CVE-2026-101109 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager (Free) < 6.5.8

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free tag, to be injected into the page...

EUVD-2026-88437

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Vehicle Manager Free tag, to be injected into the page...

CVE-2026-101109

The Joomla Extension - ordasoft.com - Vehicle Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.5.8 . The root cause is that the public vehicle-detail page (triggered by task=view) echoes the title request parameter directly into a double-quoted HTML attr...

[SECURITY] [DSA 6525-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6525-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 28, 2026 https://www.debian.org/security/faq -...

CVE-2026-100753 Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager (Free) < 6.7.9

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

EUVD-2026-88435

Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Real Estate Manager Free element to execute in the browser of anyone who loads the crafted link...

CVE-2026-100753

The Joomla Extension - ordasoft.com - Real Estate Manager (Free) is vulnerable to Reflected Cross-Site Scripting (XSS) in versions prior to 6.7.9 . The issue exists on the public property-detail page's "leave a review" form, where the title field repopulates from the request without any escaping ...

Security Bulletin: IBM DataPower Gateway affected by cross-site scripting due to DOMPurify (CVE-2026-66010)

Summary IBM DataPower Gateway has addressed CVE-2026-66010 in 11.0.0.3, 10.6.0.11, and 10.5.0.23 Vulnerability Details CVEID:CVE-2026-66010 DESCRIPTION: DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOMELEMENTHANDLING.tagNameCheck, allowing...

Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i

Summary IBM Rational Developer for i is affected by cross-site scripting vulnerabilities in DOMPurify CVE-2026-65898, CVE-2026-65900, CVE-2026-65901, CVE-2026-49458, CVE-2026-49459, CVE-2026-49978, CVE-2026-66010, and CVE-2026-75838, a protection mechanism failure vulnerability in DOMPurify...

EUVD-2026-88240

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28...

CVE-2026-87752

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6...

EUVD-2026-88222

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6...

CVE-2026-87752 HTML Injection in Rolantis Information Technologies' Agentis

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 before 4.6...

CVE-2026-87752

A cross-site scripting (XSS) vulnerability exists in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis due to improper neutralization of input during web page generation. This flaw specifically allows XSS Targeting HTML Attributes . The vulnerability affects versions f...

EUVD-2026-88200

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7172: parameter 'Nombre Completo' in the endpoint '/administrator/index.php?option=comvirtuemart&page=admin.userlist'. Successful exploitation of this vulnerability could allow an authenticated...

CVE-2026-82387

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with media-upload rights to store active content on Roller's origin, because the media upload feature trusts the upload-supplied content type and serves the stored file back wit...

CVE-2026-91204

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it...

CVE-2026-82546

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped...

CVE-2026-82381

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...

EUVD-2026-88140

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' in Apache Roller 6.1.5 allows a user with authoring rights on a weblog to store crafted content that is later written into the authoring UI's JavaScript string literals and markup sinks without proper encoding,...