CVE Vulnerability Catalog

The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 1.3.1. This is due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level permissions or higher can inject arbitrary web scripts that execute when a user visits an affected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Podatność CVE-2025-0876 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie IT's Workif, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy wersji systemu do 20251003.

Emlog is an open source website building system. A stored Cross-Site Scripting (XSS) vulnerability exists in the "Twitter" feature of EMLOG Pro 2.5.21 and below. An authenticated user with privileges to post a "Twitter" message can inject arbitrary JavaScript code, which is stored on the server and executed in the browser of any user, including administrators, when they click on the malicious post.

Cursor versions 1.6 and below allow embedding images in Mermaid diagrams rendered in the chat box. Through prompt injection, an attacker can force an image fetch from an external server and exfiltrate sensitive information.

The Yoast SEO Premium plugin for WordPress versions 25.7 to 25.9 is vulnerable to stored XSS due to a flawed regex used to remove an attribute in post content. This can be abused to inject arbitrary HTML attributes, including JavaScript event handlers. A user with Contributor access or higher can create a post containing a malicious JavaScript payload.

WeGIA, an open-source web manager for charitable institutions, versions 3.4.12 and below contain an Open Redirect vulnerability in the control.php endpoint, specifically in the nextPage parameter (metodo=listarUmnomeClasse=FuncionarioControle). This allows attackers to redirect users to arbitrary external domains, enabling phishing campaigns, malicious payload distribution, or credential theft. The issue is fixed in version 3.5.0.

CVE-2025-54088 is an open-redirect vulnerability in Secure Access prior to version 14.10. Attackers with access to the console can redirect victims to an arbitrary URL. The attack complexity is low, attack requirements are present, no privileges are required, and users must actively participate in the attack. Impact to confidentiality is low and there is no impact to integrity or availability. There are high severity impacts to confidentiality, integrity, availability in subsequent systems.

Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application store numerous sensitive credentials (database passwords, MySQL root password, SaaS keys, Portainer admin password, etc.) in world-readable cleartext files. Any local user or process with filesystem access can retrieve these secrets, leading to credential theft and full appliance compromise.

A Server-Side Request Forgery (SSRF) vulnerability in VitaraCharts 5.3.5 in fileLoader.jsp allows an attacker to send requests from the server to internal network resources.

AndSoft e-TMS v25.03 contains a reflected Cross-Site Scripting (XSS) vulnerability. An attacker can execute JavaScript code in the victim's browser by sending a malicious URL with parameters 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in the path '/clt/LOGINFRM_VON.ASP'.

Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_TP.ASP'.

Cross-site scripting (XSS) vulnerability reflected in AndSoft's e-TMS v25.03. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL. The relationship between parameter and assigned identifier is 'l, demo, demo2, TNTLOGIN, UO and SuppConn' parameters in '/clt/LOGINFRM_SIL.ASP'.

Reflected XSS vulnerability in AndSoft's e-TMS v25.03. It allows an attacker to execute JavaScript in the victim's browser via a malicious URL. Parameters 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in '/clt/LOGINFRM_MRK.ASP' are affected.

Reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03. An attacker can execute JavaScript code in the victim's browser by sending them a malicious URL. The vulnerable parameters are 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in '/clt/LOGINFRM_MON.ASP'.

Reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03. An attacker can execute JavaScript code in the victim's browser by sending them a malicious URL. The vulnerable parameters are 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in '/clt/LOGINFRM_MOL.ASP'.

Reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03. An attacker can execute JavaScript code in the victim's browser by sending them a malicious URL. The vulnerable parameters are 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in '/clt/LOGINFRM_MNG.ASP'.

Reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03. An attacker can execute JavaScript code in the victim's browser by sending them a malicious URL. The vulnerable parameters are 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in '/clt/LOGINFRM_LVE.ASP'.

Reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03. An attacker can execute JavaScript code in the victim's browser by sending them a malicious URL. The vulnerable parameters are 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in '/clt/LOGINFRM_LT.ASP'.

Reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03. An attacker can execute JavaScript code in the victim's browser by sending them a malicious URL. The vulnerable parameters are 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in '/clt/LOGINFRM_LF.ASP'.

Reflected cross-site scripting (XSS) vulnerability in AndSoft's e-TMS v25.03. An attacker can execute JavaScript code in the victim's browser by sending them a malicious URL. The vulnerable parameters are 'l, demo, demo2, TNTLOGIN, UO and SuppConn' in '/clt/LOGINFRM_FCC.ASP'.