CVE-2025-8276

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Encoding or Escaping of Output, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Patika Global Technologies HumanSuite allows Cross-Site Scripting (XSS), Phishing.

This issue affects HumanSuite: before 53.21.0.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-74 CWE-79 CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Sep 16, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-82773.1A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fail CVE-2025-82799.8Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution CVE-2025-82805.8The Contact Form 7 reCAPTCHA WordPress plugin through 1.2.0 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back CVE-2025-82817.1The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refl CVE-2025-82823.5The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow CVE-2025-82833.7A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being re CVE-2025-82849.8By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow CVE-2025-82855.3Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel su CVE-2025-82869.3The affected products expose an unauthenticated Telnet-based command line interface that could allow an attacker to modify hardware configur CVE-2025-82897.5The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 vi CVE-2025-82906.4The List Subpages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and inc CVE-2025-82914.3The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used