PT-2026-90989

A Cross-Site Scripting XSS vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field...

CVE-2026-90569: Improper Neutralization of Input During Web Page Generation

A flaw has been found in linlinjava litemall 1.5.0/1.6.0/1.7.0/1.8.0. This vulnerability affects the function AdminTopicController.validate of the file litemall-vue/src/views/items/topic/index.vue of the component Admin Topic Handler. This manipulation causes cross site scripting. The attack may ...

PT-2026-90875

A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file litemall-vue/src/views/items/detail/index.vue of the component Product Detail. Such manipulation of the argument detail leads to cross site...

PT-2026-90789

Name of the Vulnerable Software and Affected Versions Fengoffice Feng Office versions prior to 3.11.13.12 Description A remote cross site scripting issue exists in the Task Title Output component. The problem occurs within the getTitle function located in the application/views/task/add task.php...

PT-2026-90876

Name of the Vulnerable Software and Affected Versions Exrick xmall versions up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c Description An issue exists in the Order Printing component within the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp. A manipulation of an unknown functi...

CVE-2026-90563: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely...

PT-2026-90988

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

CVE-2026-90583: Improper Neutralization of Input During Web Page Generation

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

CVE-2026-90528: Improper Neutralization of Input During Web Page Generation

A flaw has been found in TDuckApp tduck-platform up to 5.3. Affected by this vulnerability is an unknown functionality of the file tduck-front/src/views/form/write/index.vue of the component Form Write View. This manipulation of the argument submitShowCustomPageContent causes cross site scripting...

CVE-2026-90567: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The...

CVE-2026-90571: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote...

CVE-2026-90570: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in linlinjava litemall 1.4.0/1.5.0/1.6.0/1.7.0/1.8.0. This issue affects the function AdminGoodsService.validate of the file litemall-vue/src/views/items/detail/index.vue of the component Product Detail. Such manipulation of the argument detail leads to cross site...

CVE-2026-90497: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the file application/views/task/addtask.php of the component Task Title Output. Executing a manipulation of the argument ogobjects.name can lead to cross site...

PT-2026-90806

Name of the Vulnerable Software and Affected Versions stilleshan ServerStatus versions 1.0 through 2.0 Description A cross site scripting issue exists within the Stats Generation component in the file server/src/main.cpp. A remote attacker can trigger this by manipulating the custom argument. Cro...

PT-2026-90874

Name of the Vulnerable Software and Affected Versions linlinjava litemall versions 1.5.0 through 1.8.0 Description A flaw in the Admin Topic Handler component allows for remote cross site scripting XSS, a technique where malicious scripts are injected into trusted websites. The issue resides with...

PT-2026-90872

A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The...

CVE-2026-90564: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in quequnlong shiyi-blog 1.0.0-1.2.1. This impacts the function SysChatMsgMapper.getChatMsgList of the file blog-web/src/views/chat/index.vue of the component chat sendMsg Endpoint. Such manipulation of the argument chatmsg leads to cross site scripting. The attack...

PT-2026-90967

Name of the Vulnerable Software and Affected Versions kagisearch smallweb versions up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf Description A remote cross site scripting issue exists in the Query String Rendering component within the index function of the app/sw.py file. The flaw is triggered b...

PT-2026-90865

A vulnerability was detected in quequnlong shiyi-blog up to 1.2.1. Affected is an unknown function of the file blog-admin/src/views/message/message/index.vue of the component Add Message API. The manipulation of the argument body.content results in cross site scripting. The attack can be executed...

CVE-2026-90502: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the component Stats Generation. Performing a manipulation of the argument custom results in cross site scripting. It is possible to initiate the attack remotely. The...