CVE-2014-9219

CVE-2014-9219 CVE-2014-9219 XSS POC About The vulnerability is caused by an input validation error in the redirection feature in url.php in phpMyAdmin 4.2.x before 4.2.13.1 when processing url parameter. A remote attacker can trick the victim to follow a specially crafted link and execute arbitra...

CVE-2022-29598

CVE-2022-29598 : Reflected Cross-Site Scripting XSS in RSS v500 Mitre URL: https://vulners.com/cve/CVE-2022-29598 NIST URL: https://nvd.nist.gov/vuln/detail/CVE-2022-29598 The RRS v500 application by Solutions Atlantic is vulnerable to a reflected Cross-Site Scripting XSS vulnerability...

CVE-2026-102626

LimeSurvey Community Edition 7.4.0 is vulnerable to a Stored XSS flaw. An authenticated user with the global Surveys: create permission can inject a JavaScript-breaking value into the date_min attribute of a Date/Time question. Because the application fails to perform JavaScript-context encoding ...

CVE-2026-102626 LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute

An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the datemin attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted...

PT-2026-94161

Name of the Vulnerable Software and Affected Versions WPLP Cookie Consent versions prior to 4.4.4 Description In multisite installations, the plugin fails to escape a value submitted through a public endpoint before it is output within a JavaScript context on an administrative screen. This allows...

CVE-2026-88593: Improper Neutralization of Input During Web Page Generation

kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts...

Astra Linux – Vulnerability in Golang-1.19

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution...

PT-2026-81131

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...

CVE-2026-56858 Fix Javascript regexp context tracking in html/template

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CVE-2026-15245 BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...

PT-2026-68862

Name of the Vulnerable Software and Affected Versions BNE Testimonials versions prior to 2.0.8.2 Description Users with the contributor role and above can perform a Stored Cross-Site Scripting XSS attack. This occurs because the plugin fails to properly escape a shortcode attribute for a JavaScri...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS does not escape user-controlled field values in a JavaScript context. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission.As of publication of...

CVE-2026-70440

Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

PT-2026-68275

Name of the Vulnerable Software and Affected Versions Jenkins Qualys Container Scanning Connector Plugin versions prior to 1.8.0.6 Description Stored cross-site scripting XSS occurs because user-controlled field values are not properly escaped within a JavaScript context. This issue can be...

CVE-2026-70440: Improper Neutralization of Input During Web Page Generation

Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...

CVE-2026-70441: Improper Neutralization of Input During Web Page Generation

Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission...

Incorrect Authorization

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Incorrect Authorization injection of $vars into the custom JavaScript execution context without proper authorization checks. An attacker can access sensitive workspace variables, including secrets from...

CVE-2026-39900

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the authprofile.php JavaScript context. This issue has been fixed in version 1.2.31...

EUVD-2026-39135

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the authprofile.php JavaScript context. This issue has been fixed in version 1.2.31...

CVE-2026-39900: Improper Neutralization of Input During Web Page Generation

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior are vulnerable to Reflected XSS via tab parameter in the authprofile.php JavaScript context. This issue has been fixed in version 1.2.31...