Reflected-XSS-on-Opentext-Portal-v7.4.4

OpenText Portal v7.4.4 中的跨站脚本（XSS）漏洞允许远程攻击者通过 vgnextoid URI 参数注入任意 web 脚本或 HTML 代码。 攻击向量：在 vgnextoid 参数中，以 "--"（HTML 注释结束序列）前缀的 JavaScript 注入 结果： 由 Héctor Sainz 发现...

CVE-2026-89239 WWBN AVideo Reflected XSS via Referer Header Comment Breakout

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing / to close t...

CVE-2026-89239

WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1 ) contains a reflected XSS in the showAlertMessage() function. The function inserts the raw Referer header into a JavaScript comment without encoding, allowing an attacker to supply a Referer value containing */ to break out of ...