Lucene search
+L

99022 matches found

Github Security Blog
Github Security Blog
added 2026/09/09 5:59 p.m.10 views

decidim-elections: Election question titles allow stored script execution

Description A low-privilege process-scoped admin who can manage elections can store arbitrary HTML in the question statement/body without sanitization, and the public elections UI renders that value unsafely. Technical description This stored XSS appears because election question titles are...

SaveExploits0References3Affected Software1
Github Security Blog
Github Security Blog
added 2026/09/09 5:56 p.m.11 views

LF Edge eKuiper: Self-XSS in External Service Creation

Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...

SaveExploits0References3Affected Software1
OSV
OSV
added 2026/09/09 5:21 p.m.6 views

DRUPAL-CONTRIB-2026-146

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not sufficiently sanitize user-supplied data before displaying it in generated HTML leading to a cross-site scripting...

5.6AI score
SaveExploits0References1
NVD
NVD
added 2026/09/09 5:17 p.m.9 views

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

5.4CVSS0.00171EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/09 4:46 p.m.7 views

CVE-2026-36341

Cross-Site Scripting XSS vulnerability exists in Webkul Krayin CRM HTML Injection CVE: CVE-2026-36341 Summary The vulnerability is particularly critical because it affects the Admin Panel. In many CRM workflows, managers or higher-level admins review activities logged by staff. By injecting a...

5.4CVSS5.9AI score0.0021EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/09 4:44 p.m.12 views

CVE-2026-87928

MaxSite CMS versions 0.94 through 109.6 contain a stored cross-site scripting vulnerability in the admin_page upload handler . Any logged-in user can upload HTML files to the uploads/_pages/ directory containing malicious scripts that execute in visitors' browsers when accessed, enabling persiste...

5.4CVSS0.00171EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/09 4:44 p.m.8 views

EUVD-2026-75110

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the adminpage upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/pages/ directory, which executes in visitors' browsers wh...

5.4CVSS0.00171EPSS
SaveExploits0References4
Kitploit
Kitploit
added 2026/09/09 4:21 p.m.6 views

CVE-2025-64095

=== Descripción === DNN anteriormente DotNetNuke es una plataforma de gestión de contenidos web CMS de código abierto en el ecosistema de Microsoft. Antes de la versión 10.1.1, el proveedor de editor HTML predeterminado permite la carga de archivos no autenticados y las imágenes pueden sobrescrib...

10CVSS5.9AI score0.44656EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/09 4:18 p.m.8 views

CVE-2026-2441

CSS in Google Chrome prior to Remote Code Execution CVE-2026-2441 Overview A HIGH vulnerability, classified as CVE-2026-2441, has been identified, categorized under CWE-416, CWE-416, CVSS 8.8. Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute...

8.8CVSS8.1AI score0.22378EPSS
SaveExploits12
RedHat Linux
RedHat Linux
added 2026/09/09 4:12 p.m.7 views

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

6.1CVSS5.9AI score0.0031EPSS
SaveExploits0References8
NVD
NVD
added 2026/09/09 2:17 p.m.6 views

CVE-2026-86771

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

8.3CVSS0.00188EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/09 1:32 p.m.7 views

EUVD-2026-74948

Snipe-IT versions before 8.7.0 fail to HTML-escape the employeenum field in the acceptance PDF generator, allowing attackers with users.edit permission to inject img tags into TCPDF's writeHTML function. Attackers can craft a malicious employeenum value containing an img tag with an arbitrary HTT...

8.3CVSS0.00188EPSS
SaveExploits0References2
NVD
NVD
added 2026/09/09 12:17 p.m.5 views

CVE-2026-87813

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

8.4CVSS0.00261EPSS
SaveExploits0References2
RedHat Linux
RedHat Linux
added 2026/09/09 12:06 p.m.8 views

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

6.1CVSS5.9AI score0.0031EPSS
SaveExploits0References8
Kitploit
Kitploit
added 2026/09/09 11:55 a.m.6 views

django-xss-example

Prueba local Solo funciona en Linux. En Windows, una de las dependencias puede causar un error. Antes de ejecutar, es necesario instalar los siguientes paquetes: root@kitploit: pip install -r requirements.txt Asegúrate de que los paquetes se hayan instalado root@kitploit: python -m django --versi...

6AI score
SaveExploits0
Kitploit
Kitploit
added 2026/09/09 11:38 a.m.5 views

CVE-2020-0674-PoC

CVE-2020-0674 About the reproduction operation of this vulnerability: The key is the writing of HTML Python source code provides the function of automated testing of HTML web pages Using the IEdriver provided by the selenium library, tested to support IE11 Script usage requires inputting the HTML...

7.6CVSS7.4AI score0.86863EPSS
SaveExploits17
Cvelist
Cvelist
added 2026/09/09 11:21 a.m.35 views

CVE-2026-87813 SiYuan before v3.8.2 Stored XSS via unescaped asset filenames

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpolated into HTML without escaping. Authenticated attackers can craft asset filenames containing malicious markup that executes JavaScript in the victim's...

8.4CVSS0.00261EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/09 11:21 a.m.8 views

CVE-2026-87812

SiYuan before v3.8.2 is affected by a stored cross-site scripting vulnerability in Bazaar package cards. The root cause is that the iconURL metadata is inserted directly into HTML img src attributes without escaping , allowing attackers to inject malicious URLs with embedded event handlers. When ...

7.4CVSS0.00204EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/09/09 11:21 a.m.35 views

CVE-2026-87812 SiYuan before v3.8.2 Stored XSS via Bazaar iconURL

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

7.4CVSS0.00204EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/09 11:21 a.m.6 views

CVE-2026-87812 SiYuan before v3.8.2 Stored XSS via Bazaar iconURL

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted directly into HTML img src attributes without escaping. Attackers can inject malicious URLs with event handlers that execute JavaScript in the authenticated...

7.4CVSS6AI score
SaveExploits0References4
Rows per page
Query Builder