118976 matches found
EUVD-2026-117993
The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting XSS when a user interacts with the crafted content...
CVE-2026-65022
The BigFix Mobile MDM App Catalog / App Store preview is vulnerable to Cross-Site Scripting (XSS) . The software fails to properly sanitize or encode user-supplied HTML before rendering it, allowing injected HTML to be displayed to users. This may result in XSS execution when a user interacts wit...
CVE-2025-64095
=== Description === DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. An unauthenticated user can upload and repla...
CVE-2026-97045
A flaw was found in golang.org/x/net/html. This vulnerability allows a remote attacker to conduct Cross-Site Scripting XSS attacks by supplying specially crafted HTML markup. The renderer fails to properly verify namespace transitions for elements foster-parented across foreign namespaces,...
CVE-2026-121949
A flaw was found in symfony/html-sanitizer. The HTML sanitizer fails to enforce configured media host and URL scheme restrictions on srcset and imagesrcset attributes. A remote attacker could exploit this vulnerability by submitting crafted HTML with image sources pointing to unauthorized domains...
CVE-2020-12625
CVE-2020-12625: Cross-Site Scripting via Malicious HTML Attachment in Roundcube Webmail A Cross-Site scripting XSS vulnerability exists in Roundcube versions before 1.4.4, 1.3.11 and 1.2.10. By leveraging the "" XML element in a mail with a "text/html" attachment, an attacker can bypass the...
CVE-2026-111059
A flaw was found in Mercury. The application fails to properly sanitize raw HTML when converting user-controlled Markdown into web components. A remote attacker could exploit this vulnerability by providing malicious Markdown containing active HTML elements or scripts, resulting in Cross-Site...
CVE-2026-86606
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any...
CVE-2026-110813
The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the...
CVE-2025-52204
CVE-2025-52204 – Reflected XSS / HTML Injection in Znuny customer.pl endpoint Summary A Reflected Cross-Site Scripting XSS and HTML Injection vulnerability exists in Znuny, allowing attackers to inject arbitrary JavaScript or HTML via the parameter defined by the system configuration...
CVE-2018-5146
CVE-2018-5146 's exp and poc poc.ogg ：self-constructed poc file cve-test2.html ：exploit file crctest.exe：calculate the crc32 of the ogg file...
CVE-2020-6418
CVE-2020-6418 The CVE 2020-6418 is about the the type confusion in V8 in Google chrome.The affected versions were prior to 80.0.3987.122. The vulnerability is achived by remote attacker accessing the shell of a target device via a crafted HTML page. Environment Requirements 1. Google Chrome with...
CVE-2026-110813 Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection
The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the...
CVE-2026-110813
The Advanced Custom Fields (ACF®) WordPress plugin before version 6.8.11 is vulnerable to an unauthenticated stored XSS vulnerability. The root cause is the improper sanitization of a stored field definition, which can be modified through its comment handling. An attacker can inject a payload tha...
EUVD-2026-117909
The Advanced Custom Fields ACF® WordPress plugin before 6.8.11 does not properly sanitize a stored field definition that can be modified through its comment handling, allowing unauthenticated users to inject a payload that is emitted as an HTML attribute name and executed as JavaScript in the...
CVE-2026-86606 iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any...
CVE-2026-86606
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin versions before 3.13.7 is vulnerable to an unauthenticated stored XSS vulnerability. The root cause is a failure to properly escape content re-emitted through its bundled HTML parser . This allows unauthent...
EUVD-2026-117906
The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not properly escape content it re-emits through its bundled HTML parser, allowing unauthenticated users to inject arbitrary web scripts in pages that will execute in the session of any...
CVE-2023-39144
CVE-2023-39144 Background I discovered this vulnerability in May of 2023. Element55 produces software for law offices to track time. This software pulls information from various locations, such as Exchange, SQL, and Shoretel. Timeline May 24, 2023 - Reported vulnerability to Element 55 May 25, 20...