PT-2026-77337

Name of the Vulnerable Software and Affected Versions Koha versions prior to 26.05.02 Koha versions prior to 25.11.07 Koha versions prior to 25.05.13 Description A stored cross-site scripting issue exists in the purchase suggestion handler. Authenticated staff users can inject malicious scripts b...

CVE-2026-75078 SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-75078

SourceCodester Class and Exam Timetabling System 1.0 is vulnerable to reflected/stored XSS via the "course" argument in /BSHRM1.php, which is echoed without sanitization. CVSS 4.3 (Medium) reflects low integrity impact requiring user interaction. No patch version is specified in any source; the e...

CVE-2026-75531

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

CVE-2026-75529

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

CVE-2026-75077 SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly...

CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

CVE-2026-75531 Stored Cross-Site Scripting in URL Observables via Lookyloo Submission Handler in Pandora

Pandora contains a stored cross-site scripting XSS vulnerability in the rendering of URL observables. A URL extracted from or associated with an analyzed file was inserted directly into the inline JavaScript onclick handler used by the Submit to Lookyloo action. Although the value was subject to...

CVE-2026-75531

Pandora's URL observable rendering embeds attacker-controlled URLs inside an inline JavaScript onclick handler despite HTML escaping, allowing script breakout and execution in a victim's authenticated session. The fix removes the value from the inline handler, stores it in a data-url attribute, a...

CVE-2026-75529 Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

CVE-2026-75529 Stored Cross-Site Scripting via MIME-Type Confusion in PDF Downloads of Pandora

Pandora is affected by a stored cross-site scripting vulnerability in the PDF download functionality. The /task-download//.../pdf endpoint verifies that the submitted file is a PDF using Pandora's content-based file-type detection, but previously returned the file using sendfiletask.file.path...

CVE-2026-75529

Pandora's /task-download//.../pdf endpoint used send_file() without a fixed MIME type, letting attacker-crafted polyglot files be served inline as HTML, enabling stored XSS against victims with access to the analysis. Patched commit sets Content-Type: application/pdf, forces Content-Disposition: ...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-63670

ApostropheCMS (open-source Node.js CMS) is vulnerable to a mutation XSS in sanitizeHtml() (packages/sanitize-html/index.js) prior to version 2.17.6 . When textarea or xmp is included in allowedTags, a literal solidus after the raw-text end-tag name (e.g., ) is treated as text by htmlparser2 , and...

CVE-2026-63670 ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

ApostropheCMS is an open-source Node.js content management system. Prior to 2.17.6, sanitizeHtml can pass disallowed executable markup through packages/sanitize-html/index.js when textarea or xmp is included in allowedTags because a literal solidus after the raw-text end-tag name is treated as te...

CVE-2026-33437

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...

CVE-2026-33437

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...

CVE-2026-33437 Stirling PDF: Stored XSS in Info Summary

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html inserts untrusted PDF Title and Author metadata into the summary-text element with...