1148651 matches found
CVE-2026-16627 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal...
Cross-site Scripting (XSS)
Overview mkdocs-material is a security holding package Affected versions of this package are vulnerable to Cross-site Scripting XSS via the mountSearchSuggest function. An attacker can execute arbitrary JavaScript in the context of the documentation site's origin by crafting a malicious q URL...
Cross-site Scripting (XSS)
Overview mkdocs-material is a Documentation that simply works Affected versions of this package are vulnerable to Cross-site Scripting XSS via the mountSearchSuggest function. An attacker can execute arbitrary JavaScript in the context of the documentation site's origin by crafting a malicious q...
DEBIAN-CVE-2026-48552
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browse...
CVE-2026-16694 IBM i is Affected By Stored Cross-site Scripting for i
IBM i 7.6, 7.5, 7.4, and 7.3 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2026-73237 Apache Allura: XSS in markdown pipeline
XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...
CVE-2026-73237
XSS vulnerability in Markdown handling in Apache Allura. This issue affects Apache Allura: from 1.10.0 before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...
CVE-2026-73237
An XSS vulnerability exists in the Markdown handling pipeline of Apache Allura . This flaw affects versions from 1.10.0 before 1.19.1 . The vulnerability allows for the improper neutralization of script-related HTML tags in a web page. To remediate this issue, users are recommended to upgrade to ...
EUVD-2026-57343
XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...
CVE-2026-73238
A Cross-Site Scripting (XSS) vulnerability exists in the code display feature of Apache Allura . This flaw affects versions before 1.19.1 . The vulnerability allows for the improper neutralization of script-related HTML tags, potentially leading to script execution in the user's browser. To remed...
CVE-2026-73238 Apache Allura: XSS in code display
XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...
CVE-2026-73238 Apache Allura: XSS in code display
XSS vulnerability in code display in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...
CVE-2026-48552 Nagios Core / XI DOM-based XSS via jsonquery.js
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browse...
CVE-2026-48552
Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 are vulnerable to DOM-based cross-site scripting in jsonquery.js. Unencoded JSON string values reflected from stored fields are inserted into the DOM without sanitization, allowing attackers to run arbitrary JavaScript in the victim's browse...
CVE-2026-48552
Affected software : Nagios Core prior to 4.5.14 and Nagios XI prior to 2026R1.7. Component : jsonquery.js. Root cause : unencoded JSON string values reflected from stored fields are injected into the DOM without sanitization. Impact : DOM-based cross-site scripting allowing arbitrary JavaScript e...
Cross-site Scripting (XSS)
Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the document.title assignment in JavaScript, where user-supplied GET parameters are...
Cross-site Scripting (XSS)
Overview prowler is a Prowler is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI,...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the renderCss process. An attacker can inject malicious scripts by providing crafted custom styles through the editor settings interface, which are then rendered on backend pages. This is only exploitable if...
WordPress M.Anh theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme M.Anh versions = 1.7...