CLEANSTART-2026-MJ23189 Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code

Security vulnerability affects the nodejs-24 package. Maliciously crafted export names in an imported WebAssembly module can inject JavaScript code...

PT-2026-120600

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect...

PT-2026-120583

Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api/v1/tickets/search to loop mongod for denial of service or...

CVE-2024-5139: Improper Neutralization of Input During Web Page Generation

The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of malicious JavaScript payloads. This vulnerability can be triggered by submitting crafted input to the Authentication Endpoint. Successful exploitation allows an attacker to redirect...

WSO2 Enterprise Integrator cross-site scripting vulnerability

WSO2 Enterprise Integrator versions prior to 6.6.0 and 6.6.0.204; WSO2 Identity Server versions prior to 5.10.0 and 5.10.0.310, 6.0.0 and 6.0.0.212, 6.1.0 and 6.1.0.195, and 7.0.0 and 7.0.0.64; WSO2 API Manager versions prior to 3.1.0 and 3.1.0.286, 3.2.0 and 3.2.0.376, 3.2.1 and 3.2.1.10, 4.0.0...

CVE-2026-28330

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting XSS vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages...

CVE-2026-28330 SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting XSS vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages...

CVE-2026-28330

The SolarWinds Observability Self-Hosted platform is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). This flaw allows authenticated attackers to inject malicious content or JavaScript into the system. The injected script is then displayed or executed in the browsers of oth...

EUVD-2026-105179

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting XSS vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages...

CVE-2026-28330 SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting XSS vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages...

Chris Trudesk input validation error vulnerability

Versions 1.2.11 and earlier of Chris Trudesk contain an input validation error vulnerability. This vulnerability stems from server-side JavaScript injection in the search parameter; authenticated users can inject code into MongoDB’s $where clause. By disabling regular expressions in GET...

PT-2026-118506

SolarWinds Observability Self-Hosted was found to be affected by a stored Cross-Site Scripting XSS vulnerability that allows authenticated attackers to inject malicious content or JavaScript, which is displayed or executed in the browsers of other authenticated users who access the affected pages...

PT-2026-117545

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak System versions 2.3.6.0 through 2.3.6.1 Description An authenticated attacker can exploit a stored cross-site scripting XSS flaw where the web application fails to properly sanitize or HTML-encode user-supplied input before it is...

IBM Concert cross-site scripting vulnerability

The IBM Concert versions 1.0 to 3.0.0 have a cross-site scripting vulnerability. This vulnerability stems from cross-site scripting issues, allowing unverified attackers to inject arbitrary JavaScript code into the Web UI, thereby altering intended functions and potentially leading to the exposur...

CVE-2026-106149

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

CVE-2026-106149

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

PT-2026-114941

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

CVE-2026-109960

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customerindex.php. Script executes when an administrator views the customer overview with the Theme column...

CVE-2026-109960

Froxlor versions 2.0.0 before 2.3.14 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. Authenticated customers can inject malicious HTML and JavaScript by providing a craftied theme value via customer_index.php . The payload executes in an administrator's browser when they view the cust...

CVE-2026-109960: Improper Neutralization of Input During Web Page Generation

Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customerindex.php. Script executes when an administrator views the customer overview with the Theme column...