Total
39705 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-2976 | 1 Gfi | 1 Kerio Connect | 2025-11-04 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability was found in GFI KerioConnect 10.0.6. It has been classified as problematic. Affected is an unknown function of the component File Upload. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2024-30929 | 1 Derbynet | 1 Derbynet | 2025-11-04 | N/A | 8.0 HIGH |
| Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the 'back' Parameter in playlist.php | |||||
| CVE-2024-30927 | 1 Derbynet | 1 Derbynet | 2025-11-04 | N/A | 6.3 MEDIUM |
| Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the racer-results.php component. | |||||
| CVE-2024-30926 | 1 Derbynet | 1 Derbynet | 2025-11-04 | N/A | 4.6 MEDIUM |
| Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the ./inc/kiosks.inc component. | |||||
| CVE-2024-30925 | 1 Derbynet | 1 Derbynet | 2025-11-04 | N/A | 6.5 MEDIUM |
| Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows attackers to execute arbitrary code via the photo-thumbs.php component. | |||||
| CVE-2024-30921 | 1 Derbynet | 1 Derbynet | 2025-11-04 | N/A | 5.4 MEDIUM |
| Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the photo.php component. | |||||
| CVE-2024-30920 | 1 Derbynet | 1 Derbynet | 2025-11-04 | N/A | 7.4 HIGH |
| Cross Site Scripting vulnerability in DerbyNet v9.0 and below allows a remote attacker to execute arbitrary code via the render-document.php component. | |||||
| CVE-2024-23192 | 2025-11-04 | N/A | 6.1 MEDIUM | ||
| RSS feeds that contain malicious data- attributes could be abused to inject script code to a users browser session when reading compromised RSS feeds or successfully luring users to compromised accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Potentially malicious attributes now get removed from external RSS content. No publicly available exploits are known. | |||||
| CVE-2024-23191 | 2025-11-04 | N/A | 5.4 MEDIUM | ||
| Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known. | |||||
| CVE-2024-23190 | 2025-11-04 | N/A | 5.4 MEDIUM | ||
| Upsell shop information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured accounts. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-defined upsell content has been improved. No publicly available exploits are known. | |||||
| CVE-2024-23189 | 2025-11-04 | N/A | 5.4 MEDIUM | ||
| Embedded content references at tasks could be used to temporarily execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to the users account, access to another account within the same context or an successful social engineering attack to make users import external content. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. Sanitization of user-generated content has been improved. No publicly available exploits are known. | |||||
| CVE-2023-51338 | 1 Phpjabbers | 1 Meeting Room Booking System | 2025-11-04 | N/A | 5.4 MEDIUM |
| PHPJabbers Meeting Room Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters of index.php page. | |||||
| CVE-2023-51337 | 1 Phpjabbers | 1 Event Ticketing System | 2025-11-04 | N/A | 5.4 MEDIUM |
| PHPJabbers Event Ticketing System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in "lid" parameter in index. | |||||
| CVE-2023-51335 | 1 Phpjabbers | 1 Cinema Booking System | 2025-11-04 | N/A | 6.5 MEDIUM |
| PHPJabbers Cinema Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. | |||||
| CVE-2023-51330 | 1 Phpjabbers | 1 Cinema Booking System | 2025-11-04 | N/A | 5.4 MEDIUM |
| PHPJabbers Cinema Booking System v1.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Now Showing menu "date" parameter. | |||||
| CVE-2023-51328 | 1 Phpjabbers | 1 Cleaning Business Software | 2025-11-04 | N/A | 5.4 MEDIUM |
| PHPJabbers Cleaning Business Software v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "c_name, name" parameters. | |||||
| CVE-2023-51325 | 1 Phpjabbers | 1 Shared Asset Booking System | 2025-11-04 | N/A | 5.4 MEDIUM |
| PHPJabbers Shared Asset Booking System v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. | |||||
| CVE-2023-51318 | 1 Phpjabbers | 1 Bus Reservation System | 2025-11-04 | N/A | 5.4 MEDIUM |
| PHPJabbers Bus Reservation System v1.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "title, name" parameters. | |||||
| CVE-2023-51315 | 1 Phpjabbers | 1 Restaurant Booking System | 2025-11-04 | N/A | 5.4 MEDIUM |
| PHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "seat_name, plugin_sms_api_key, plugin_sms_country_code, title, name" parameters. | |||||
| CVE-2023-51312 | 1 Phpjabbers | 1 Restaurant Booking System | 2025-11-04 | N/A | 5.4 MEDIUM |
| PHPJabbers Restaurant Booking System v3.0 is vulnerable to Reflected Cross-Site Scripting (XSS) in Reservations menu, Schedule section date parameter. | |||||