CVEs published March 5, 2025
139 CVEs were published on March 5, 2025: 50 critical, 29 high.
- Published
- 139
- Critical
- 50
- High
- 29
- Medium
- 58
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 33
Most affected products
- Google Chrome
- 9
- Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- 4
- Keysight Ixia Vision Product Family
- 4
- heroplugins Hero Mega Menu - Responsive WordPress Menu Plug…
- 3
- projectworlds Online Hotel Booking
- 3
- averta Master Slider – Responsive Touch Slider
- 2
- GMOD Apollo
- 2
- NVIDIA Hopper HGX 8-GPU
- 2
- redaxo · redaxo/source
- 2
- AlThemist Lafka - Multi Store Burger - Pizza & Food Deliver…
- 1
Critical 50
- CVE-2025-27517Volt Allows RCE Via User-Crafted Requestslivewire volt · livewire/volt
- CVE-2023-38693RCE in Lucee REST endpointLucee · org.lucee:lucee
- CVE-2024-12799Insufficiently Protected CredentialsOpenText Identity Manager Advanced Edition
- CVE-2024-13147SQLi in Merkur Software's B2B Login PanelMerkur Software B2B Login Panel
- CVE-2024-12097SQLi in Boceksoft Informatics' E-TravelBoceksoft Informatics E-Travel
- CVE-2024-11951Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation in homey_registerFave Themes Homey Login Register
- CVE-2024-12281Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profileFave Themes Homey
- CVE-2025-25015Kibana arbitrary code execution via prototype pollutionElastic Kibana
- CVE-2024-13787VEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injectiondesignthemes VEDA - MultiPurpose WordPress Theme
- CVE-2025-1515WP Real Estate Manager <= 2.8 - Authentication Bypass via Account TakeoverChimpstudio WP Real Estate Manager
- CVE-2025-1393Weidmueller: Authentication Vulnerability due to Hard-coded CredentialsWeidmueller PROCON-WIN
- CVE-2025-24924GMOD Apollo Missing Authentication for Critical FunctionGMOD Apollo
- CVE-2025-25362A Server-Side Template Injection (SSTI) vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a craftedspacy-llm
- CVE-2025-25632Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.
- CVE-2025-27638Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Hardcoded Password V-2024-013.
- CVE-2025-27640Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows SQL Injection V-2024-012.
- CVE-2025-27641Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.951 Application 20.0.2368 allows Unauthenticated APIs for Single-Sig
- CVE-2025-27642Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Unauthenticated Driver Package Edit
- CVE-2025-27643Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Hardcoded AWS API Key V-2024-006.
- CVE-2025-27645Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Insecure Extension Installation by
- CVE-2025-27646Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Edit User Account Exposure V-2024-0
- CVE-2025-27647Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Addition of Partial Admin Users Wit
- CVE-2025-27648Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.913 Application 20.0.2253 allows Cross Tenant Password Exposure V-20
- CVE-2025-27649Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.893 Application 20.0.2140 allows Incorrect Access Control: PHP V-202
- CVE-2025-27650Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Private Keys in Docker Overlay V-20
- CVE-2025-27651Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: Elatec
- CVE-2025-27652Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: rfIDEA
- CVE-2025-27655Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Server-Side Request Forgery: CPA v1
- CVE-2025-27656Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Password Stored in Process List V-2
- CVE-2025-27657Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Code Execution V-2023-008.
- CVE-2025-27658Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Authentication Bypass OVE-20230524-
- CVE-2025-27659Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows SQL Injection OVE-20230524-0002.
- CVE-2025-27661Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Session Fixation OVE-20230524-0004.
- CVE-2025-27662Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Password in URL OVE-20230524-0005.
- CVE-2025-27663Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Weak Password Encryption / Encoding
- CVE-2025-27665Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Antivirus Protection a
- CVE-2025-27666Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Authorization Checks O
- CVE-2025-27667Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Administrative User Email Enumerati
- CVE-2025-27668Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Arbitrary Content Inclusion via Ifr
- CVE-2025-27670Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient Signature Validation O
- CVE-2025-27671Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Device Impersonation OVE-20230524-0
- CVE-2025-27672Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows OAUTH Security Bypass OVE-20230524-
- CVE-2025-27673Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cookie Returned in Response Body OV
- CVE-2025-27674Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Hardcoded IdP Key V-2023-006.
- CVE-2025-27675Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Vulnerable OpenID Implementation V-
- CVE-2025-27677Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Symbolic Links For Unprivileged Fil
- CVE-2025-27678Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Client Remote Code Execution V-2023
- CVE-2025-27680Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.750 Application 20.0.1442 allows Insecure Firmware Image with Insuffi
- CVE-2025-27681Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 mishandles Client Inter-process Security V-
- CVE-2025-27682Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Insecure Log Permissions V-2022-005.
