8665 matches found
EUVD-2026-62237
A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script...
CVE-2026-66358
A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script...
CVE-2026-66358: Improper Neutralization of Input During Web Page Generation
A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script...
PT-2026-78268
Name of the Vulnerable Software and Affected Versions acmailer affected versions not specified Description A cross-site scripting XSS issue exists, which may allow an attacker to execute an arbitrary script. Cross-site scripting is a type of security flaw where malicious scripts are injected into...
CVE-2026-72529: Missing Authentication for Critical Function
A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could execute an arbitrary script by calling an undocumented function...
EUVD-2026-60570
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-2357 Bold Page Builder <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'btbbshortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2026-16775
The affected software is the Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin. Affected versions: all versions up to and including 4.9.0. Vulnerability type: Stored Cross-Site Scripting via the 'id' Shortcode Attribute, caused by insufficient input sanitization and output...
PT-2026-73080
Name of the Vulnerable Software and Affected Versions Quiz and Survey Master QSM – Easy Quiz and Survey Maker versions prior to 11.2.2 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access a...
CVE-2026-15948
The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-17209
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...
CVE-2026-17209 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...
CVE-2026-17209 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...
CVE-2026-17209
IBM Db2 Mirror for i 7.4–7.6 is affected by CVE-2026-17209: the GUI could be exploited by a remote authenticated attacker to execute arbitrary scripts via cross-site scripting. This aligns with the IBM bulletin listing multiple vulnerabilities in Db2 Mirror for i; the CVSS base score is 6.3 (Medi...
CVE-2026-17209
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...
CVE-2026-19794
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...
EUVD-2026-58607
The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...
PT-2026-72104
Name of the Vulnerable Software and Affected Versions IBM Db2 Mirror for i versions 7.4 through 7.6 Description Remote authenticated attackers can execute arbitrary scripts due to cross-site scripting, a flaw where malicious scripts are injected into trusted websites. Recommendations At the momen...
CVE-2026-17209: Improper Neutralization of Input During Web Page Generation
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting...