Cross-site scripting (XSS) is a web application vulnerability that enables execution of attacker-controlled scripts in users’ browsers, risking account compromise and data exposure. It matters in enterprise contexts because it targets authenticated sessions in critical business applications and portals.
38 articles about Cross-Site Scripting
Decision Insights Threat Desk • November 18, 2025
Lectora software versions 21.0–21.3 and 7.1.6 and older had an XSS vulnerability. A patch in version 21.4 requires republishing courses.
Decision Insights Threat Desk • November 18, 2025
SynchroWeb's Kiwire Captive Portal has three web vulnerabilities identified, prompting users to update their systems for security.
Decision Insights Research • November 14, 2025
Decision Insights Threat Desk • November 13, 2025
Advantech's DeviceOn/iEdge, an IoT management platform, is subject to multiple vulnerabilities, including XSS and path traversal.
Decision Insights Threat Desk • November 13, 2025
AVEVA disclosed a vulnerability in its Application Server IDE, affecting versions up to 2023 R2 SP1 P02. The issue involves improper HTML tag neutralization, allowing potential XSS code exploitation. Recommended mitigations include updating to a later version and restricting network access.
Decision Insights Threat Desk • November 13, 2025
CISA, in collaboration with federal and international partners, has issued an updated Cybersecurity Advisory on Akira ransomware, detailing latest attack methods and prevention strategies.
Decision Insights Threat Desk • November 13, 2025
Rockwell Automation has identified multiple vulnerabilities in the FactoryTalk DataMosaix Private Cloud, urging users to update to secure versions.
Decision Insights Threat Desk • November 13, 2025
CISA has released an updated advisory on Akira ransomware, detailing its evolving tactics and threats to critical sectors. Organizations are urged to apply patches, enforce multifactor authentication, and monitor for unusual activity to enhance their security measures.
Decision Insights Threat Desk • November 11, 2025
Kiwire Captive Portal by SynchroWeb has three vulnerabilities, including SQL injection, open redirection, and XSS.
Decision Insights Threat Desk • November 11, 2025
Agencies must remediate vulnerability CVE-2025-27915 in the Known Exploited Vulnerabilities Catalog to protect federal networks.
Decision Insights Threat Desk • November 6, 2025
Advantech's DeviceOn/iEdge has vulnerabilities that allow remote code execution and Denial of Service. Users should upgrade devices.
Decision Insights Threat Desk • October 21, 2025
CISA flags vulnerabilities in Rockwell's 1783-NATR equipment, advising defenses against potential exploitation risks.