16379 matches found
SUSE CVE-2026-34033
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. User-supplied content was included in notification emails without proper escaping, allowing authenticated users to inject arbitrary HTML int...
PT-2026-86326
🚨 CVE-2026-19861 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value before including it in the HTML notification emails it sends, allowing unauthenticated users to inject arbitrary HTML into messages delivere...
CVE-2026-52772 YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw'html' to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6...
CVE-2026-53758 Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized
Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization,...
CVE-2026-19727
CVE-2026-19727 is an XSS (targeting HTML attributes) vulnerability in the Yordam Information Technology Consulting Library Information and Document Automation Program , caused by improper neutralization of input during web page generation. The issue affects versions before v22.2 and is rated CVSS...
CVE-2026-19727 HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...
CVE-2026-19727 HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...
CVE-2026-77818 Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...
CVE-2026-77818
CVE-2026-77818 is a reflected HTML injection vulnerability in Yordam Informatics' Library Information and Document Automation Program (affects versions from v22.1 before v22.2 ), exploitable via form hijacking during web page generation. The vulnerability allows content spoofing and is rated CVSS...
CVE-2026-77818 Reflected HTML Injection via Form Hijacking in Yordam Informatics's Library Automation System
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows Content Spoofing. This issue affects...
CVE-2026-85599
Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the lorem tag parameter and details summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browser...
cve-disclosures
CVE Disclosures — Aman Bahiniya Three CVEs assigned by MITRE...
CVE-2026-80180
Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
CVE-2026-80180 Apache Allura: Stored XSS via markdown HTML processing
Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
EUVD-2026-70921
Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
CVE-2026-80180 Apache Allura: Stored XSS via markdown HTML processing
Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...
CVE-2026-80180
The Apache Allura software is vulnerable to Stored XSS due to improper markdown HTML processing . This issue affects versions from the initial release through 1.20.0 . Impacted users are recommended to upgrade to version 1.21.0 , which provides a fix for this vulnerability. No specific exploit de...
CVE-2026-81807
The Simple Ajax Chat WordPress plugin, in versions prior to 20260827 , is vulnerable to an unauthenticated stored XSS vulnerability. The root cause is the failure to escape chat message content before rendering it, specifically during chat message linkification . This allows unauthenticated attac...
Oracle Linux 9 : ELSA-2026-61316-0: / xmlrpc-c (ELSA-2026-613160)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-613160 advisory. 1.51.0-17 - Fix HTML injection in Abyss error responses and directory listings - Resolves: CVE-2026-15928 Tenable has extracted the preceding description bloc...
