CVE-2026-76719

A security vulnerability exists in HPE OneView and HPE Synergy Composer (prior to v11.40 ) that may be exploited remotely. The vulnerability allows for Cross-Site Scripting (XSS) and URL Redirection , which can lead to session hijacking , data theft , or other unauthorized actions. The CVSS v3.1 ...

CVE-2026-76718 HPE OneView - Cross-site scripting vulnerability

A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions...

CVE-2026-76718 HPE OneView - Cross-site scripting vulnerability

A potential security vulnerability in HPE OneView can be exploited to allow remote session hijacking or other unauthorized actions...

CVE-2026-76718

A security vulnerability exists in HPE OneView (prior to v11.40 ) and HPE Synergy Composer (prior to v11.40 ), categorized as a Cross-Site Scripting (XSS) and URL Redirection issue. The flaw can be exploited remotely to facilitate remote session hijacking or other unauthorized actions. To remedia...

CVE-2026-84739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary JavaScript in the context of another user's browser session due to...

CVE-2026-84739

GitLab CE/EE versions from 13.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 are vulnerable to a Cross-site Scripting (XSS) issue. The root cause is the improper sanitization of path components within the merge request diff viewer . This flaw could allow an authenticated user to exe...

Cross-site Scripting

Apache Wicket is vulnerable to Cross-site Scripting. The vulnerability is due to improper neutralization of input during web page generation, where user-supplied input is included in generated HTML without proper escaping and attackers can inject malicious script payloads that execute in the...

CVE-2026-8732-EXPLOIT

CVE-2026-8732 – WordPress WP Maps Pro Exploit 인증되지 않은 관리자 계정 탈취 | CVSS 9.8 | 즉시 사용 가능 🔥 제공 내용 CVE-2026-8732용 완전 작동 Python 익스플로잇 인증 없는 관리자 계정 생성 매직 로그인 URL 반환 – 즉시 사이트 장악 WP Maps Pro ≤ 6.1.0에서 작동 무흔적, 깔끔, 기본적으로 로그 미남김 ⚡ 왜 저희를 선택해야 하나요 50개 이상의 취약한 대상에서 테스트 완료 불필요한 코드 없음 – 순수 익스플로잇 레드 팀, 모의 침투, 버그...

CVE-2026-100376

A flaw was found in the MediaWiki TemplateSandbox extension. A remote attacker could exploit this vulnerability by enticing a victim into previewing a page configured with a specially crafted sandbox prefix. This flaw can lead to Cross-Site Scripting XSS, enabling the execution of arbitrary scrip...

Cross-Site Request Forgery

Apache Wicket is vulnerable to cross-site request forgery. The vulnerability is due to unsafe allowances in the default FetchMetadataResourceIsolationPolicy, where any "simple top-level navigation" GET request is allowed regardless of Sec-Fetch-Site and Sec-Fetch-Mode, and Sec-Fetch-Site: same-si...

WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin oik versions = 4.15.4...

CVE-2026-102292

A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functionality of the file users.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-102290

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be...

CVE-2026-102264

A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file frontend/update-account.php of the component Edit Profile Feature. Performing a manipulation of the argument Name/Address/City results in cros...

CVE-2026-102292

A cross-site scripting (XSS) vulnerability exists in the coolbeans1212 MateisHomePage-Website application. The flaw is located in an unknown functionality within the users.php file, where a remote attacker can manipulate the Search argument to execute the attack. While the product uses continuous...

CVE-2026-102292 coolbeans1212 MateisHomePage-Website users.php cross site scripting

A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functionality of the file users.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The...

EUVD-2026-88642

A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functionality of the file users.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-102292 coolbeans1212 MateisHomePage-Website users.php cross site scripting

A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea2a4226deeca27ab1fb9df0552ec76444547811. Affected by this issue is some unknown functionality of the file users.php. This manipulation of the argument Search causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-102333

A flaw was found in httpdbg. The application fails to validate URL schemes in recorded HTTP request URLs before rendering them as clickable links in the web interface. An attacker who controls traffic recorded by httpdbg can supply a link containing malicious scripts, leading to stored Cross-Site...

CVE-2026-102290 CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting

A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be...