Browser-Extension-Included-SVM-in-XSS

XSS Guard ML Browser extension Manifest V3 phát hiện Reflecte...

CVE-2026-102459

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks...

Lab-Reflected-XSS-with-some-SVG-markup-allowed-PRACTITIONER-LAB-Not-solved

Lab: Reflected XSS with some SVG markup allowed 📚 Studijní...

CVE-2026-102459 DigiWin｜EasyFlow .NET - Reflected Cross-site Scripting

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2026-102459

The EasyFlow .NET software developed by Digiwin is vulnerable to a Reflected Cross-site Scripting (XSS) vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript code within a user's browser by leveraging phishing attacks . No specific technical root cause, affected version...

EUVD-2026-89715

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2026-103049

A flaw was found in the MediaWiki Cargo extension. This vulnerability allows a remote attacker to conduct a reflected Cross-Site Scripting XSS attack due to improper input sanitization of table headers on the Special:CargoQuery page. By enticing a user to follow a specially crafted link, an...

EUVD-2026-89502

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

CVE-2026-103049

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

MediaWiki Wikibase Extension 1.46.0 Cross Site Scripting

MediaWiki Wikibase Extension versions before 1.46.1, 1.45.5, and 1.43.10 contain a reflected cross site scripting vulnerability in Special:SetLabel language validation. The supplied proof of concept submits a harmless marker and detects unescaped reflection...

CVE-2026-102459: Improper Neutralization of Input During Web Page Generation

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks...

CVE-2026-103590: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

CVE-2026-103587: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

PT-2026-103627

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office Transplant a module form. An attacker can craft a malicious link containing a JavaScript payload in the exceptions parameter. This...

CVE-2026-97253: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

PT-2026-103465

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

PT-2026-103628

Name of the Vulnerable Software and Affected Versions QloApps versions prior to 1.7.1 Description A reflected cross-site scripting issue exists in the back-office room type editor. The application fails to properly escape the room num, floor, and comment field values within input attributes. This...

CVE-2026-103589: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

CVE-2026-103588: Improper Neutralization of Input During Web Page Generation

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

PT-2026-103247

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...