High 29
- CVE-2025-27508Emissary Use of a Broken or Risky Cryptographic AlgorithmNationalSecurityAgency emissary · gov.nsa.emissary:emissary
- CVE-2025-2003Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' pDevolutions Server
- CVE-2025-27513OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Packageopen-telemetry opentelemetry-dotnet · OpenTelemetry.Api
- CVE-2025-20206Cisco Secure Client for Windows with VPN Posture (HostScan) Module DLL Hijacking VulnerabilityCisco Secure Client
- CVE-2025-27497OpenDJ Denial of Service (Dos) using alias loopOpenIdentityPlatform OpenDJ · org.openidentityplatform.open…
- CVE-2025-24494Keysight Ixia Vision Product Family Path TraversalKeysight Ixia Vision Product Family
- CVE-2024-11216Broken Access Control in PozitifIK's Pik OnlinePozitifIK Pik Online
- CVE-2025-1702Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameterultimatemember Ultimate Member – User Profile, Registration…
- CVE-2024-13471DesignThemes Core Features <= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_fileDesignThemes Core Features
- CVE-2024-13232WordPress Awesome Import & Export Plugin - Import & Export WordPress Data <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Execution/Privilege Escalationddeveloper WordPress Awesome Import & Export Plugin - Impor…
- CVE-2024-13777ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object InjectionZoomIt ZoomSounds - WordPress Wave Audio Player with Playli…
- CVE-2025-0956WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object InjectionFantasticPlugins WooCommerce Recover Abandoned Cart
- CVE-2025-1919Out of bounds read in Media in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory acGoogle Chrome
- CVE-2025-1918Out of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to potentially perform out of bounds memory aGoogle Chrome
- CVE-2025-1916Use after free in Profiles in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to install a malicious extensionGoogle Chrome
- CVE-2025-1915Improper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on Windows prior to 134.0.6998.35 allowed an attackGoogle Chrome
- CVE-2025-1914Out of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to perform out of bounds memory access via a crafGoogle Chrome
- CVE-2024-0114NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administraNVIDIA Hopper HGX 8-GPU
- CVE-2024-31525Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control.
- CVE-2024-51144Cross Site Request Forgery (CSRF) vulnerability exists in the 'pvmsg.php?action=add_message', pvmsg.php?action=confirm_delete , and ajax.ser
- CVE-2024-53458Sysax Multi Server 6.99 is vulnerable to a denial of service (DoS) condition when processing specially crafted SSH packets.
- CVE-2024-57174A misconfiguration in Alphion ASEE-1443 Firmware v0.4.H.00.02.15 defines a previously unregistered domain name as the default DNS suffix.
- CVE-2025-27639Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Privilege Escalation V-2024-015.
- CVE-2025-27644Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.933 Application 20.0.2368 allows Local Privilege Escalation V-2024-0
- CVE-2025-27664Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Insufficient CSRF Protection OVE-20
- CVE-2025-27669Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Remote Network Scanning (XSPA)/DoS
- CVE-2025-27683Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Driver Unrestricted Upload of File w
- CVE-2025-27684Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Debug Bundle Contains Sensitive Data
- CVE-2025-27685Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 1.0.735 Application 20.0.1330 allows Configuration File Contains CA & Pri
Medium, low and unrated 60
- CVE-2025-27625In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attaJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-27624A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users togglJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-27623Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via RESTJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-27622Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via RESJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-27516Jinja sandbox breakout through attr filter selecting format methodpallets jinja · jinja2
- CVE-2025-27515Laravel has a File Validation Bypasslaravel framework · laravel/framework
- CVE-2024-11035Carbon Black Cloud Windows Sensor Information LeakSymantec Carbon Black Cloud Windows Sensor
- CVE-2025-20208A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote attaCisco TelePresence Management Suite
- CVE-2025-27412REDAXO allows Authenticated Reflected Cross Site Scripting - packages installationredaxo · redaxo/source
- CVE-2025-27411REDAXO allows Arbitrary File Upload in the mediapool pageredaxo · redaxo/source
- CVE-2025-23416Keysight Ixia Vision Product Family Path TraversalKeysight Ixia Vision Product Family
- CVE-2025-21095Keysight Ixia Vision Product Family Path TraversalKeysight Ixia Vision Product Family
- CVE-2025-24521Keysight Ixia Vision Product Family Improper Restriction of XML External Entity ReferenceKeysight Ixia Vision Product Family
- CVE-2025-22212Extension - tassos.gr - SQL injection in Convert Forms component version 1.0.0-1.0.0 - 4.4.9 for Joomlatassos.gr Convert Forms component for Joomla
- CVE-2025-1714Username Enumeration in GliffyPerforce Gliffy
- CVE-2024-12650Wago: Vulnerability in libwagosnmpWAGO CC100 0751-9x01 · WAGO Edge Controller 0752-8303/8… +10
- CVE-2024-11153Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.5.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposuredanieliser Content Control – The Ultimate Content Restricti…
