Do Son A XSS flaw in Open WebUI allows authenticated users to achieve Admin RCE by injecting JavaScript into rich text prompts, then exploiting the Functions feature. Update to v0.6.35.
XSS
Apache patched a Critical RCE flaw (CVE-2025-59118) in OFBiz ERP that allows remote attackers to upload arbitrary files with dangerous types. A reflected XSS flaw was also fixed.
LiteSpeed Cache for WordPress (LSCWP) versions 7.5.0.1 are vulnerable to a Reflected XSS flaw, exposing 7M sites to account takeover. Update to 7.6 now.
Cisco released updates for its Desk and IP Phone series, fixing a High-severity DoS flaw (CVE-2025-20350) from buffer overflow and a Medium XSS flaw (CVE-2025-20351).
CISA added the Zimbra XSS zero-day (CVE-2025-27915) to its KEV Catalog due to active exploitation since January. Attackers use malicious .ICS files to steal mail data.
Elastic patched five flaws in Kibana/Elasticsearch, including three Critical XSS issues (CVE-2025-25009) and credential leaks, urging immediate upgrades to v8.18.8+.
Synacktiv exposed a critical flaw chain in Snipe-IT. A low-privileged user can exploit a Stored XSS (CVE-2025-59712) to hijack admin sessions and trigger RCE (CVE-2025-59713) via unsafe deserialization.
Yoast SEO Premium has a stored XSS flaw (CVE-2025-11241) that allows Contributor+ users to inject malicious scripts into posts. All users are urged to upgrade to v26.0 immediately.
Splunk issued patches for six flaws, including a High-severity blind SSRF (CVE-2025-20371) and XSS issues that could allow attackers to access sensitive data and crash the platform.
Two WordPress Core vulnerabilities (XSS and Info Exposure) affecting versions up to 6.8.2 were accidentally exposed before patches were ready.
A critical XSS flaw (CVE-2025-59545) in DNN's Prompt module allows attackers to execute code and hijack admin sessions. All users must update immediately.
A critical XSS flaw in the Lectora e-learning platform (CVE-2025-9125) allows for malicious code injection, posing a risk of session hijacking and redirection.
A high-severity flaw (CVE-2025-58179) in Astro's Cloudflare adapter allows attackers to bypass domain restrictions, leading to SSRF and XSS attacks.
A new security advisory reveals two high-severity flaws in FreePBX, including a stored XSS and a shared OAuth key that could allow for API token forgery and admin compromise.
GitLab has released patches for multiple high-severity vulnerabilities, including several XSS flaws that could lead to account takeover. All users should update immediately.
CERT/CC reveals critical flaws in Partner Software and Partner Web, including default admin credentials and XSS, that allow unauthenticated RCE on municipal and state systems.
SonicWall SMA 100 series has buffer overflow and XSS flaws (CVSS 6.3-7.3) exploitable by unauthenticated attackers via the web interface. Update to 10.2.2.1-90sv immediately!
GitLab patched multiple high-severity XSS and data exposure vulnerabilities in CE/EE, urging users to update to 18.2.1, 18.1.3, or 18.0.5.
Grafana Labs issued urgent patches for high-severity XSS (CVE-2025-6023) and medium-severity open redirect (CVE-2025-6197) vulnerabilities, impacting its observability platform.
Four critical flaws, including unauthenticated telnet access and RCE, discovered in Nexxt Solutions NCM-X1800 mesh routers allow full network compromise. Update or disable immediately.
Microsoft enables JScript9Legacy by default in Windows 11 24H2, replacing the deprecated JScript. This enhanced engine offers improved security against XSS and maintains backward compatibility.
GitLab releases urgent security updates to fix critical vulnerabilities, including an 8.7 CVSS score XSS flaw. Update your instances now to prevent attacks.