1045689 matches found
EUVD-2026-62496
Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory 6.2.3 - companyName from the request was written unescaped into an XML attribute...
CVE-2026-75955
J-BusinessDirectory is a Joomla extension developed by cmsjunkie.com. Versions prior to 6.2.3 are affected by a reflected XSS / XML injection vulnerability. The root cause is that the companyName parameter from a user request is written unescaped into an XML attribute , allowing an attacker to in...
CVE-2026-75955 Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3
Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory 6.2.3 - companyName from the request was written unescaped into an XML attribute...
CVE-2026-76203
Pentestify (a penetration testing report tool by maalfer) versions 1.2.0 through 2.3.2 contain a CSS sanitizer bypass in the report theme feature. The root cause is an Incorrect Behavior Order: Validate Before Canonicalize flaw — the sanitizer checks CSS input before resolving hex escape sequence...
CVE-2026-75920
phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...
CVE-2026-75917
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...
CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...
EUVD-2026-62415
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...
CVE-2026-18526
HumHub CE 1.18.4 and 1.18.4-pl1 have a stored XSS flaw in the oEmbed confirmation rendering workflow; the fix is tracked in GitHub PR #8373 (https://github.com/humhub/humhub/pull/8373). No exploitation evidence is provided in the documents.
CVE-2026-74804
creationtimestamp| type| source ---|---|--- 2026-08-19 14:04:01+00:00| seen| https://bsky.app/profile/yootheme.bsky.social/post/3mtgvj2kahc2s 2026-08-19 14:04:02+00:00| seen| https://bsky.app/profile/yootheme.bsky.social/post/3mtgvj2lbns2s 2026-08-19 16:08:24+00:00| seen|...
CVE-2026-75920
phpMyFAQ versions before 4.1.6 create a temporary content.zip backup in the web-accessible document root. Unauthenticated attackers can race concurrent requests to download it before deletion, or chain an admin-context XSS to trigger authenticated backups and retrieve the archive, exposing sensit...
EUVD-2026-62445
phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...
CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP
phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...
CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP
phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...
CVE-2026-75916 SiYuan XSS-to-RCE via unescaped block metadata in hint popup
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...
CVE-2026-75916 SiYuan XSS-to-RCE via unescaped block metadata in hint popup
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...
CVE-2026-73354
Unauthenticated Cross Site Scripting XSS in SimplyRETS Real Estate IDX = 3.2.8 versions...
CVE-2026-73182
Unauthenticated Cross Site Scripting XSS in BBQ Pro = 3.9 versions...