Lucene search
+L

96366 matches found

EUVD
EUVD
added 2026/08/22 6:00 a.m.6 views

EUVD-2026-64216

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

5.5AI score
SaveExploits0References1
EUVD
EUVD
added 2026/08/21 9:29 p.m.7 views

EUVD-2026-64178

LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for ...

4.8CVSS5.3AI score
SaveExploits0References1
EUVD
EUVD
added 2026/08/21 9:16 p.m.8 views

EUVD-2026-64169

Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields og:title and og:description. An authenticated user with permission to modify...

4.6CVSS5.3AI score0.00033EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/21 9:16 p.m.10 views

CVE-2026-53468

Typemill versions prior to 2.23.0 are vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). The root cause is missing output encoding , allowing an authenticated user with permission to modify page metadata to inject arbitrary HTML attributes int...

4.6CVSS5.3AI score0.00033EPSS
SaveExploits0References2
CVE
CVE
added 2026/08/21 8:53 p.m.11 views

CVE-2026-69237

Esri Portal for ArcGIS versions 11.3 and prior contain an HTML injection vulnerability in an administrative API . A remote attacker with administrative privileges can insert arbitrary HTML into the API. The CVSS 3.1 score is 3.8 (LOW) , reflecting the high privilege requirement (PR:H) and limited...

3.8CVSS5.6AI score
SaveExploits0References1
EUVD
EUVD
added 2026/08/21 8:53 p.m.8 views

EUVD-2026-64085

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are...

3.8CVSS5.7AI score
SaveExploits0References1
EUVD
EUVD
added 2026/08/21 8:48 p.m.7 views

EUVD-2026-64157

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All...

5.4CVSS5.7AI score
SaveExploits0References1
CVE
CVE
added 2026/08/21 8:48 p.m.12 views

CVE-2026-69229

Esri Portal for ArcGIS versions 12.0 and prior are affected by an HTML injection vulnerability in the Portal for ArcGIS Home application. A remote, authenticated attacker can insert arbitrary HTML into the application, resulting in low confidentiality and integrity impact (CVSS 3.1: 5.4 MEDIUM )....

5.4CVSS5.5AI score
SaveExploits0References1
EUVD
EUVD
added 2026/08/21 8:46 p.m.6 views

EUVD-2026-64153

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All...

3.5CVSS5.7AI score
SaveExploits0References1
CVE
CVE
added 2026/08/21 8:46 p.m.8 views

CVE-2026-69238

Esri Portal for ArcGIS versions 11.5 and prior are affected by an HTML injection vulnerability in the Portal for ArcGIS Home application . A remote, highly privileged attacker can insert arbitrary HTML into the application. The CVSS 3.1 score is 3.5 (LOW) , reflecting the high privilege requireme...

3.5CVSS5.5AI score
SaveExploits0References1
NVD
NVD
added 2026/08/21 8:16 p.m.4 views

CVE-2026-27463

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

5.3CVSS
SaveExploits0References2
EUVD
EUVD
added 2026/08/21 8:12 p.m.7 views

EUVD-2026-64132

Defuddle cleans up HTML pages. Prior to 0.19.1, site extractors interpolate page-derived image alt and src values, og:image values, and video descriptions into HTML strings without context-appropriate escaping, and buildExtractorResponse returns this contentHtml without the main pipeline's...

8.2CVSS5.3AI score
SaveExploits0References4
CVE
CVE
added 2026/08/21 8:12 p.m.9 views

CVE-2026-61824

Defuddle (an HTML page cleaner) is vulnerable to cross-site scripting (XSS) prior to version 0.19.1 . Site extractors interpolate page-derived values—image alt/src attributes, og:image values, and video descriptions—into HTML strings without context-appropriate escaping. Additionally, buildExtrac...

8.2CVSS5.3AI score
SaveExploits0References4
EUVD
EUVD
added 2026/08/21 7:57 p.m.6 views

EUVD-2026-64124

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

5.3CVSS5.4AI score
SaveExploits0References2
CVE
CVE
added 2026/08/21 7:57 p.m.10 views

CVE-2026-27463

Combodo iTop , a web-based IT service management tool, prior to version 3.2.3 , exposes the full application version in the HTML title attribute of the logo on the login page. This allows unauthenticated remote attackers to fingerprint the exact version, facilitating targeted exploitation of know...

5.3CVSS5.4AI score
SaveExploits0References2
Cvelist
Cvelist
added 2026/08/21 7:57 p.m.14 views

CVE-2026-27463 Combodo iTop: Version disclosure via login page logo

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, the HTML title attribute of the logo in the login page contains the complete iTop version. This issue has been fixed in version 3.2.3...

5.3CVSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/08/21 7:35 p.m.71 views

modoboa 2.0.4 - Admin TakeOver

Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. id: CVE-2023-0777 info: name: modoboa 2.0.4 - Admin TakeOver author: r3Y3r53 severity: critical description: | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to...

9.8CVSS8AI score0.15207EPSS
SaveExploits4References4
Nuclei
Nuclei
added 2026/08/21 7:35 p.m.68 views

OPNsense - Cross-Site Scripting

A cross-site scripting XSS vulnerability in the act parameter of systemcertmanager.php in OPNsense before 23.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. id: CVE-2023-39002 info: name: OPNsense - Cross-Site Scripting author: Herry severity: medium description...

6.1CVSS6.1AI score0.01212EPSS
SaveExploits1References3
Nuclei
Nuclei
added 2026/08/21 7:35 p.m.57 views

WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting

Multiple cross-site scripting vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 notify or 2 blog parameter. id: CVE-2013-2287 info: name: WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting...

4.3CVSS5.3AI score0.09239EPSS
SaveExploits2References4
Nuclei
Nuclei
added 2026/08/21 7:35 p.m.23 views

Label Studio < 1.16.0 - Cross-Site Scripting

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

6.1CVSS5.3AI score0.01898EPSS
SaveExploits2References2
Rows per page
Query Builder