CVE-2025-29018

CVE-2025-29018 - Sistema de Banca por Internet 2.0.0 XSS Almacenado en pagesaddacctype.php Descripción Existe una vulnerabilidad de Cross-Site Scripting XSS Almacenado en Code Astro Sistema de Banca por Internet 2.0.0 debido a entrada no saneada en el parámetro name en pagesaddacctype.php. Los...

CVE-2021-3395

CVE-2021-3395 Descripción sugerida Una vulnerabilidad de cross-site scripting XSS en Pryaniki 6.44.3 permite a usuarios autenticados remotos cargar un archivo arbitrario. El código JavaScript se ejecutará cuando alguien visite el archivo adjunto. Tipo de Vulnerabilidad Cross Site Scripting XSS...

kibana-prototype-pollusion

CVE-2019-7609 Las versiones de Kibana anteriores a 5.6.15 y 6.6.1 contienen una falla de ejecución de código arbitrario en el visualizador Timelion. Un atacante con acceso a la aplicación Timelion podría enviar una solicitud que intente ejecutar código JavaScript. Esto podría permitir que un...

CVE-2023-33829

CVE-2023-33829: Stored-XSS-on-SCM-Manager-1.60 Resumen Se ha descubierto una vulnerabilidad en la versión SCM Manager 1.2 = 1.60 que permite a un atacante previamente autenticado con permisos de escritura ejecutar código javascript en campos específicos. Esta prueba de concepto se realiza en un...

CVE-2026-100751

Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions Pro 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open when the...

CVE-2026-100751

The Joomla Extension - regularlabs.com - Tabs & Accordions (Pro) versions 2.3.0 - 3.1.0 are vulnerable to Privileged stored XSS via data-rlta-url attributes. The component accepts a url option for an item and writes it to a generated attribute, which the browser subsequently passes to window.open...

EUVD-2026-88105

Joomla Extension - regularlabs.com - Privileged stored XSS via data-rlta-url attributes in Tabs & Accordions Pro 2.3.0 - 3.1.0 - Tabs & Accordions Pro accepts a url option for an item and writes it to a generated data-rlta-url attribute. The browser code passes that value to window.open when the...

CVE-2026-36226

CVE-2026-36226: Prueba de Concepto XSS de Crear Nuevo Usuario de Proyecto en Advantech WebAccess/SCADA Este repositorio contiene una prueba de concepto benigna para CVE-2026-36226, un problema de cross-site scripting en Advantech WebAccess/SCADA 8.0-2015.08.16. Este repositorio es solo para...

CVE-2021-40513

CVE-2021-40513 OSCAR McMaster 19.401235 Vulnerabilidad de Cross Site Scripting Reflejado Existe una vulnerabilidad de Cross Site Scripting reflejado en varias páginas de la versión 19.401235 de la aplicación OSCAR McMaster que permite la ejecución arbitraria de comandos JavaScript. Marcador de...

CVE-2026-73641: Improper Neutralization of Input During Web Page Generation

Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed...

Cross-site Scripting (XSS)

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the add and update methods of the Certificates API, which parse SSL certificates and store the issuer organization value without sanitization. An attacker...

CVE-2026-100639

SiYuan v3.8.3 is vulnerable to a Cross-Site Scripting (XSS) flaw due to a failure to HTML-escape the data-subtype attribute during gutter-button markup generation. This occurs when content containing a Kramdown inline attribute list (IAL) is pasted as plain-text Markdown. The shared Lute renderer...

CVE-2026-85081

The File Manager WordPress plugin before 8.0.5, FileOrganizer WordPress plugin before 1.2.1, File Manager Pro WordPress plugin before 2.1.3 do not correctly validate the origin of window messages received by the file browser they load on their admin screens, accepting any origin that is a leading...

CVE-2026-100521

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

EUVD-2026-87377

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary...

CVE-2026-100522

Versions of Cotonti through 1.0.0 are vulnerable to a reflected cross-site scripting (XSS) flaw in the message.php file. The root cause is the improper escaping of the lng parameter before it is displayed in the confirmation dialog. This allows unauthenticated attackers to craft malicious links c...

CVE-2026-100522 Cotonti through 1.0.0 Reflected XSS via message.php lng parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary...

CVE-2026-100521 Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor...

CVE-2026-100174

The AIL Framework tag selector component var/www/static/js/tags.js is vulnerable to stored cross-site scripting XSS. A user with the ability to create a custom tag could embed an HTML payload containing JavaScript event handlers e.g., or in the tag name. When another authenticated user opened a...

CVE-2026-100174

The AIL Framework tag selector component (specifically var/www/static/js/tags.js) is vulnerable to stored cross-site scripting (XSS) . The root cause is the lack of input sanitization for tag names; the application passes the displayField value directly to the jQuery .html() property in both the ...