MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting

paintballrefjosh/MaNGOSWebV4 4.0.8 contains a reflected XSS caused by unsanitized input in install/index.php step parameter, letting attackers execute arbitrary scripts in the victim's browser, exploit requires victim to visit a maliciously crafted URL id: CVE-2017-6478 info: name: MaNGOSWebV4...

Palo Alto Networks PAN-OS Web Interface - Cross Site-Scripting

PAN-OS management web interface is vulnerable to reflected cross-site scripting. A remote attacker able to convince an administrator with an active authenticated session on the firewall management interface to click on a crafted link to that management web interface could potentially execute...

Zarinpal Paid Download - Reflected XSS

Zarinpal Paid Download WordPress plugin v2.3 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users such as admin, exploit requires...

EUVD-2026-54447

Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting XSS vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the...

CVE-2026-8183

Langflow OSS is affected (versions 1.0.0–1.10.3) by a vulnerability described as remote directory traversal via crafted URLs containing dot-dot sequences ( /.. / ), enabling access to arbitrary files on the system. The Connected CVE entry corroborates the affected versions and the traversal vecto...

CVE-2026-20198

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An...

EUVD-2026-53448

A vulnerability in the web-based management interface of Cisco Integrated Management Controller IMC could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An...

CVE-2026-9195

A cross-site scripting vulnerability in the Query Console of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows a remote attacker who lures an authenticated administrator to a crafted URL to execute arbitrary JavaScript in the administrator's browser session, capture credentials, and perfo...

CVE-2026-9195

Progress MarkLogic Server Query Console is affected by a cross-site scripting (XSS) vulnerability in versions before 11.3.6 and 12.0.3. The issue allows a remote attacker to lure an authenticated administrator to a crafted URL, enabling arbitrary JavaScript execution in the administrator’s browse...

CVE-2026-48911

CVE-2026-48911 describes an Insufficient Verification of Data Authenticity in Apache Answer (affected up to 2.0.1). The vulnerability arises from a missing authorization check in the external-login email binding flow, enabling unauthenticated attackers to take over arbitrary user accounts by guid...

EUVD-2026-53107

The GDPR Cookie Compliance WordPress plugin before 5.1.0 expires the visitor's cookies from an action that is reachable without authentication and performs no request-origin check, allowing an attacker to log any user out and delete the site's cookies by luring them to a crafted link...

CVE-2026-52370

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

EUVD-2026-52809

NVIDIA Dynamo for Linux contains a vulnerability where an attacker may cause server-side request forgery by supplying a crafted URL in a multimodal request. A successful exploit of this vulnerability might lead to information disclosure...

CVE-2026-15928

A flaw was found in the XMLRPC-C Library. This reflected cross-site scripting XSS vulnerability exists in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious...

K000162711: Vim vulnerability CVE-2026-28417

Security Advisory Description Vim is an open source, command line text editor. Prior to version 9.2.0073, an OS command injection vulnerability exists in the netrw standard plugin bundled with Vim. By inducing a user to open a crafted URL e.g., using the scp:// protocol handler, an attacker can...

EUVD-2026-51527

A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...

SUSE CVE-2026-52800

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be add...

CVE-2026-55730

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

CVE-2026-55730

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

CVE-2026-55730

CVE-2026-55730 summary: Loytec LWEB802 is affected by a reflected Cross-Site Scripting (CWE-79) in the LWEB802 component. The vulnerability exists in all platforms and affects versions prior to 5.0.8. An unauthenticated remote attacker can craft a link containing a malicious project or mspParams ...