73156 matches found
EUVD-2026-71609
Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...
CVE-2022-26961
Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NPIBCF-NATUP-01/NMSCI-WebGui/backuprestore.jsp and NPIBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then ...
EUVD-2022-56034
Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NPIBCF-NATUP-01/NMSCI-WebGui/backuprestore.jsp and NPIBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then ...
CVE-2022-26961
Italtel NetMatch-S 5.0.0-20200703 is vulnerable to Multiple Stored XSS due to improper neutralization of input during web page generation. The flaw exists in the backup_restore.jsp and storage.jsp components (under respective paths) via the name parameter . A malicious user can inject arbitrary J...
PT-2026-86255
Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP IBCF-NATUP-01/NMSCI-WebGui/backup restore.jsp and NP IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will th...
PT-2026-85454
DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...
CVE-2026-85601: Improper Neutralization of Input During Web Page Generation
Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...
PT-2026-85501
Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to type mixing errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially created HTML page...
CVE-2026-85541: Improper Neutralization of Input During Web Page Generation
DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website...
EUVD-2026-71456
A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an unauthenticated attacker t...
CVE-2026-38961
Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...
FreeBSD : njs -- heap buffer overflow in XML exclusive canonicalization (0bfb082c-a7b6-11f1-a655-3497f65b111b)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0bfb082c-a7b6-11f1-a655-3497f65b111b advisory. F5 reports: A flaw in the NGINX JavaScript XML module allows an out-of-bounds write when...
CVE-2026-38961
Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...
PT-2026-85597
EMX Tecnologia Gestao X version = 8.4 contains a Stored Cross-Site Scripting XSS vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other...
Linux Distros Unpatched Vulnerability : CVE-2026-76178
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with...
Prototype Pollution
Overview org.webjars.npm:csv-parse is a parser converting CSV text input into arrays or objects. Affected versions of this package are vulnerable to Prototype Pollution in its duplicate-column handling, which assigns an array to obj'proto' when a header contains duplicate proto entries, triggerin...
EUVD-2026-42050
Phoenix: Presence keys colliding with Object.prototype members break existence checks...
