1140320 matches found
html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content
A flaw was found in the html/template package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign = within a URL's content attribute inside a tag. This improper escaping could lead to Cross-Site Scripting XSS, allowing the attacker to...
python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module
A flaw was found in Python's http.cookies module. The Morsel.jsoutput function, responsible for generating JavaScript output for cookies, does not properly neutralize the HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the renderexception process. An attacker can execute arbitrary scripts in the context of a staff user's browser by injecting malicious HTML into plugin fields that are later rendered during edit mode exceptio...
EUVD-2026-41150
Wagtail: Reflected XSS in dynamic image URL generator view...
CVE-2026-73254
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...
CVE-2026-73259
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MGENABLEDIRLIST and persuade a user to visit it. The mghttpservedir and listdir path in src/http.c places the decoded request URI into the...
CVE-2026-73254
Mongoose (embedded web server and network library) prior to 7.22 is vulnerable to stored cross-site scripting via unescaped filenames in directory listings. The root cause is in printdirentry() called by listdir() in src/http.c: the function URL-encodes the href attribute but inserts the raw file...
CVE-2026-73254 Mongoose: Stored XSS via unescaped filenames in directory listing
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MGENABLEDIRLIST. The printdirentry path called by listdir in src/http.c...
Important: Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update
An update for rh-podman-desktop is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...
WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Events Made Easy versions = 3.2.5...
WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Bonds in WordPress Plugin Social Media & Share Icons versions = 2.9.9...
WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin 12 Step Meeting List versions = 3.19.16...
WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin WPComplete versions = 2.9.5.6...
WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Khuong Hai & Thanh Nam HPT Vietnam in WordPress Theme Urna versions = 2.6.2...
CVE-2026-77075
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contain an expression injection vulnerability in resource-locator field link preview rendering. The editor spliced the field's stored value directly into the node type's URL template without checking for expression syntax. An...
CVE-2026-66615
Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...
CVE-2026-66673
Unauthenticated Cross Site Scripting XSS in Flatastic = 2.0 versions...
CVE-2026-66616
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.48...