CVE-2026-100522 Cotonti through 1.0.0 Reflected XSS via message.php lng parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary...

PT-2026-99148

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0 Description A reflected cross-site scripting issue exists in the 'message.php' endpoint. The lng parameter is not properly escaped before being displayed in the confirmation dialog, allowing unauthenticated attackers to...

PT-2026-99245

Name of the Vulnerable Software and Affected Versions File Manager WordPress plugin versions prior to 8.0.5 FileOrganizer WordPress plugin versions prior to 1.2.1 File Manager Pro WordPress plugin versions prior to 2.1.3 Description These plugins fail to correctly validate the origin of window...

PT-2026-99366

Name of the Vulnerable Software and Affected Versions Adminer versions prior to 6.0.2 Description An issue exists where the result of the CONNECTION ID database function is interpolated into JavaScript without proper escaping. This allows a malicious database server to execute arbitrary JavaScrip...

CVE-2026-85081: Improper Neutralization of Input During Web Page Generation

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-100522: Improper Neutralization of Input During Web Page Generation

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary...

CVE-2026-6086

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-6084

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/variants' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’, ‘name...

CVE-2026-6088 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

EUVD-2026-86622

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-6085

A Stored Cross-Site Scripting (XSS) vulnerability exists in the StockAgile API and management panel developed by Novadigits technologies. The flaw is located on the server side within the REST endpoint /inventory/configuration/serial-number-types. It allows a remote, previously authenticated atta...

CVE-2026-6083 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

EUVD-2026-86619

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

CVE-2026-6082 Stored Cross-Site Scripting in StockAgile by Novadigits technologies

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/payment-methods' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’...

CVE-2026-6087: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

PT-2026-98846

Name of the Vulnerable Software and Affected Versions AIL Framework affected versions not specified Description The tag selector component located at var/www/static/js/tags.js is susceptible to stored cross-site scripting XSS. An authenticated user with permissions to create custom tags can embed...

CVE-2026-6088: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/categories' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...

CVE-2026-6085: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint '/inventory/configuration/serial-number-types' that allow the injection and persistence of malicious JavaScript code through parameters such as...

CVE-2026-97723: Improper Neutralization of Input During Web Page Generation

madpsy ka9qubersdr before 0.1.58 has a stored cross-site scripting XSS vulnerability in the chat message rendering functionality. User-controlled URLs in chat messages were insufficiently neutralized before being converted into HTML links. Quotation characters could break out of the generated hre...

CVE-2026-6083: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS vulnerability in StockAgile API and management panel. The vulnerability is present on the server side in REST endpoint ' /inventory/configuration/pricing-tiers' that allow the injection and persistence of malicious JavaScript code through parameters such as ‘code’,...