EUVD-2022-56034

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NPIBCF-NATUP-01/NMSCI-WebGui/backuprestore.jsp and NPIBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then ...

CVE-2022-26961

Italtel NetMatch-S 5.0.0-20200703 is vulnerable to Multiple Stored XSS due to improper neutralization of input during web page generation. The flaw exists in the backup_restore.jsp and storage.jsp components (under respective paths) via the name parameter . A malicious user can inject arbitrary J...

CVE-2026-38961

Cross-Site Scripting XSS vulnerability in the RSS Widget of Netgate pfSense Plus versions 26.03, 25.11.1 and pfSense CE version 2.8.1 allows remote authenticated attackers to inject arbitrary JavaScript via malicious content in an RSS feed title. The injected script executes in the browser of any...

PT-2026-85780

CVE-2026-38961: Stored XSS in Netgate pfSense RSS Widget versions 26.03, 25.11.1, CE 2.8.1. Malicious feed titles execute JS for any authenticated user viewing the dashboard. CVSS: N/A. Unpatched—restrict RSS access now. Details: https://t.co/XaOt7Xazw4 cybersecurit valtersit CVE CVEAlert infosec...

EUVD-2026-71456

A reflected cross-site scripting XSS vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an unauthenticated attacker t...

CVE-2022-26961

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NPIBCF-NATUP-01/NMSCI-WebGui/backuprestore.jsp and NPIBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then ...

CVE-2026-73848: Improper Neutralization of Input During Web Page Generation

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-56127

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...

CVE-2026-56126

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

CVE-2026-56128

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallscheduleedit.php. The schedule description is stored without HTML sanitization and subsequently inserted into an...

CVE-2026-56128

pfSense Plus before 26.07 and pfSense CE before 2.9.0 contain a stored cross-site scripting vulnerability in the firewall schedule editor. Authenticated users with the Firewall: Schedules: Edit privilege can inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The v...

CVE-2026-56127 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewallrulesedit.php. The firewall rule description is stored in the pfSense XML configuration with only backslash-escaping...

CVE-2026-56126 pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

CVE-2026-56126

pfSense Plus before 26.07 and CE before 2.9.0 contain a stored cross-site scripting (XSS) vulnerability in /status_monitoring.php . Authenticated users holding the Status: Monitoring privilege can inject arbitrary JavaScript by supplying unsanitized values in multiple POST parameters (e.g., graph...

EUVD-2026-70495

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

CVE-2026-85158

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-56126: Improper Neutralization of Input During Web Page Generation

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /statusmonitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-date...

PodcastGenerator 3.2.9 Cross Site Scripting

PodcastGenerator version 3.2.9 contains a persistent cross site scripting vulnerability in the Live Items functionality. Exploit Title: PodcastGenerator 3.2.9 - Stored XSS Date: 2026-08-08 Exploit Author: Sahil Arya Vendor Homepage: https://github.com/PodcastGenerator/PodcastGenerator Software...

PT-2026-85051

pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status monitoring.php. Multiple POST parameters including graph-left, graph-right, time-period, resolution, start-dat...