Lucene search
+L

99012 matches found

NVD
NVD
added 2026/09/09 7:17 p.m.11 views

CVE-2026-54694

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

9.6CVSS0.00282EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/09 6:44 p.m.18 views

CVE-2026-54694

CVE-2026-54694 affects SkillTree (NationalSecurityAgency/skills-service), a micro-learning gamification platform, in versions prior to 4.4.2 . Two flaws chain into a Stored XSS that enables admin account takeover : StringHighlighter.js interpolates unencoded user input into HTML rendered via v-ht...

9.6CVSS0.00282EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/09 6:44 p.m.33 views

CVE-2026-54694 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

9.6CVSS0.00282EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/09 6:44 p.m.11 views

EUVD-2026-75116

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

9.6CVSS0.00282EPSS
SaveExploits0References1
OSV
OSV
added 2026/09/09 6:44 p.m.3 views

CVE-2026-54694 NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover

SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable attack chain, with three distinct exploitation paths of escalating impact. StringHighlighter.js builds an HTML string by interpolating raw value substrings...

9.6CVSS5.8AI score
SaveExploits0References3
Github Security Blog
Github Security Blog
added 2026/09/09 5:59 p.m.10 views

decidim-elections: Election question titles allow stored script execution

Description A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical description This stored XSS appears because election question titles are...

SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/09/09 5:56 p.m.11 views

LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

SaveExploits0References3Affected Software1
OSV
OSV
added 2026/09/09 5:21 p.m.6 views

DRUPAL-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

5.6AI score
SaveExploits0References1
NVD
NVD
added 2026/09/09 5:17 p.m.9 views

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

5.4CVSS0.00171EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/09 4:46 p.m.7 views

CVE-2026-36341

Vulnerabilidad de Cross-Site Scripting XSS en Webkul Krayin CRM Inyección HTML CVE: CVE-2026-36341 Resumen La vulnerabilidad es particularmente crítica porque afecta al Panel de Administración. En muchos flujos de trabajo de CRM, los gerentes o administradores de nivel superior revisan las...

5.4CVSS5.9AI score0.0021EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/09 4:44 p.m.12 views

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a stored cross-site scripting vulnerability in the admin_page upload handler . Any logged-in user can upload HTML files to the uploads/_pages/ directory containing malicious scripts that execute in visitors' browsers when accessed, enabling persiste...

5.4CVSS0.00171EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/09 4:44 p.m.8 views

EUVD-2026-75110

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

5.4CVSS0.00171EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/09 4:21 p.m.6 views

CVE-2025-64095

=== Description === DNN(前身为 DotNetNuke)是微软生态系统中一个开源的内容管理系统(CMS)。在 10.1.1 版本之前,默认的 HTML 编辑器提供商允许未经身份验证的文件上传,并且图片可以覆盖已有文件。未经身份验证的用户可以上传并替换已有文件,从而导致网站被篡改,同时结合其他问题,可注入 XSS 载荷。此漏洞已在 10.1.1 版本中修复(https://nvd.nist.gov/vuln/detail/CVE-2025-64095) root@kitploit: python PoC-CVE-2025-64095.py Enter target U...

10CVSS5.9AI score0.44656EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/09 4:18 p.m.8 views

CVE-2026-2441

CSS in Google Chrome prior to Remote Code Execution CVE-2026-2441 Overview A HIGH vulnerability, classified as CVE-2026-2441, has been identified, categorized under CWE-416, CWE-416, CVSS 8.8. Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute...

8.8CVSS8.1AI score0.22378EPSS
SaveExploits12
RedHat Linux
RedHat Linux
added 2026/09/09 4:12 p.m.7 views

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

6.1CVSS5.9AI score0.0031EPSS
SaveExploits0References8
NVD
NVD
added 2026/09/09 2:17 p.m.6 views

CVE-2026-86771

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

8.3CVSS0.00188EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/09 1:32 p.m.7 views

EUVD-2026-74948

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

8.3CVSS0.00188EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/09 12:17 p.m.5 views

CVE-2026-87813

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

8.4CVSS0.00261EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/09/09 12:06 p.m.8 views

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

6.1CVSS5.9AI score0.0031EPSS
SaveExploits0References8
Kitploit
Kitploit
added 2026/09/09 11:55 a.m.6 views

django-xss-example

Prueba local Solo funciona en Linux. En Windows, una de las dependencias puede causar un error. Antes de ejecutar, es necesario instalar los siguientes paquetes: root@kitploit: pip install -r requirements.txt Asegúrate de que los paquetes se hayan instalado root@kitploit: python -m django --versi...

6AI score
SaveExploits0
Rows per page
Query Builder