CVE-2026-104448

YesWiki versions prior to 4.6.7 are vulnerable to a cross-site request forgery (CSRF) vulnerability within the ajaxdeletepage handler. The root cause is the application's failure to validate a CSRF token on GET requests that include a jsonp_callback parameter. An attacker could entice a logged-in...

EUVD-2026-91425

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost...

xsshunter

사용 중단 - 새 EXPRESS 버전을 사용하세요 자세한 내용은 여기를 참조하세요: https://github.com/mandatoryprogrammer/xsshunter-express XSS Hunter 소스 코드 이것은 https://xsshunter.com 에서 실행되는 소스 코드의 이식 가능한 버전입니다. 보안 전문가와 버그 바운티 헌터가 훨씬 더 강력한 방식으로 XSS를 테스트할 수 있도록 모든 서버에 쉽게 설치할 수 있도록 설계되었습니다. 이 소프트웨어를 설정하고 싶지 않고 바로 테스트를...

CVE-2020-11022

Jadi gini jadi gini gais, CVE-2020-11022 itu kan kerentanan pada jquery yang di bawah versi 3.5.0 atau keatas, kerentanan CVE-2020-11022 itu sendiri yaitu memicu sebuah XSS dengan memanfaatkan DOM Manipulation seperti i.e. .html, .append, dan lainnya, untuk melakukan eksekusi kode XSS berbahaya. ...

CVE-2026-59668

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizebills/store”...

CVE-2026-64638-WordPress-Core-XSS2Shell

CVE-2026-64638 — Nuclei 탐지 템플릿 WordPress Core의 사전 인증 differential parser인 XSS2Shell 을 비침습적으로 탐지하기 위한 Nuclei 템플릿으로, 로그인 페이지에 DOM 요소를 주입할 수 있어 XSS → RCE 체인의 기반이 됩니다. ⚠️ 이 템플릿은 탐지만 수행합니다 HTML 응답에서 마커가 반사되는 단계. DOM clobbering, JSONP/SOME, Application Password 탈취 또는 플러그인 업로드 등 전체 공격 체인은 실행하지 않습니다. 명시적...

CVE-2026-59668 Multiple vulnerabilities in the Repasat application

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizebills/store”...

EUVD-2026-91370

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizebills/store”...

hono: hono/jsx: Cross-Site Scripting via Unescaped Strings

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...

CVE-2026-59672

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomGrupoEmpresarial” parameter is affected – endpoint "/es/corporategroups/update/246”...

CVE-2026-59673

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTipoCli” parameter is affected – endpoint “/es/clientypes/update/109441”...

CVE-2026-59661

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomRuta” parameter is affected – endpoint “/es/routes/update/693”...

CVE-2026-59659

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomZonaGeo” parameter is affected – endpoint “/es/geozones/update/149979”...

CVE-2026-59664

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomServicioPrestado” parameter is affected – endpoint “/es/providedservices/store”...

CVE-2026-59662

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”...

EUVD-2026-91368

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomTamano” parameter is affected – endpoint “/es/companysizemployees/update”...

CVE-2026-59667

The Repasat application contains a Cross-Site Scripting (XSS) vulnerability (CWE-79). The issue exists in the "nomTamano" parameter within the "/es/companysizemployees/update" endpoint. Successful exploitation could allow an attacker to deceive a user into executing arbitrary code within their br...

CVE-2026-59666

The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability. The flaw exists in the "nomOrigen" parameter located at the "/es/origins/store" endpoint. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within their web browser. No s...

CVE-2026-59665 Multiple vulnerabilities in the Repasat application

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomMotivo” parameter is affected – endpoint “/es/lostmotives/store”...

EUVD-2026-91360

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomCompetidor” parameter is affected – endpoint “/es/competitors/store”...