CVE-2026-112365

The easy.jobs WordPress plugin (versions up to and including 2.8.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'cover_letter' parameter. The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arbitrary web scripts. For...

CVE-2026-112365 easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter

The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'coverletter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping...

CVE-2020-10128

CVE-2020-10128 - SearchBlox product before V-9.2.1 is vulnerable to Stored-Cross Site Scripting Product Description: SearchBlox simplifies enterprise search for complex organizations. SearchBlox intuitive and intelligent tools offer out-of-the-box setup, secure encryption, and low total cost of...

CVE-2026-105456

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

external_v8_AOSP10_r33_CVE-2020-0240

V8 JavaScript Engine V8 is Google's open source JavaScript engine. V8 implements ECMAScript as specified in ECMA-262. V8 is written in C++ and is used in Google Chrome, the open source browser from Google. V8 can run standalone, or can be embedded into any C++ application. V8 Project page:...

CLEANSTART-2026-BR47308 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts

Security vulnerability affects the langfuse-worker package. Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts...

CLEANSTART-2026-RY14465 Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts

Security vulnerability affects the langfuse-worker package. Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts...

CLEANSTART-2026-MA29967 ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript

CVE-2026-69192 affects multiple packages. ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. See references for individual vulnerability details...

CLEANSTART-2026-ZC88690 Dottie provides nested object access and manipulation in JavaScript

Security vulnerability affects the sqlpad package. Dottie provides nested object access and manipulation in JavaScript...

CVE-2026-105456 Stored XSS via HTML scrubber rule in RTIR

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

EUVD-2026-114128

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

CVE-2026-105456 Stored XSS via HTML scrubber rule in RTIR

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

CVE-2026-105456

The RTIR extension for Request Tracker (RT) introduces a Stored XSS vulnerability due to a flawed HTML scrubber rule. The extension allows internal link placeholders but incorrectly permits any link containing that placeholder, including those using the javascript: scheme. This change affects the...

CVE-2026-105456 Stored XSS via HTML scrubber rule in RTIR

RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely contains the placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only to RTIR's own...

CVE-2026-119680

A stored cross-site scripting XSS vulnerability exists in the chart feature of SharePoint Manager Plus SPMP due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript into attributes used to generate charts, including users' full...

CVE-2015-20130

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

CLEANSTART-2026-UC01601 jsdiff is a JavaScript text differencing implementation

Security vulnerability affects the argo-workflows package. jsdiff is a JavaScript text differencing implementation...

CVE-2018-25031

Swagger UI Cross-Site Scripting POC: CVE-2018-25031 using Selenium in Python This repository contains a Python script that demonstrates a proof of concept POC of a Cross-Site Scripting XSS vulnerability in Swagger UI, using the Selenium library. The goal of this POC is to identify websites that a...

CVE-2015-20130 Netsweeper < 4.0.11 / 4.1.5 Reflected XSS via view_server_log.php

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

CVE-2015-20130

Netsweeper versions before 4.0.11 and 4.1.0 before 4.1.5 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the webadmin/reporter/view_server_log.php component. The root cause is the lack of proper output encoding when handling the log request parameter. Remote attackers ca...