1124489 matches found
CVE-2026-75838
DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...
CVE-2026-75107
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors throug...
CVE-2026-74902
SiYuan (note-taking app) before v3.7.4 has a file upload validation flaw: filenames are inserted into HTML via insertAdjacentHTML without escaping. A crafted filename carrying script payloads triggers XSS that escalates to full OS command access when a victim drags, drops, or pastes the file into...
CVE-2026-74902 SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...
EUVD-2026-60583
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...
CVE-2026-19447
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5...
EUVD-2026-60579
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5...
CVE-2026-19447
FileOrbis (by Fileorbis Informatics Services Trade Inc.) is vulnerable to stored XSS due to improper input neutralization during web page generation. Affects versions before 16.5; CVSS 5.4 (MEDIUM), network exploitable with low privileges. No in-the-wild exploitation reported. Upgrade to 16.5 to ...
CVE-2026-75626 SpiderFoot Stored Cross-Site Scripting via Correlation Titles
SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...
BIT-GITLAB-2026-16627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...
BIT-JUPYTERLAB-2026-73415 jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blo...
WordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Featured Video Plus versions = 2.3.3...
WordPress WPZOOM Forms – Contact Form Plugin for Gutenberg plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WPZOOM Forms – Contact Form Plugin for Gutenberg versions = 2.0.5...
WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Video Conferencing with Zoom versions = 4.6.8...
WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Wufoo Shortcode versions = 1.55...
WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Typing Effect versions = 1.3.7...
WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Tab Widget versions = 1.2.11...
WordPress GeoDirectory plugin <= 2.8.175 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin GeoDirectory versions = 2.8.175...
Apache HTTP Server <=2.4.39 - HTML Injection/Partial Cross-Site Scripting
Apache HTTP Server versions 2.4.0 through 2.4.39 are vulnerable to a limited cross-site scripting issue affecting the modproxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server...
Nagios XI 5.7.5 - Cross-Site Scripting
Nagios XI 5.7.5 contains a cross-site scripting vulnerability in the file /usr/local/nagiosxi/html/admin/sshterm.php, due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal session cookies, or it can be chained with th...