Exploit for Cross-site Scripting in Interzen Zenshare_Suite

ZenShare Suite - Vulnerability Disclosure This repository con...

EUVD-2026-68467

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

CVE-2026-82868 @pdfme/schemas before 5.5.9 Cross-Site Scripting via SVG

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

CVE-2026-82867 @pdfme/schemas before 5.5.9 Cross-Site Scripting via Select

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the Select schema plugin that fails to sanitize option values before interpolating them into HTML via innerHTML. Attackers can supply malicious templates with crafted option values containing HTML and JavaScript to execu...

CVE-2026-82838

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-82838 Default webserver configuration with incorrect CSP

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-82838 Default webserver configuration with incorrect CSP

The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set...

CVE-2026-82868: Improper Neutralization of Input During Web Page Generation

@pdfme/schemas before 5.5.9 contains a cross-site scripting vulnerability in the SVG schema plugin that renders user-supplied SVG content directly to innerHTML without sanitization. Attackers can inject malicious SVG with embedded scripts, event handlers, or foreignObject elements to execute...

CVE-2025-63607: Improper Neutralization of Input During Web Page Generation

TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contactdisplay, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...

CVE-2025-63607

TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contactdisplay, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...

PT-2026-83985

TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contact display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...

EUVD-2025-210815

TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contactdisplay, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...

CVE-2025-63607

TechStore 1.0 is vulnerable to Cross Site Scripting XSS. In contactdisplay, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser...

CVE-2025-63607

The software TechStore 1.0 is vulnerable to Cross Site Scripting (XSS) . The vulnerability exists because the application's contact_display function echoes the id parameter verbatim into the rendered page without proper sanitization. This allows an attacker to execute arbitrary JavaScript in the ...

CubeCart 6.7.4 - Cross-Site Scripting

Exploit Title: CubeCart 6.7.4 - Cross-Site Scripting Attribute Injection in gui.class.php Date: 2026-06-08 Exploit Author: Mikail Kocadağ MKLKCDG Vendor Homepage: https://www.cubecart.com/ Software Link: https://github.com/cubecart/v6 Vulnerable Version: 6.7.4 Fixed Version: 6.7.5 CVE:...

Exploit for CVE-2026-18741

CVE-2026-18741 - Stored XSS in Worksuite SaaS...

EUVD-2026-68154

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

CVE-2026-14835: Improper Neutralization of Input During Web Page Generation

The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfilteredhtml capability, allowing users with contributor-level access a...

CVE-2026-55696

PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Prior to 2.0.5, AttachmentViewer.setAttachment in js/privatebin.js uses getAttachmentMimeType to accept attacker-controlled MIME types and uses getBlobUrl to create a same-origin blob before setting...