Lucene search
+L

20853 matches found

Positive Technologies
Positive Technologies
added 2026/07/14 12:00 a.m.31 views

PT-2026-57944

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy CSP configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application...

4.1CVSS6.2AI score0.00259EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/07/14 12:00 a.m.23 views

PT-2026-57962

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end the value is passed through do shortcode, which echoes non-shortcode content verbatim, allowing users with...

6.1AI score0.00226EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/07/13 12:47 p.m.11 views

CVE-2026-55808

A flaw was found in Drupal core. This improper neutralization of input during web page generation, commonly known as Cross-site Scripting XSS, allows an attacker to inject malicious scripts into web pages. When a user views an affected page, these scripts can execute in their browser. This could...

5.4CVSS6.1AI score0.00273EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/13 7:28 a.m.61 views

CVE-2026-57829 Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7

Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated stored XSS...

8.7CVSS0.00253EPSS
SaveExploits1References1
attackerkb
attackerkb
added 2026/07/11 6:50 a.m.11 views

CVE-2026-15010

The bbp Style Pack plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.4.5 via the Topic Form Additional Fields feature. This is due to insufficient input sanitization in bsptopicfieldsformsave which writes $POST'bsptopicfieldslabeln' directly to...

6.4CVSS6.2AI score0.00331EPSS
SaveExploits0References5
attackerkb
attackerkb
added 2026/07/11 5:35 a.m.10 views

CVE-2026-6939

The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'approvalcode' parameter in all versions up to, and including, 2.7.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

7.2CVSS6.2AI score0.00562EPSS
SaveExploits0References12
EUVD
EUVD
added 2026/07/11 5:35 a.m.21 views

EUVD-2026-43154

The fresh Podcaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'freshpodcaster' shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

6.4CVSS6.2AI score0.00331EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/11 5:16 a.m.17 views

CVE-2026-15096

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Map Module 'bwidthmap' Field in all versions up to, and including, 7.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

6.4CVSS0.00331EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/11 5:16 a.m.37 views

CVE-2026-15097

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heightslider' Slider Module Field in all versions up to, and including, 7.7.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS0.00349EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/11 3:44 a.m.57 views

CVE-2026-12141 Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter

The Premium Addons for Elementor – Powerful Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'premiumtooltiptext' parameter in all versions up to, and including, 4.11.84 due to insufficient input sanitization and output escaping. This makes i...

4.9CVSS0.0029EPSS
SaveExploits0References5
CVE
CVE
added 2026/07/11 3:44 a.m.32 views

CVE-2026-15096

The CVE concerns the Themify Builder WordPress plugin. A Stored Cross-Site Scripting (XSS) flaw exists in the Map Module’s b_width_map field across all versions up to 7.7.6, caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or hig...

6.4CVSS6.2AI score0.00331EPSS
SaveExploits0References5
Snyk
Snyk
added 2026/07/11 12:27 a.m.9 views

Cross-site Scripting (XSS)

Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper input neutralization during web page generation. An attacker can execute arbitrary script...

6.1CVSS6.2AI score0.00273EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/11 12:00 a.m.38 views

PT-2026-57376

Name of the Vulnerable Software and Affected Versions Motors – Car Dealership & Classified Listings Plugin versions prior to 1.4.113 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. This occurs when arbitra...

7.2CVSS6.2AI score0.00428EPSS
SaveExploits0References12
EUVD
EUVD
added 2026/07/10 8:57 p.m.18 views

EUVD-2026-43044

Grist is spreadsheet software using Python as its formula language. Prior to 1.7.15, several server-rendered Grist pages embedded user-controlled values into the page and into inline scripts without fully escaping them, allowing cross-site scripting. On the main application page, a document's nam...

7.7CVSS5.8AI score0.00364EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/10 8:39 p.m.20 views

EUVD-2026-43030

OpenReplay is a self-hosted session replay suite. From 1.24.0 before 1.25.0, the OpenReplay tracking SDK accepts custom event names and captured page URLs from any visitor using a public project key, stores them in ClickHouse without output encoding, and later renders them in the authenticated...

9.3CVSS6.1AI score0.00499EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/10 8:16 p.m.22 views

CVE-2026-54714

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute...

6.1CVSS0.00338EPSS
SaveExploits0References4
attackerkb
attackerkb
added 2026/07/10 7:54 p.m.8 views

CVE-2026-54714

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute...

6.1CVSS6.1AI score0.00338EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added 2026/07/10 7:54 p.m.17 views

EUVD-2026-43009

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML RelayState, SAMLResponse, and actionUrl into a Logto-origin auto-submit HTML form in packages/core/src/saml-application/SamlApplication/utils.ts without HTML-attribute...

6.1CVSS6.1AI score0.00338EPSS
SaveExploits0References4
NVD
NVD
added 2026/07/10 5:17 p.m.26 views

CVE-2026-57167

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence...

5.1CVSS0.00467EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/10 4:37 p.m.22 views

EUVD-2026-42952

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, server-side-rendered video watch pages embed a schema.org JSON-LD block by JSON.stringify-ing video metadata without escaping less-than, greater-than, or slash characters, allowing a value containing the byte sequence...

5.1CVSS6.2AI score0.00467EPSS
SaveExploits0References3
Rows per page
Query Builder