or group pages (plus any page provided by an extension that used that helper function), leading to a potential XSS vector. This vulnerability has been fixed in CKAN 2.10.9 and 2.11.4. | |||||
| CVE-2025-54353 | 1 Fortinet | 1 Fortisandbox | 2026-06-17 | N/A | 5.4 MEDIUM |
| An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.0 through 4.4.7, FortiSandbox 4.2 all versions, FortiSandbox 4.0 all versions may allow an attacker to perform an XSS attack via crafted HTTP requests. | |||||
| CVE-2025-54316 | 2026-06-17 | N/A | 4.9 MEDIUM | ||
| An issue was discovered in Logpoint before 7.6.0. When creating reports, attackers can create custom Jinja templates that chained built-in filter functions to generate XSS payloads. These payloads can be rendered by the Logpoint Report Template engine, making it vulnerable to cross-site scripting (XSS) attacks. | |||||
| CVE-2025-54301 | 2026-06-17 | N/A | N/A | ||
| A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. File names are not properly escaped. | |||||
| CVE-2025-54300 | 2026-06-17 | N/A | N/A | ||
| A stored XSS vulnerability in Quantum Manager component 1.0.0-3.2.0 for Joomla was discovered. The SVG upload feature does not sanitize uploads. | |||||
| CVE-2025-54299 | 2026-06-17 | N/A | N/A | ||
| A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered. | |||||
| CVE-2025-54298 | 2026-06-17 | N/A | N/A | ||
| A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered. | |||||
| CVE-2025-54297 | 2026-06-17 | N/A | N/A | ||
| A stored XSS vulnerability in CComment component 5.0.0-6.1.14 for Joomla was discovered. | |||||
| CVE-2025-54296 | 2026-06-17 | N/A | N/A | ||
| A stored XSS vulnerability in ProFiles component 1.0-1.5.0 for Joomla was discovered. | |||||