CVE-2026-73827

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

CVE-2026-73827

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

CVE-2026-73827

SOY Calendar is affected by a cross-site scripting (XSS) vulnerability that allows an arbitrary script to be executed in the web browser of a user who is logging into the product. The vulnerability requires low privileges and active user interaction , with a CVSS 3.0 base score of 5.4 (MEDIUM) an...

EUVD-2026-67576

SOY Calendar contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logging in to the product...

CVE-2026-82090

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...

CVE-2026-82090

Pocket for Android (versions through 8.33.0.0 ) is affected by a Cross-Site Scripting (XSS) vulnerability rated CVSS 4.0 9.2 (CRITICAL) . The root cause is that the "Save to Pocket" feature injects external HTML into the DOM, allowing injected JavaScript to alter the application state via native ...

EUVD-2026-67403

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM. JavaScript code can alter the application state via native bridge methods...

EUVD-2026-67355

A Cross-Site Scripting XSS vulnerability in the WatchGuard Dimension Backup Historical Data feature allows an authenticated administrator user to execute arbitrary JavaScript in another user's browser...

CVE-2026-82089

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

CVE-2026-82089

The wallabag aka fr.gaulupeau.apps.InThePoche application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable due to XSS vulnerability EBICS server (CVE-2025-14504)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed XSS vulnerability Vulnerability Details CVEID:CVE-2025-14504 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, 6.2.0.0 through 6.2.0.51, 6.2.1.0 through 6.2.1.11, and...

Security Bulletin: IBM Sterling B2B Integrator and IBM Sterling File Gateway are Vulnerable to XSS security vulnerability in the dashboard UI (CVE-2023-40693)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the XSS security vulnerability Vulnerability Details CVEID:CVE-2023-40693 DESCRIPTION: IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.1.0.0 through 6.1.2.72, and 6.2.0.0 through 6.2.0.51, 6.2.1.0 through...

CVE-2026-78195

Rejected reason: Rejecting as a duplicate of CVE-2026-78047...

towaos-lab-cve-2020-11023

CVE-2020-11023 - Vulnerabilidade XSS no jQuery Payloads de ataque root@kitploit: alert1 root@kitploit: Medidas de mitigação ⚠️ Importante : o uso de .html não é totalmente evitado apenas com jQuery 1. Usar o método .text ⭐️Recomendado root@kitploit: // Seguro: não é interpretado como HTML...

Security Bulletin: Security Vulnerability in WebSphere Application Server Liberty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-12635)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed vulnerability due to WebSphere Application Server Liberty. Vulnerability Details CVEID:CVE-2025-12635 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 throu...

CVE-2026-37710

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

EUVD-2026-67774

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

CVE-2026-76798: Improper Neutralization of Input During Web Page Generation

The MongoSQL Transition Readiness Tool writes query text and user names read from BI Connector log files into its generated HTML report without encoding them for that output context. A user able to issue queries through the BI Connector can influence log content so that markup supplied in a query...

CVE-2026-40541: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM...

CVE-2026-6286: Improper Neutralization of Input During Web Page Generation

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification...