1143590 matches found
CVE-2026-75916
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...
CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...
CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...
CVE-2026-18526
HumHub CE 1.18.4 and 1.18.4-pl1 have a stored XSS flaw in the oEmbed confirmation rendering workflow; the fix is tracked in GitHub PR #8373 (https://github.com/humhub/humhub/pull/8373). No exploitation evidence is provided in the documents.
CVE-2026-18526 HumHub 1.18.4 / 1.18.4-pl1 – Stored Cross-Site Scripting in oEmbed confirmation
HumHub Community Edition 1.18.4 and 1.18.4-pl1 contain a stored Cross-Site Scripting XSS vulnerability in the oEmbed confirmation rendering workflow...
EUVD-2026-62412
Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...
CVE-2026-54793
Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...
CVE-2026-54793
Dell OpenManage Enterprise versions prior to 4.7.0 contain a Cross-site Scripting (XSS) vulnerability caused by improper neutralization of input during web page generation. A low-privileged remote attacker could exploit this with user interaction to achieve information exposure . The CVSS v3.1 sc...
EUVD-2026-62442
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...
CVE-2026-75917 SiYuan before v3.7.4 XSS-to-RCE via pathName.ts
SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...
CVE-2026-75917
SiYuan before v3.7.4 contains an XSS-to-RCE vulnerability in the file-tree picker's hover-tooltip generation (app/src/util/pathName.ts, getLeaf()/movePathTo()). Document metadata fields (bookmark, alias, memo, alternate name) are concatenated into the aria-label HTML attribute without escaping, a...
CVE-2026-75916
In SiYuan through 3.7.3, genHintItemHTML() in app/src/protyle/hint/extend.ts concatenates block name, alias, and memo fields into HTML without escaping, enabling XSS via '((' autocomplete popups. Combined with nodeIntegration enabled, contextIsolation disabled, and no CSP, this escalates to arbit...
EUVD-2026-62441
SiYuan through 3.7.3 contains a cross-site scripting vulnerability in the '' block-reference autocomplete hint popup. In genHintItemHTML app/src/protyle/hint/extend.ts, a candidate block's name, alias, and memo fields are concatenated into the popup's HTML without escaping. An attacker who can se...
httpd: Apache HTTP Server: Cross-site scripting in mod_proxy_ftp via HTML directory list generation
A flaw was found in Apache HTTP Server, specifically within the modproxyftp module. This cross-site scripting XSS vulnerability occurs during the generation of HTML directory lists when the server is configured to list FTP directory contents via either a forward or reverse proxy. An attacker coul...
httpd: Apache HTTP Server: Cross-site scripting in mod_proxy_ftp via HTML directory list generation
A flaw was found in Apache HTTP Server, specifically within the modproxyftp module. This cross-site scripting XSS vulnerability occurs during the generation of HTML directory lists when the server is configured to list FTP directory contents via either a forward or reverse proxy. An attacker coul...
CVE-2026-73354
Unauthenticated Cross Site Scripting XSS in SimplyRETS Real Estate IDX = 3.2.8 versions...
CVE-2026-73182
Unauthenticated Cross Site Scripting XSS in BBQ Pro = 3.9 versions...
CVE-2026-73184
Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...