1148519 matches found
CVE-2026-78187
A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...
CVE-2026-78187 Piwigo Public Authentication cross site scripting
A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...
CVE-2026-78187 Piwigo Public Authentication cross site scripting
A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...
EUVD-2026-64723
A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...
CVE-2026-78187
CVE-2026-78187 is a reflected cross-site scripting (XSS) vulnerability in Piwigo 16.3.0 , affecting the Public Authentication Page component. Manipulation of the lang argument allows a remote, unauthenticated attacker to inject script that executes in a victim's browser upon user interaction. The...
CVE-2026-78187 Piwigo Public Authentication cross site scripting
A vulnerability has been found in Piwigo 16.3.0. This impacts an unknown function of the component Public Authentication Page. Such manipulation of the argument lang leads to cross site scripting. The attack may be performed from remote. A high complexity level is associated with this attack. The...
EUVD-2026-64707
NewSiteServer NSS developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting...
CVE-2026-19852
NewSiteServer (NSS) developed by CyberTutor is affected by an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, achieving effects similar to cross-site scripting (XSS) . The CVSS 3.1 base score is 6.1 (MEDIUM) , with ...
Exploit for CVE-2025-37654
Patch: CVE-2025-37654 Vulnerability Details - CVE: CVE...
Johnson Controls Metasys 12.x / 13.x / 14.x < 14.1.5 / 15.x < 15.0.1 Cross-Site Scripting (CVE-2026-34491)
A low-privilege user can inject a malicious XSS payload into the Johnson Controls Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators. Successful exploitation of this vulnerability could allow a low-privileg...
PT-2026-80806
Unauthenticated Cross Site Scripting XSS in WPComplete = 2.9.5.6 versions...
PT-2026-81062
Unauthenticated Cross Site Scripting XSS in Stripe Payments = 2.1.2 versions...
CVE-2026-78414: Improper Neutralization of Input During Web Page Generation
Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...
CVE-2026-78264: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Toolset Blocks = 1.6.26 versions...
CVE-2026-78282: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Stripe Payments = 2.1.2 versions...
CVE-2026-32556: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...
CVE-2026-34491: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...
CVE-2026-78290: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...