CVE-2026-103049

A flaw was found in the MediaWiki Cargo extension. This vulnerability allows a remote attacker to conduct a reflected Cross-Site Scripting XSS attack due to improper input sanitization of table headers on the Special:CargoQuery page. By enticing a user to follow a specially crafted link, an...

EUVD-2026-89502

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

CVE-2026-103049

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

CVE-2026-102459: Improper Neutralization of Input During Web Page Generation

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks...

PT-2026-103627

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office Transplant a module form. An attacker can craft a malicious link containing a JavaScript payload in the exceptions parameter. This...

PT-2026-103629

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.0 Description A reflected cross-site scripting issue exists in the back-office room type editor's length of stay fields. Authenticated administrators can be induced to submit crafted POST requests containing...

PT-2026-103628

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office room type editor. The application fails to properly escape the room num, floor, and comment field values within input attributes. This...

PT-2026-103081

Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description Reflected Cross-site Scripting occurs when an application includes untrusted data in a web page without proper validation or encoding. Unauthenticated remote attackers can execute...

CVE-2026-103588: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

MediaWiki Wikibase Extension 1.46.0 Cross Site Scripting

MediaWiki Wikibase Extension versions before 1.46.1, 1.45.5, and 1.43.10 contain a reflected cross site scripting vulnerability in Special:SetLabel language validation. The supplied proof of concept submits a harmless marker and detects unescaped reflection...

CVE-2026-103590: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103589: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103437: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

PT-2026-103465

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

PT-2026-103247

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

CVE-2026-103587: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

PT-2026-103626

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office Hotel Reservation System Book Now search. The application fails to validate the date to and id room type parameters before copying the...

CVE-2026-103049: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

CVE-2026-97253: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

Linux Distros Unpatched Vulnerability : CVE-2026-53610

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects attacker-controlled...