- CVE-2024-13423Sparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivationsilkalns Sparkling
- CVE-2025-1463Spreadsheet Integration <= 3.8.2 - Cross-Site Request Forgery to Arbitrary Post Publishjavmah WPGSI: Spreadsheet Integration
- CVE-2024-11731Master Slider – Responsive Touch Slider <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcodeaverta Master Slider – Responsive Touch Slider
- CVE-2024-13747WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL InjectionCidCode WooMail - WooCommerce Email Customizer
- CVE-2024-13815Listingo - Business Listing and Directory WordPress Theme <= 3.2.7 - Unauthenticated Arbitrary Shortcode ExecutionThemographics Listingo
- CVE-2024-13810Zass - WooCommerce Theme for Handmade Artists and Artisans <= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo ImportAlThemist Zass - WooCommerce Theme for Handmade Artists and…
- CVE-2024-12815Point Maker <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingzipang Point Maker
- CVE-2024-13809Hero Slider - WordPress Slider Plugin <= 1.3.5 - Authenticated (Subscriber+) SQL Injectionheroplugins Hero Slider - WordPress Slider Plugin
- CVE-2024-13839Company Directory <= 4.3 - Reflected Cross-Site Scripting via add_query_arg Functionrichardgabriel Staff Directory Plugin: Company Directory
- CVE-2025-0954WP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings Importfuturedesigngrp WP Online Contract
- CVE-2024-13778Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injectionheroplugins Hero Mega Menu - Responsive WordPress Menu Plug…
- CVE-2024-13811Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme <= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo ImportAlThemist Lafka - Multi Store Burger - Pizza & Food Deliver…
- CVE-2024-5667Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Librarycipherdevgroup WP Featherlight – A Simple jQuery Lightbox ·…
- CVE-2024-13757Master Slider – Responsive Touch Slider <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcodeaverta Master Slider – Responsive Touch Slider
- CVE-2024-13779Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site Scriptingheroplugins Hero Mega Menu - Responsive WordPress Menu Plug…
- CVE-2024-13780Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletionheroplugins Hero Mega Menu - Responsive WordPress Menu Plug…
- CVE-2025-22493Improper cookie attributes in Foreseer Reporting Software (FRS)Eaton Foreseer Reporting Software
- CVE-2024-13866Simple Notification <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scriptingappsbd Simple Notification
- CVE-2025-1008Recently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameterworldweb Recently Purchased Products For Woo
- CVE-2024-13827Razorpay Subscription Button Elementor Plugin <= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg FunctionsRazorpay Subscription Button Elementor Plugin
- CVE-2024-13350SearchIQ – The Search Solution <= 4.7 - Authenticated (Contributor+) Stored Cross-Site ScriptingSearchIQ – The Search Solution
- CVE-2024-8682JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registrationhttps://themeforest.net/item/jnews-one-stop-solution-for-we…
- CVE-2025-0990I Am Gloria <= 1.1.4 - Cross-Site Request Forgerywebtroniclabs I Am Gloria
- CVE-2025-1435bbPress <= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalationjohnjamesjacoby bbPress
- CVE-2025-1923Inappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35 allowed an attacker who convinced a user to instaGoogle Chrome
- CVE-2025-1922Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user Google Chrome
- CVE-2025-1921Inappropriate implementation in Media Stream in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to obtain information about aGoogle Chrome
- CVE-2025-1917Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2025-1967code-projects Blood Bank Management System donor.php cross site scriptingcode-projects Blood Bank Management System
- CVE-2024-0141NVIDIA Hopper HGX for 8-GPU contains a vulnerability in the GPU vBIOS that may allow a malicious actor with tenant level GPU access to writeNVIDIA Hopper HGX 8-GPU
- CVE-2025-1966PHPGurukul Pre-School Enrollment System index.php sql injectionPHPGurukul Pre-School Enrollment System
- CVE-2025-1965projectworlds Online Hotel Booking login.php sql injectionprojectworlds Online Hotel Booking
- CVE-2025-1964projectworlds Online Hotel Booking booknow.php sql injectionprojectworlds Online Hotel Booking
- CVE-2025-20002GMOD Apollo Generation of Error Message Containing Sensitive InformationGMOD Apollo
- CVE-2025-1963projectworlds Online Hotel Booking reservation.php sql injectionprojectworlds Online Hotel Booking
- CVE-2024-48246Vehicle Management System 1.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the "Name" parameter of /vehicle-management/book
- CVE-2025-25634A vulnerability has been found in Tenda AC15 15.03.05.19 in the function GetParentControlInfo of the file /goform/GetParentControlInfo.
- CVE-2025-27637Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.1002 Application 20.0.2614 allows Cross-Site Scripting V-2024-016.
- CVE-2025-27653Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Preauthenticated Cross Site Scripti
- CVE-2025-27654Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Cross Site Scripting (XSS) V-2023-0
- CVE-2025-27660Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross Site Scripting OVE-20230524-0
- CVE-2025-27676Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Reports V-2
- CVE-2025-27679Vasion Print (formerly PrinterLogic) before Virtual Appliance Host 22.0.843 Application 20.0.1923 allows Cross-Site Scripting in Badge Regis