1149012 matches found
ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input
A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...
EUVD-2026-54971
A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/taskid/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack...
CVE-2026-19378
A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/taskid/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack...
PT-2026-69389
Name of the Vulnerable Software and Affected Versions Cybozu Garoon affected versions not specified Description Cross-site scripting allows an arbitrary script to be executed in the web browser of a user logged in to the product. Recommendations At the moment, there is no information about a newe...
CVE-2026-57279: Improper Neutralization of Input During Web Page Generation
Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...
CVE-2026-19378: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/taskid/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack...
PT-2026-69865
Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.6 Description The staff action log model renders unescaped previous and new value fields, allowing the injection of stored cross-site scripting XSS into the staff interface. Stored XSS is a type of...
CVE-2026-17019: Improper Neutralization of Input During Web Page Generation
The JetEngine WordPress plugin before 3.8.13.1 does not sanitise uploaded SVG files before storing and serving them, and does not adequately restrict who can upload them, allowing unauthenticated attackers to upload a file containing malicious JavaScript that executes in the browser of any user w...
Debian dsa-6427 : wordpress - security update
The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6427 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6427-1 [email protected] https://www.debian.org/security/...
📄 WordPress 7.0.2 Code Execution / Cross Site Scripting
A proof of concept exploit for a reflected cross site scripting vulnerability in WordPress version 7.0.2. The vulnerability results from a parser differential between PHP striptags and WordPress KSES processing of usernames supplied to wp-login.php, allowing attacker-controlled markup to survive...
CVE-2026-19378 code-projects Task Management System CommentSave.php cross site scripting
A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/taskid/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack...
CVE-2026-19378 code-projects Task Management System CommentSave.php cross site scripting
A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/taskid/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack...
CVE-2026-19378
A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/taskid/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack...
CVE-2026-19378
CVE-2026-19378 affects code-projects Task Management System 1.0. The issue concerns unknown processing of the file path /user/CommentSave.php where manipulating arguments comment/task_id/mineId/recId/myName/myImage triggers a cross-site scripting (XSS) vulnerability. This vulnerability can be exp...
EUVD-2026-54259
CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...
Roundcube -- Multiple vulnerabilities
The Roundcube project reports: Missing basic validation for content proxied by the css proxy SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading islocalurl check remote content blocking bypass...
CVE-2026-71502
CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...
Cross-site Scripting (XSS)
Silverstripe CMS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of page titles when rendered in CMS breadcrumbs, which allows an attacker to inject malicious JavaScript that executes in the browser when the affected page list view is accessed...
