CVE-2026-100380

CVE-2026-100380: Reflected XSS in language-validation errors Reporter: Marco Paciaroni BomboBombone. Wikibase included unescaped language-validation error text in the SetLabel page. Rejected input could be returned as executable HTML before the request reached the label-saving operation. Affected...

CVE-2023-43341-Evolution-Reflected-XSS---Installation-Connection-

Evolution CMS Reflected XSS v3.2.3 Author: Sergio Description: A cross-site scripting XSS reflected vulnerability in the evolution v.3.2.3 installation process connection allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the uid parameter. Attack Vectors...

CVE-2023-29489

Introductoin An exploitable reflected cross-site scripting XSS vulnerability has been discovered in certain versions of cPanel and was assigned with CVE-2023-29489. This vulnerability allows attackers to execute arbitrary JavaScript code without requiring authentication. The XSS vulnerability can...

toxssin

toxssin Purpose toxssin is an open-source penetration testing tool that automates the process of exploiting Cross-Site Scripting XSS vulnerabilities. It consists of an https server that works as an interpreter for the traffic generated by the malicious JavaScript payload that powers this tool...

CVE-2026-17089-PoC-pwnVader

CVE-2026-17089 — Events Manager = 7.4.0.1 — Unauthenticated reflected XSS headerformat Author: pwnVader · License: MIT repository root | ---|--- Component| Events Manager – Calendar, Bookings, Tickets, and more! WordPress plugin Type| CWE-79 — Reflected Cross-Site Scripting Affected| = 7.4.0.1...

CVE-2026-93638

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite ZCS allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input...

CVE-2026-55486

The Goobi viewer web application (versions 25.08 to before 26.05 ) is vulnerable to reflected XSS and CSP malformation due to an unsanitized origin query parameter in the IIIF Auth 2.0 endpoints (auth/login and auth/token) within AuthorizationFlowResource. The application fails to validate this p...

CVE-2026-55486 Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then 1 embe...

EUVD-2026-109067

The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then 1 embe...

CVE-2026-10632

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite ZCS allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When...

CVE-2019-10475

CVE-2019-10475 Quick POC for Jenkins CVE-2019-10475 / SECURITY-1490 reported on 2019-10-23. The issue is within the build-metrics plugin which generates some basic build metrics. It's commonly used with the Jenkins sidebar links plugin. This is a simple & generic reflected XSS vulnerability. The...

reflector

reflector Description Burp Suite extension is able to find reflected XSS on page in real-time while browsing on web-site and include some features as: Highlighting of reflection in the response tab. Test which symbols is allowed in this reflection. Analyze of reflection context. Content-Type...

CVE-2022-23378

CVE-2022-23378 : Reflected XSS in TastyIgniter v3.2.2 Restaurtant CMS Authenticated reflected XSS exists in the TastyIgniter Admin dashboard in version v3.2.2. Mitre URL: https://vulners.com/cve/CVE-2022-23378 NIST URL: https://nvd.nist.gov/vuln/detail/CVE-2022-23378 Proof of Concept POC: Admin...

CVE-2026-93638 Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite ZCS allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input...

CVE-2026-93638

The Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.17 are vulnerable to a pre-authentication reflected cross-site scripting (XSS) vulnerability. The flaw exists in the login page when processing the zrememberme parameter. An unauthenticated attacker can craft a relogin URL that trigge...

EUVD-2026-108977

A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite ZCS allows an unauthenticated attacker to execute JavaScript through the zrememberme parameter. A crafted relogin URL selects a two-factor error display that inserts the parameter into a hidden input...

iVANTI-CVE-2021-38560

iVANTI-CVE-2021-38560 Ivanti Service Manager 2021.1 infected with reflected XSS via the appName parameter associated with ConfigDB calls, such as in RelocateAttachments.aspx. Vulnerability Type: Cross Site Scripting XSS Vendor of Product: IVANTI Affected Product Versions: Service Manager - =...

CVE-2023-48858

CVE-2023-48858 PoC for CVE-2023-48858 A Cross-site scripting XSS vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part. Proof of Concept:...

CVE-2026-112863

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0...

CVE-2026-10632

A reflected cross-site scripting (XSS) vulnerability exists in the Classic Web Client of Zimbra Collaboration Suite (ZCS) . The root cause is the lack of HTML encoding when the document editor inserts package names into script attributes via the /h/rest endpoint's packages parameter. When chained...