CVE-2026-14824

The Quiz and Survey Master (QSM) WordPress plugin versions prior to 11.2.2 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape a question setting before it is outputted into an unquoted HTML attribute . This allows users with contributor-lev...

CVE-2026-14824 Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

EUVD-2026-52487

Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tagnames parameter of the GET /api/savecontentadmin endpoint, bypassin...

EUVD-2026-52452

A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performed from remote. A high complexity level...

PT-2026-67679

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-51144

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

PT-2026-67722

Name of the Vulnerable Software and Affected Versions Perspective version 5.0.0 Description A cross-site scripting issue exists in the built-in Debug plugin. Attackers can inject arbitrary HTML and JavaScript by providing table cell values with unescaped HTML markup. These values are interpolated...

CVE-2026-52370

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

CVE-2026-52370

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

CVE-2026-52370

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

CVE-2026-51144

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

CVE-2026-51144: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

PT-2026-67659

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is...

PT-2026-68576

Name of the Vulnerable Software and Affected Versions Events Manager versions prior to 7.4.2 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to inject malicious scripts into web pages viewed by other users. Recommendations Update to a version newer...

Schneider Electric Modicon Controllers M241, M251, M258, and LMC058 Improper Neutralization of Input During Web Page Generation (CVE-2025-13902)

CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause condition where authenticated attackers can have a victim's browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server...

CVE-2026-51144

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

CVE-2026-51144

A Cross Site Scripting (XSS) vulnerability exists in Soliton Systems MailZen Management Protal versions v.2.62 and v.2.63 . A remote attacker can exploit this flaw to execute arbitrary code by targeting the Role Name , First Name , Last Name , and Username fields. The vulnerability is characteriz...

PT-2026-67866

Name of the Vulnerable Software and Affected Versions Soliton Systems MailZen Management Portal versions 2.62 through 2.63 Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code. The flaw exists within the Role Name, First Name, Last Name, and Username fields...

Security Updates for Power BI Report Server (July 2026)

The Power BI Report Server installation on the remote host is missing a security update. It is, therefore, affected by a spoofing vulnerability: - Improper neutralization of input during web page generation 'cross-site scripting' in Power BI allows an authorized attacker to perform spoofing over ...

Linux Distros Unpatched Vulnerability : CVE-2026-15920

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links ...