PT-2026-96002

Name of the Vulnerable Software and Affected Versions newbee-ltd newbee-mall versions prior to 1.0.1 Description A remote cross site scripting issue exists in the Goods Save Endpoint within the controller/common/UploadController.java file. By manipulating the goodsName argument, an attacker can...

CVE-2026-94033: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drugrecommender/Admin/adduser of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is...

CVE-2026-94045: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in newbee-ltd newbee-mall up to 1.0.0. Impacted is an unknown function of the file controller/common/UploadController.java of the component Goods Save Endpoint. Performing a manipulation of the argument goodsName results in cross site scripting. The attack may ...

CVE-2026-94034: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drugrecommender/Admin/changepassword of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site...

CVE-2026-93976: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2026-93975: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be...

CVE-2026-94016: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drugrecommender/Admin/addsymptom. Performing a manipulation of the argument txtname results in cross site scripting. Remote exploitation of the attack is possible. T...

CVE-2026-93977: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The...

Cross-site Scripting (XSS)

Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Cross-site Scripting XSS via insufficient server-side HTML escaping in the JSX rendering pipeline. Untrusted values - including array roots, boundary objects, fallback...

Cross-site Scripting (XSS)

Semantic MediaWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient output-context encoding of the user-controlled value parameter in rendered output and error messages, which allows an attacker to inject malicious content and execute scripts in a victim's brows...

Cross-site Scripting (XSS)

Semantic MediaWiki is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of user-controlled mainlabel content when headers=plain, which allows an attacker to inject executable HTML into table headers and execute malicious scripts in a victim's browser...

Cross-site Scripting (XSS)

Paella Player is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of closed-caption cue text, which allows an attacker to inject malicious script content through captions and execute it in a victim's browser...

CVE-2026-87917: Improper Neutralization of Input During Web Page Generation

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-89081: Improper Neutralization of Input During Web Page Generation

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-76790: Improper Neutralization of Input During Web Page Generation

The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting...

CVE-2026-84750: Unrestricted Upload of File with Dangerous Type

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2026-11608: Improper Neutralization of Input During Web Page Generation

The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-95755

Name of the Vulnerable Software and Affected Versions Ultra Addons for Contact Form 7 versions prior to 3.5.51 Description Unauthenticated users can upload arbitrary files because the plugin fails to validate file types or extensions in one of its form fields. Uploaded files are stored in a...

CVE-2026-15463: Improper Neutralization of Input During Web Page Generation

The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticat...

CVE-2026-93956: Improper Neutralization of Input During Web Page Generation

A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross site scripting. The attack may be launche...