1126608 matches found
EUVD-2026-52750
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...
CVE-2026-15920
Django 5.2 before 5.2.17 and 6.0 before 6.0.8 are affected by a cross-site scripting issue in django.contrib.admin.utils.display_for_field() that renders URLField values as clickable links without validating the URL. If an unsafe URL is already stored (e.g., via direct queryset writes, deserializ...
CVE-2026-10032
The CVE-2026-10032 issue involves the openUrl function in @a2ui/web_core, which passes an agent-controlled URL directly to window.open() without URI scheme validation. A malicious actor can supply a javascript: URI as the url argument for a Button component’s functionCall action, allowing arbitra...
CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
CVE-2026-67196
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...
CVE-2026-14337
Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...
EUVD-2026-52693
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...
CVE-2026-67196 Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...
CVE-2026-67196 Perspective 5.0.0 XSS via Debug Plugin innerHTML Interpolation
Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into innerHTML during CSV serialization...
CVE-2026-67196
Vulnerability : In Perspective 5.0.0, the built-in Debug plugin is vulnerable to cross-site scripting via innerHTML interpolation during CSV serialization. Trigger : attackers craft table rows whose cells contain unescaped HTML markup, including unquoted event-handler attributes, which are not es...
EUVD-2026-52686
Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...
WordPress Thrive Architect plugin <= 10.9.3.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Thrive Architect versions = 10.9.3.1...
WordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Advanced AJAX Product Filters versions = 3.2.0.3...
WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Media LIbrary Assistant versions = 3.38...
WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Mukhlis Amien in WordPress Plugin Events Manager versions = 7.4.2...
WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Ninja Tables versions = 5.2.9...
CVE-2026-14192
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
Security Bulletin:IP-Address Library Vulnerability: XSS Risk with Untrusted Input Rendering and HTML Escaping Issues
Summary ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1, Address6.group and Address6.link do not HTML-escape attacker-controlled content before embedding it in the HTML strings they return, and AddressError.parseMessage emitted by the...
CVE-2026-14192 Stored XSS in Bilin Software's HUMANIST Digital Human Resources
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...
CVE-2026-14192
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...