CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2025-4866 – weibocom rill-flow Management Console code injection
https://notcve.org/view.php?id=CVE-2025-4866
18 May 2025 — The manipulation leads to code injection. ... Dank der Manipulation mit unbekannten Daten kann eine code injection-Schwachstelle ausgenutzt werden. • https://github.com/weibocom/rill-flow/issues/102 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2025-4862 – PHPGurukul Directory Management System searchdata.php cross site scripting
https://notcve.org/view.php?id=CVE-2025-4862
18 May 2025 — A vulnerability, which was classified as problematic, has been found in PHPGurukul Directory Management System 2.0. Affected by this issue is some unknown functionality of the file /searchdata.php. The manipulation of the argument searchdata leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://github.com/Schatten-42/MyCVE/issues/4 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 1CVE-2025-4860 – D-Link DAP-2695 Static Pool Settings Page adv_dhcps.php cross site scripting
https://notcve.org/view.php?id=CVE-2025-4860
18 May 2025 — A vulnerability classified as problematic has been found in D-Link DAP-2695 120b36r137_ALL_en_20210528. Affected is an unknown function of the file /adv_dhcps.php of the component Static Pool Settings Page. The manipulation of the argument f_mac leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. • https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/DAP-2695/XSS_Static_Pool_Settings • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 1CVE-2025-4859 – D-Link DAP-2695 MAC Bypass Settings Page adv_macbypass.php cross site scripting
https://notcve.org/view.php?id=CVE-2025-4859
18 May 2025 — A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been rated as problematic. This issue affects some unknown processing of the file /adv_macbypass.php of the component MAC Bypass Settings Page. The manipulation of the argument f_mac leads to cross site scripting. The attack may be initiated remotely. • https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/DAP-2695/XSS_MAC_Bypass • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.8EPSS: 0%CPEs: 2EXPL: 1CVE-2025-4858 – D-Link DAP-2695 ARP Spoofing Prevention Page adv_arpspoofing.php cross site scripting
https://notcve.org/view.php?id=CVE-2025-4858
18 May 2025 — A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been declared as problematic. This vulnerability affects unknown code of the file /adv_arpspoofing.php of the component ARP Spoofing Prevention Page. The manipulation of the argument harp_mac leads to cross site scripting. The attack can be initiated remotely. • https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/DAP-2695/XSS_ARP_Spoofing_Prevention • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2025-4852 – TOTOLINK A3002R VPN Page cross site scripting
https://notcve.org/view.php?id=CVE-2025-4852
18 May 2025 — A vulnerability, which was classified as problematic, has been found in TOTOLINK A3002R 2.1.1-B20230720.1011. This issue affects some unknown processing of the component VPN Page. The manipulation of the argument Comment leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. • https://github.com/fizz-is-on-the-way/Iot_vuls/tree/main/A3002RU_V2/XSS_VPN • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.3EPSS: 0%CPEs: 5EXPL: 1CVE-2025-4767 – defog-ai introspect Test Endpoint integration_routes.py test_custom_tool code injection
https://notcve.org/view.php?id=CVE-2025-4767
16 May 2025 — The manipulation of the argument input_model leads to code injection. ... Dank Manipulation des Arguments input_model mit unbekannten Daten kann eine code injection-Schwachstelle ausgenutzt werden. • https://github.com/defog-ai/introspect/issues/496 • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.1EPSS: 0%CPEs: 1EXPL: 1CVE-2025-4745 – code-projects Employee Record System current_employees.php cross site scripting
https://notcve.org/view.php?id=CVE-2025-4745
16 May 2025 — A vulnerability, which was classified as problematic, was found in code-projects Employee Record System 1.0. This affects an unknown part of the file current_employees.php. The manipulation of the argument employeed_id/first_name/middle_name/last_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. • https://code-projects.org • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 5.1EPSS: 0%CPEs: 1EXPL: 1CVE-2025-4744 – code-projects Employee Record System edit_employee.php cross site scripting
https://notcve.org/view.php?id=CVE-2025-4744
16 May 2025 — A vulnerability, which was classified as problematic, has been found in code-projects Employee Record System 1.0. Affected by this issue is some unknown functionality of the file dashboard\edit_employee.php. The manipulation of the argument employeed_id/first_name/middle_name/last_name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. • https://code-projects.org • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2025-47562 – WordPress MapSVG <= 8.5.34 - Content Injection Vulnerability
https://notcve.org/view.php?id=CVE-2025-47562
16 May 2025 — Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG allows Code Injection. • https://patchstack.com/database/wordpress/plugin/mapsvg/vulnerability/wordpress-mapsvg-8-5-34-content-injection-vulnerability?_s_id=cve • CWE-94: Improper Control of Generation of Code ('Code Injection') •