PT-2026-66829

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-52232

The FS Inc S3150-8T2F Switch (version 2.2.0D Build 118101 ) is susceptible to a reflected cross-site scripting (XSS) vulnerability within the /logo.asp component. An attacker can exploit this by providing a specially crafted URL to a victim, leading to the execution of arbitrary Javascript within...

Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2670)

Cross-site scripting XSS vulnerability in the Brother MFC-9970CDW printer with firmware G 1.03 and L 1.10 allows remote attackers to inject arbitrary web script or HTML via an arbitrary parameter name QUERYSTRING to admin/adminmain.html, a different vulnerability than CVE-2013-2507 and...

Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2671)

Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware L 1.10 allow remote attackers to inject arbitrary web script or HTML via the 1 id or 2 val parameter to admin/adminmain.html; 3 id, 4 val, or 5 arbitrary parameter name QUERYSTRING to...

Brother MFC-9970CDW Printers Cross-site Scripting (CVE-2013-2507)

Multiple cross-site scripting XSS vulnerabilities in the Brother MFC-9970CDW printer with firmware G 1.03 allow remote attackers to inject arbitrary web script or HTML via the 1 id parameter to admin/logtonet.html or 2 kind parameter to fax/copysettings.html, a different vulnerability than...

FreeBSD : Gitlab -- vulnerabilities (661d3db5-8bd9-11f1-9c40-2cf05da270f3)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 661d3db5-8bd9-11f1-9c40-2cf05da270f3 advisory. Gitlab reports: Sensitive Information Exposure issue in Workhorse impacts GitLab CE/EE Mass...

Alt-N MDaemon 20.0.x < 20.0.9 / 21.0.x < 21.0.8 / 21.5.x < 21.5.6 / 22.0.x < 22.0.7 / 23.0.x < 23.0.4 / 23.5.x < 23.5.5 / 24.0.x < 24.0.4 / 24.5.x < 24.5.3 / 25.0.x < 25.0.3 Stored XSS

The remote Windows host is running a version of MDaemon Email Server that is affected by a stored cross-site scripting XSS vulnerability. An attacker can send a specially crafted HTML e-mail message with JavaScript in an img tag. This could allow a remote attacker to load arbitrary JavaScript cod...

PT-2026-66702

Name of the Vulnerable Software and Affected Versions NewStatPress WordPress plugin versions prior to 1.4.5 Description Stored Cross-Site Scripting XSS occurs because the plugin fails to sanitize and escape data from unauthenticated visitor requests before storing it and subsequently displaying i...

PT-2026-66834

Name of the Vulnerable Software and Affected Versions AWS Ops Wheel versions prior to PR 168 Description Stored cross-site scripting occurs during the handling of participant URLs. An authenticated remote user can exploit this by providing a crafted participant url value containing a dangerous UR...

PT-2026-66691

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not sanitize or escape certain megamenu menu-item settings before storing them and outputting them on the front end, and does not require the unfiltered html capability to save them, allowing users with administrative...

PT-2026-66830

Name of the Vulnerable Software and Affected Versions Johnson Controls FM Systems Employee versions prior to 2025.3.1 Description Improper neutralization of script-related HTML tags in a web page allows for Cross-Site Scripting XSS, a condition where malicious scripts are injected into trusted...

CVE-2026-52232

A reflected cross-site scripting XSS vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

PT-2026-66679

ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/file served user-controlled HTML and SVG files with extension-derived content types, allowing stored cross-site scripting in the ComfyUI origin and access to browser-stored API tokens, settings, workflow...

CVE-2026-59232: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through...

PT-2026-66677

Name of the Vulnerable Software and Affected Versions ComfyUI versions prior to 0.28.0 Description The /view endpoint serves uploaded SVG files inline due to the absence of image/svg+xml and related XML content types from the dangerous-content-type handling. This allows for stored cross-site...

PostCSS XSS

The vulnerability of the PostCSS cascade style sheet transformation library is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

WordPress Powerkit – Supercharge your WordPress Site plugin <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Powerkit versions = 3.1.0...

PT-2026-66692

The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live ta...

PT-2026-66780

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through...

Qnap QTS and QuTS hero Cross-site Scripting (CVE-2026-41539)

A cross-site scripting XSS vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QTS...