1148568 matches found
EUVD-2026-63131
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "power" Splunk role could create a malicious Splunk Web tour and cause arbitrary JavaScript to run in the browser of another user when that user opens a crafted tour link. The JavaScript runs in the brows...
EUVD-2026-63133
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could store a dashboard view that runs JavaScript in the browser of another user who opens it and hovers over a sparkline table cell, allowing for access to all...
CVE-2026-66611: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...
CVE-2026-77643: Improper Neutralization of Input During Web Page Generation
A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...
PT-2026-78977
Name of the Vulnerable Software and Affected Versions Flatastic versions 2.0 and earlier Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...
Cross-site Scripting (XSS)
Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS when sending vi...
Cross-site Scripting (XSS)
Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...
Cross-site Scripting (XSS)
Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the...
CVE-2026-66605: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...
PT-2026-78970
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
PT-2026-78983
Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...
PT-2026-79078
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG ENABLE DIRLIST. The printdirentry path called by listdir in src/http.c...
CVE-2026-73402: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...
CVE-2026-66673: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Flatastic = 2.0 versions...
CVE-2026-66615: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...
CVE-2026-66614: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...
CVE-2026-66612: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
CVE-2026-66606: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...