1162926 matches found
CVE-2026-96258
A cross-site scripting (XSS) vulnerability exists in the Public Password Reset Endpoint of onSite internet GmbH Auktion NG Auktionssoftware (versions up to 20260722). The flaw is located within the /forgotpasswd.html file, where manipulating the email argument allows for remote execution of the a...
CVE-2026-96258 onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting
A vulnerability has been found in onSite internet GmbH Auktion NG Auktionssoftware up to 20260722. This affects an unknown part of the file /forgotpasswd.html of the component Public Password Reset Endpoint. The manipulation of the argument email leads to cross site scripting. The attack is...
EUVD-2026-85012
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file studentsignup.php of the component Self-Registration. Performing a manipulation of the argument fullname results in cross site scripting. Remote...
CVE-2026-95957 SourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scripting
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file studentsignup.php of the component Self-Registration. Performing a manipulation of the argument fullname results in cross site scripting. Remote...
CVE-2026-95957 SourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scripting
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This issue affects the function prepend of the file studentsignup.php of the component Self-Registration. Performing a manipulation of the argument fullname results in cross site scripting. Remote...
CVE-2026-95957
A cross-site scripting (XSS) vulnerability exists in the SourceCodester Smart Attendance System with QR Code Scanner 1.0 within the Self-Registration component. The flaw is located in the prepend function of the student_signup.php file. By manipulating the full_name argument, an attacker can achi...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Site builders may also configure handlers for processing submissions. Remote Post Handlers send webform data to other servers via APIs. The module does not sufficiently...
CVE-2026-94684: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection...
PT-2026-97464
Contributor Cross Site Scripting XSS in Ditty = 3.1.69 versions...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Form submissions may include uploaded files. The module does not sufficiently force certain uploaded file types to download when served. Under certain site...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module does not sufficiently sanitize text counter configuration before passing options to the bundled jQuery Text Counter library. Under certain configurations, th...
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154
The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. The module provides JavaScript behaviours for announcing dynamic form updates to assistive technologies. In some configurations, due to improper sanitisation, specially...
PT-2026-97522
Name of the Vulnerable Software and Affected Versions OpenC3 COSMOS versions 5.0.6 through 7.2.0 Description An authenticated actor with system set permission can perform a stored cross-user cross-site scripting XSS attack. By sending a request to the 'POST /openc3-api/screen' endpoint, an attack...
CVE-2026-95530: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in PixelYourSite – Your smart PIXEL TAG Manager = 11.4.1 versions...
CVE-2026-95515: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Ninja Forms = 3.15.3 versions...
CVE-2026-94682: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Podcast Importer SecondLine = 1.5.6 versions...
CVE-2026-94671: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in The Post Grid = 7.9.5 versions...
CVE-2026-94500: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...