PT-2026-3603

A reflected cross-site scripting xss vulnerability exists in the modifyAeTitle functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability...

PT-2026-3604

A reflected cross-site scripting xss vulnerability exists in the modifyUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability...

MedDream PACS Premium emailfailedjob reflected cross-site scripting (XSS) vulnerability

Talos Vulnerability Report TALOS-2025-2255 MedDream PACS Premium emailfailedjob reflected cross-site scripting XSS vulnerability January 20, 2026 CVE Number CVE-2025-54495 SUMMARY A reflected cross-site scripting xss vulnerability exists in the emailfailedjob functionality of MedDream PACS Premiu...

MedDream PACS Premium modifyAnonymize reflected cross-site scripting (XSS) vulnerability

Talos Vulnerability Report TALOS-2025-2259 MedDream PACS Premium modifyAnonymize reflected cross-site scripting XSS vulnerability January 20, 2026 CVE Number CVE-2025-55071 SUMMARY A reflected cross-site scripting xss vulnerability exists in the modifyAnonymize functionality of MedDream PACS...

PT-2026-3748

Name of the Vulnerable Software and Affected Versions Fleet versions prior to 4.78.2 Fleet versions 4.53.3 through 4.77.1 Fleet versions 4.75.2 Fleet versions 4.76.2 Description Fleet, an open-source device management software, contains a cross-site scripting XSS flaw in its Windows MDM...

MedDream PACS Premium modifyTranscript reflected cross-site scripting (XSS) vulnerability

Talos Vulnerability Report TALOS-2025-2267 MedDream PACS Premium modifyTranscript reflected cross-site scripting XSS vulnerability January 20, 2026 CVE Number CVE-2025-53707 SUMMARY A reflected cross-site scripting xss vulnerability exists in the modifyTranscript functionality of MedDream PACS...

MedDream PACS Premium autoPurge reflected cross-site scripting (XSS) vulnerability

Talos Vulnerability Report TALOS-2025-2253 MedDream PACS Premium autoPurge reflected cross-site scripting XSS vulnerability January 20, 2026 CVE Number CVE-2025-54817 SUMMARY A reflected cross-site scripting xss vulnerability exists in the autoPurge functionality of MedDream PACS Premium 7.3.6.87...

PT-2026-3605

A reflected cross-site scripting xss vulnerability exists in the modifyCoercion functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger this vulnerability...

CVE-2026-23847

SiYuan (git/github kernel) prior to 3.5.4 is vulnerable to reflected XSS in /api/icon/getDynamicIcon via unsanitized SVG input. The content parameter is injected into the SVG tag without XML escaping, and the image/svg+xml response enables JavaScript execution in attackers’ context. Remediation:...

PT-2026-3492

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.5.4 Description SiYuan is a personal knowledge management system susceptible to reflected cross-site scripting. The issue occurs in the /api/icon/getDynamicIcon API endpoint. The endpoint generates SVG images for tex...

PT-2026-3493

Name of the Vulnerable Software and Affected Versions IsMyGym versions affected versions not specified Description A Reflected Cross-Site Scripting XSS issue exists in IsMyGym by Zuinq Studio. This allows an attacker to execute JavaScript code in a user's browser by sending a malicious URL...

CVE-2025-14375

The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 5.0.10 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-2861

CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl method has a cross-site-scripting vulnerability via query string parameter manipulation. This issue has been fixed in 5.2.12 and 5.3.1...

CVE-2026-23722

WeGIA (Web Manager for Charitable Institutions) before version 3.6.2 contains a Reflected Cross-Site Scripting (XSS) flaw in html/memorando/insere_despacho.php where the id_memorando GET parameter is echoed into HTML without proper sanitization/encoding. This allows unauthenticated attackers to i...

CVE-2026-0601 Nexus Repository 3 - Cross-Site Scripting

A reflected cross-site scripting vulnerability exists in Nexus Repository 3 that allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted request requiring user interaction...

PT-2026-2944

Name of the Vulnerable Software and Affected Versions Typesetter CMS versions up to and including 5.1 Description Typesetter CMS versions up to and including 5.1 have a reflected cross-site scripting XSS issue in the Editing component. The images parameter, submitted as images in a POST request, ...

CVE-2025-13701

The Shabat Keeper plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the $SERVER'PHPSELF' parameter in all versions up to, and including, 0.4.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrar...

PT-2026-2335

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal affected versions not specified Description An unauthenticated attacker can inject malicious scripts into a URL parameter. These scripts are reflected in the server response and executed in a user's browser when...

Testa 跨站脚本漏洞

Testa is an academic activity monitoring software from Testa. A cross-site scripting vulnerability exists in Testa version 3.5.1, which stems from a reflected cross-site scripting vulnerability in the redirect parameter in login.php that could lead to the execution of arbitrary JavaScript...

CVE-2025-69268 Spectrum reflected XSS

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Reflected XSS.This issue affects DX NetOps Spectrum: 24.3.8 and earlier...