EUVD-2015-9439

Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/reporter/viewserverlog.php that allows remote attackers to execute arbitrary JavaScript by injecting malicious code through the log request parameter, which is reflected into the HT...

CVE-2026-119680

A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) . The root cause is the improper sanitization and HTML encoding of user-controlled data, allowing an attacker to inject malicious HTML or JavaScript into attributes like users' full nam...

CVE-2025-55579

CVE-2025-55579 - SolidInvoice Stored Cross-Site Scripting XSS in Tax Rates Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Tax Rates Feature. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users'...

CVE-2025-28073

CVE-2025-28073 Suggested description phpList 3.6.3 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized. Vulnerability Type Cross Site Scripting XSS Vend...

MAL-012

MAL-012: Reflected Cross-Site Scripting in Admin Console leading to Remote Code Execution in Payara Server A reflected Cross Site Scripting XSS attack was found in the Payara Admin Console. By convincing an admin user to access the malicious URL and click the “Choose File” button, an attacker can...

CVE-2025-50866

CloudClassroom-PHP-Project 1.0 contains a reflected Cross-site Scripting XSS vulnerability in the email parameter of the postquerypublic endpoint. Improper sanitization allows an attacker to inject arbitrary JavaScript code that executes in the context of the user s browser, potentially leading t...

Injection-vulnerability-in-Paradox-Security-Systems-IPR512-CVE-2023-24709-PoC

Injection vulnerability in Paradox Security Systems IPR512 - CVE-2023-24709 PoC In Paradox Security System IPR512 Web console login form page, attacker can input JavaScript string, such as that will overwrite configurations in the file "login.xml" and cause the login form to crash and make it...

Follina-CVE-2022-30190-Sample

Follina-CVE-2022-30190-Sample-by-ethical-blue Educational Follina Tool Version history v1.1 — JavaScript payload obfuscation v1.0 — Initial release Features .RTF payload generator Simple HTTP Server for payload Mitigation tips Configuration extractor Easy to use for learning Exploit Executed...

CVE-2025-46041

Anchor CMS v0.12.7 - Stored XSS CVE-2025-46041 Anchor CMS v0.12.7 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability in the description field of the /admin/pages/add interface. CVE ID CVE-2025-46041 Summary Type: Stored XSS Location: Page creation interface /admin/pages/add Impact:...

CVE-2026-119408

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden...

CVE-2025-68391

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to...

CVE-2025-51411

🛡️ CVE Disclosure: CVE-2025-51411 — Reflected XSS in Institute-of-Current-Students Disclosure Date: 25 July 2025 CVE ID: CVE-2025-51411 Severity: MEDIUM CVSS 6.1 🧩 Summary A reflected Cross-Site Scripting XSS vulnerability exists in the Institute-of-Current-Students v1.0 project, specifically...

EUVD-2025-211223

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to...

CVE-2025-68391

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to an arbitrary file upload vulnerability. This flaw allows any user to upload files and override existing files within a temporary folder. The primary impact is the potential execution of embedded JavaScript scripts when an authentic...

CVE-2025-68391 Arbitrary File Upload in Protectel

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to...

CVE-2025-68391 Arbitrary File Upload in Protectel

ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated user tries to...

CVE-2026-119408 n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden...

CVE-2026-119408 n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes

n8n before 2.42.6, 2.43.x before 2.43.3, and 3.x before 3.0.1 contains a remote code execution vulnerability via deprecated Function, Function Item, and LangChain Code nodes running outside task runner isolation. Authenticated users who can create, modify, or import workflows naming these hidden...

CVE-2026-119408

The n8n workflow automation tool is vulnerable to remote code execution in versions before 2.42.6, 2.43.3, and 3.0.1. The vulnerability exists within deprecated Function , Function Item , and LangChain Code nodes. When these nodes run outside of task runner isolation, authenticated users with per...

CVE-2026-85268

A Cross-Site Scripting XSS CWE-79 vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID...