nas-web.add_user Arbitrary Command Execution

The vulnerability of the nas-web.adduser function in the GL.iNet GL-MT3000 router microprogramming system is related to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-14192

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-34495

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-34495 FMS Employee vulnerable to XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-18197

CVE-2026-18197 affects Link Library prior to 7.9.4. The issue is an improper neutralization of input during web page generation, enabling Cross-Site Scripting (XSS). The connected documents do not provide details on exploited components, versions beyond the affected range, specific root causes be...

CVE-2026-18197

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Link Library allows Cross-Site Scripting XSS. This issue affects Link Library: before 7.9.4...

PT-2026-65716

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Link Library allows Cross-Site Scripting XSS. This issue affects Link Library: before 7.9.4...

CVE-2026-18084

CVE-2026-18084 is an XSS vulnerability in the BlackBerry UEM Management Console due to improper neutralization of input during web page generation. Affected: BlackBerry UEM 12.23.0 QF8 or earlier. Impact: cross-site scripting with high potential impact; no exploitation details or remediations pro...

WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting Detection

Code for Recovery 12 Step Meeting List versions up to 3.14.33 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft a malicious URL...

PT-2026-114549

Уязвимость набора инструментов для веб-разработки DevTools браузеров Google Chrome и Microsoft Edge связана с недостаточной нейтрализацией специальных элементов в запросе. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании с помощью специально...

CVE-2026-66390

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

EUVD-2026-45901

An high privileged remote attacker can exploit an authenticated OS command injection vulnerability in the systemcertificates view due to improper neutralization of special elements in an OS command. This can result in a total loss of confidentiality, availability and integrity...

CVE-2026-15069

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization of input during web page generation...

CVE-2026-15091

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary scripts due to improper neutralization of input during web page generation...

EUVD-2026-45263

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization of input during web page generation...

CVE-2026-15069 Multiple Vulnerabilities in IBM Engineering AI hub.

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to execute arbitrary script code due to improper neutralization of input during web page generation...

EUVD-2026-45060

Improper neutralization of input during web page generation 'cross-site scripting' in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network...

PT-2026-60842

Name of the Vulnerable Software and Affected Versions IBM Engineering AI Hub versions 1.0.0 through 1.2.0 Description Improper neutralization of input during web page generation allows a remote attacker to execute arbitrary script code. This issue is a Cross-Site Scripting XSS flaw, where an...

CVE-2026-58643

Improper neutralization of input during web page generation 'cross-site scripting' in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network...

Windows Admin Center Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Windows Admin Center allows an unauthorized attacker to perform spoofing over a network...