8735 matches found
html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword
A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...
html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword
A flaw was found in Go's html/template component. This vulnerability allows cross-site scripting XSS due to improper escaping of the 'yield' keyword during template processing. A remote attacker could exploit this flaw by providing crafted input to an affected template, leading to arbitrary scrip...
EUVD-2026-102834
Improper validation of the reseturl parameter of the Setup in-page search in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by...
PYSEC-2026-4270 PraisonAI: SkillTools Executes Scripts Without Path Containment Validation
Summary SkillTools.runskillscript accepts a scriptpath parameter and executes it via subprocess.run without any path containment validation. While FileTools has validatepath with traversal detection, SkillTools performs none. An LLM-directed call can execute arbitrary scripts from any filesystem...
CVE-2026-63171 Omnispace Agora Project < 26.10.0 Stored XSS via Category Description
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute...
CVE-2026-67165
The software HCL Connections is vulnerable to a cross-site scripting (XSS) attack (CWE-79). An attacker may leverage this vulnerability to execute arbitrary script code within the browser of an unsuspecting user. The potential impact includes the theft of cookie-based authentication credentials ,...
EUVD-2026-98177
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input...
CVE-2026-93886
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input...
CVE-2026-93886
IBM i versions 7.3, 7.4, 7.5, and 7.6 (Product 5770-SS1) are vulnerable to an Improper Neutralization of Input During Web Page Generation (CWE-79) in the HTTP Server Administration Graphical User Interface (GUI) . A remote authenticated attacker could exploit this flaw due to improper validation ...
CVE-2026-93886 IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input...
CVE-2026-105410
A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...
CVE-2026-105408
A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...
CVE-2026-105409
A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...
EUVD-2026-97329
A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...
CVE-2026-105410 Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...
CVE-2026-105409 Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...
EUVD-2026-97328
A Stored Cross-site Scripting XSS vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session...
CVE-2026-105409
A Stored Cross-site Scripting (XSS) vulnerability exists in Tuleap Enterprise Edition versions 17.0 through 17.5 . This flaw allows an attacker to execute arbitrary script code within a user's browser session. While the CVSS 3.1 score is 8.7 (High) , indicating high impact on confidentiality and ...
CVE-2026-105408
A Stored Cross-site Scripting (XSS) vulnerability exists in Tuleap Enterprise Edition versions 17.0 through 17.5 . This flaw allows an attacker to execute arbitrary script code within a user's browser session. The vulnerability is categorized under CWE-79 (Improper Neutralization of Input During ...