Cross-site Scripting (XSS)

Overview prowler is a Prowler is an Open Source security tool to perform AWS, GCP and Azure security best practices assessments, audits, incident response, continuous monitoring, hardening and forensics readiness. It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI,...

CVE-2026-57858

Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored cross-site scripting vulnerability in the BookingPageTagManager component that allows authenticated event owners to inject arbitrary JavaScript by supplying a malicious analytics tracking ID without sanitization. Attackers can close th...

Security Bulletin:Vulnerability in Spring Framework affects IBM Netezza Appliance

Summary The Spring Framework package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVE CVE-2026-41845 Vulnerability Details CVEID:CVE-2026-41845 DESCRIPTION: Due to incorrect escaping, the use of JavaScriptUtils.javaScriptEscape may lead to JavaScript code...

PT-2026-71154

Name of the Vulnerable Software and Affected Versions IBM i versions 7.3 through 7.6 Description An authenticated user can embed arbitrary JavaScript code into the Web UI. This stored cross-site scripting issue allows for the alteration of intended functionality, which could potentially lead to t...

PT-2026-70861

Name of the Vulnerable Software and Affected Versions MongoDB Server affected versions not specified Description An issue in the JavaScript scripting engine allows an authenticated user with write privileges to execute controlled code within the query scope of other users. This occurs when a...

EUVD-2026-55801

SQLBot through 1.10.0, fixed in commit c3f40a5, contains a stored cross-site scripting vulnerability in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. Attackers who can modify dashboard text widget content can inject arbitrary HTML and JavaScript that...

CVE-2026-18478

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...

CVE-2026-72594 lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload

A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...

CVE-2026-14293

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-15047 s2Member < 260805 - Contributor+ Stored XSS via Shortcode

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

EUVD-2026-54994

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-72576: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...

Cross-site Scripting (XSS)

Silverstripe CMS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of page titles when rendered in CMS breadcrumbs, which allows an attacker to inject malicious JavaScript that executes in the browser when the affected page list view is accessed...

CVE-2026-15245

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...

CVE-2026-15245

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...

CVE-2026-15245: Improper Neutralization of Input During Web Page Generation

The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into an inline script, allowing users with the contributor role and above to inject arbitrary JavaScript that executes in the browser of anyone viewing th...

CVE-2026-71446

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

CVE-2026-71446 Stored Cross-Site Scripting in AIL Framework Domain Screenshot View

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

CVE-2026-71446 Stored Cross-Site Scripting in AIL Framework Domain Screenshot View

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

GHSA-4F78-QHMW-8J8M Electron: DevTools JavaScript Injection via Unsanitized Dock State Parameter

Impact The mode option of webContents.openDevTools was not sanitized before use by the DevTools frontend. If an attacker can influence this value, script under their control may run in the DevTools context, which in unsandboxed configurations has access to Node.js. Apps are only affected if...