CVE-2025-9969

HighCVSS 7.1/10Last modified Sep 30, 2026

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vizly Web Design Real Estate Packages allows Content Spoofing, CAPEC - 593 - Session Hijacking, CAPEC - 591 - Reflected XSS.

This issue affects Real Estate Packages: before 5.1.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 19, 2025
Last modified: Sep 30, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-99707.4Cleartext Storage of Sensitive Information in Memory vulnerability in ABB MConfig.This issue affects MConfig: through 1.4.9.21.CVE-2025-99719.8Certain models of Industrial Cellular Gateway developed by Planet Technology have a Missing Authentication vulnerability, allowing unauthent CVE-2025-99729.8Certain models of Industrial Cellular Gateway developed by Planet Technology have an OS Command Injection vulnerability, allowing unauthenti CVE-2025-99737.2Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authen CVE-2025-99748.0The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended CVE-2025-99756.8The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wp_scra CVE-2025-99769.0An OS Command Injection vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2022x through Relea CVE-2025-99775.3Value provided in one of POST parameters sent during the process of logging in to Times Software E-Payroll is not sanitized properly, which CVE-2025-99786.8The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cros CVE-2025-99794.3The Maspik plugin for WordPress is vulnerable to Missing Authorization in version 2.5.6 and prior. This is due to missing capability checks CVE-2025-99804.8QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form). Malicious attacker with admin privileges can inject CVE-2025-99814.8QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form). Malicious attacker with admin privileges can in