VulnCheck KEV: CVE-2026-39447

Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.10.6 versions...

PT-2026-113304

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-106632: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-113311

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

CVE-2026-104587

The blob42 gosuki application (through commit 6e2bf34 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the use of text/template instead of html/template, which leads to a failure in performing context-aware auto-escaping on the URL and DisplayURL fields with...

CVE-2024-34321

ProPhoenix Law RMS version v2022.2403.3.101 is affected by a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the Notes.aspx endpoint, specifically triggered via the PageTitle/Notes parameter. This type of vulnerability typically allows an attacker to execute malicious scrip...

VulnCheck KEV: CVE-2024-13377

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘alt’ parameter in all versions up to, and including, 2.9.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2024-34321

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting XSS vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint...

CVE-2024-34326

The ProPhoenix Law RMS v2022.2403.3.101 software contains a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the errorHandler.aspx endpoint, specifically triggered via the PageTitle , Alert , or MsgType parameters. Exploitation details and specific remediation instructions a...

Ubuntu 24.04 LTS / 26.04 LTS : WebKitGTK vulnerabilities (USN-8703-1)

The remote Ubuntu 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8703-1 advisory. Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website,...

PT-2026-113308

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-113300

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-113313

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE

Overview Shopware 6.7 contains a stored cross-site scripting XSS vulnerability in its media upload functionality that can lead to administrator credential compromise and remote code execution. Description Shopware is an open-source e-commerce platform used to build and manage online stores. It...

PT-2026-111802

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field,...

PT-2026-111818

Name of the Vulnerable Software and Affected Versions Shopware version 6.7 Description Shopware allows the upload of attacker-controlled HTML files which are served as text/html without effective security headers, such as Content-Security-Policy or X-Content-Type-Options: nosniff. This leads to...

CVE-2026-104252: Improper Neutralization of Input During Web Page Generation

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to 23.0.5 and 24.0.2, twopczHandler in go/vt/vttablet/tabletserver/twopcz.go writes the Action and dtid form values from the vttablet and vtcombo /twopcz HTTP debug endpoint into a text/html response without HTML...

PT-2026-113297

Name of the Vulnerable Software and Affected Versions Vitess versions prior to 23.0.5 Vitess versions prior to 24.0.2 Description The twopczHandler function in go/vt/vttablet/tabletserver/twopcz.go fails to perform HTML escaping when writing Action and dtid form values from the /twopcz HTTP debug...

CVE-2026-110076: Improper Neutralization of Input During Web Page Generation

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

PT-2026-113309

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...